SUSPICIOUS — f1d0b836adce27185bccfeb542e2b1d9d69de4b53d95c48d073b3644f2c6f42c

SUSPICIOUS — f1d0b836adce27185bccfeb542e2b1d9d69de4b53d95c48d073b3644f2c6f42c is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 4 of 25 detection engines flagged it.

Identification

• SHA-256: f1d0b836adce27185bccfeb542e2b1d9d69de4b53d95c48d073b3644f2c6f42c
• SHA-1: 455bd57c63e48a3958f3a7f7501d93153eb65027
• MD5: 735465c86fc7c43063ef7aa61dadb696
• imphash: 895fbb56c02c3d2bca3125cef5da8730
• File type: pe · Size: 205638 bytes
• Verdict: suspicious (35/100)

Detections (4 of 25 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• Detect It Easy (packer/type): DIE:UPX 3.96
• Kaspersky (KVRT): Virus.Win32.Lamer.ks
• Microsoft Defender: Trojan:Win32/Vindor!pz

Embedded URLs

• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0

Embedded domains

• www.microsoft.com
• crl.microsoft.com

File paths

• D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140_threads.i386.pdb

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report