SUSPICIOUS — 95a419212a337c8133a61a8a35ab6de50378cca71830682c07b55e66a5a7325a.bin

SUSPICIOUS — 95a419212a337c8133a61a8a35ab6de50378cca71830682c07b55e66a5a7325a.bin is a zip sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (43/100). 1 of 54 detection engines flagged it.

Identification

• SHA-256: 95a419212a337c8133a61a8a35ab6de50378cca71830682c07b55e66a5a7325a
• SHA-1: 294798e6c3c1377079d78361bd5aaec1d0da9134
• MD5: 4f74fe0429bd2a91869d98a7aba5d366
• ssdeep: 98304:fhDkEki3rTO+okDwoFhKxOOzvqMxRGe/U4fY00edDY/fMF4lgCf6:fhDkQsk9FO1Sc/UKfdDGfCZX
• TLSH: T1BF613320B1ADCE22D08A9560F8FD6903FB8C7720B2EB0184175C9C759DA84FE654AB75
• Submitted as: 95a419212a337c8133a61a8a35ab6de50378cca71830682c07b55e66a5a7325a.bin
• File type: zip · Size: 4193849 bytes
• Verdict: suspicious (43/100)

Source: MalShare · first seen 2026-09-24T16:52:57.586Z · SHA-256 verified

Detections (1 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob

Why this verdict

The suspicious score of 43/100 is the fusion of 3 weighted signals:

• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Archive contains executables: 758ee4876b07587af3cc61594abeb809.exe, a21163b2f4c1a0eb65881363c4d0340b.exe, unins000.exe, unins001.exe, WhatsAppSetup.exe - static signal, weight 0.25, confidence 0.50

Archive contents (5 executables)

This zip carries 5 extracted members, each analyzed as its own sample:

• 758ee4876b07587af3cc61594abeb809.exe - a6967e7a3c2251812dd6b3fa0265fb7b61aadc568f562a98c50c345908c6e827
• WhatsAppSetup.exe - dd27f6990e8f069762093c6ffb90b4b0de4b9da0538793c5b79679a5c184cf40
• a21163b2f4c1a0eb65881363c4d0340b.exe - a6967e7a3c2251812dd6b3fa0265fb7b61aadc568f562a98c50c345908c6e827
• unins000.exe - 6371ddae0228fbe8643ceca0a037c9ff236da0a32a7a18b6d113b7e297e5c593
• unins001.exe - 433fb32291cccfaf7ac3effb0c2bbe7d62ec88114c4fc7a3fc2f83b89294c4df

Embedded domains

• vb.ch
• e.hk

File paths

• C:\W
• M:\mE
• W:\Rm

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report