MalwareTips
File verdict·Decided by the MT AI Engine
Our call

Malicious

Unsigned executable flagged by 19 engines including two tier-1 as abltrojan with data-destruction behavior.

abltrojan
Trust score12Critical
MT AI confidence · 82%
info.exe
6.1 MB
9f4a974810932b8dfc…370bfd2733
Antivirus engines
19 of 75 flagged
Code signing
Unsigned
Age
First seen 1y ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

82%Confidence
High
Reasoning

Nineteen engines report malicious, two of which are tier-1, with labels converging on abltrojan variants. The presence of T1485 in offensive techniques indicates destructive capability typical of trojans. The binary is unsigned and carries a medium-prevalence threat label that matches the engine families. Absence of sandbox malice and low tier-1 agreement are noted but insufficient to override the volume and tier of detections.

Key signals · 4

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. engines.tier1Malicious=2 with Fortinet and TrendMicro-HouseCall detections

  2. behaviour.offensiveTechniques=["T1485"]

  3. file.popularThreatLabel=abltrojan and popularThreatName=abltrojan

  4. engines.malicious=19 out of 71 reporting

Points in its favour
  • No malicious dropped children
  • No contacted malicious hosts
  • Medium prevalence with 29 submitters
Points against
  • Unsigned PE with 19 malicious detections
  • Offensive MITRE T1485 present
  • Consistent abltrojan family labels across engines
What to do

Treat as malicious; remove the file and scan the system for related artifacts.

Threat family attribution

abltrojan corroborated by 2 sources

  • VT (75 engines)
    abltrojan
  • MT AI Engine
    abltrojan
Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
12

Adversary techniques mapped to the MITRE ATT&CK framework.

T1027T1027.002T1059T1070.006T1071T1082T1083T1129T1485T1497.001T1518.001T1574.002
Spawned processes
3
$(unnamed)
"C:\Users\<USER>\Desktop\info.exe"
$(unnamed)
info.exe
$(unnamed)
"C:\Users\user\Desktop\info.exe"
Filesystem & mutexes
30
Files written15
  • C:\Users\<USER>\AppData\Local\Temp\_MEI58562\VCRUNTIME140.dll
  • C:\Users\<USER>\AppData\Local\Temp\_MEI58562\_bz2.pyd
  • C:\Users\<USER>\AppData\Local\Temp\_MEI58562\_ctypes.pyd
  • C:\Users\<USER>\AppData\Local\Temp\_MEI58562\_decimal.pyd
  • C:\Users\<USER>\AppData\Local\Temp\_MEI58562\_hashlib.pyd
+10 more
Files deleted15
  • C:\Users\<USER>\AppData\Local\Temp\_MEI58562\api-ms-win-core-console-l1-1-0.dll
  • C:\Users\<USER>\AppData\Local\Temp\_MEI58562\api-ms-win-core-datetime-l1-1-0.dll
  • C:\Users\<USER>\AppData\Local\Temp\_MEI58562\api-ms-win-core-debug-l1-1-0.dll
  • C:\Users\<USER>\AppData\Local\Temp\_MEI58562\api-ms-win-core-errorhandling-l1-1-0.dll
  • C:\Users\<USER>\AppData\Local\Temp\_MEI58562\api-ms-win-core-file-l1-1-0.dll
+10 more
Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache.

10 unseen
  • d045a72c3e4d21165e93…a310e8Never scanned
    never seen before
  • eb8fe2778c54213aa2cc…588e74Never scanned
    never seen before
  • 6f50b4dc2129ff8e2280…5de06cNever scanned
    never seen before
  • 8eccaba9321df69182ee…7395aeNever scanned
    never seen before
  • 5783c5c5a3ffce181691…7cfcc5Never scanned
    never seen before
  • 39e363c47d4d45beda15…76453cNever scanned
    never seen before
  • 91d7a4c39baac78c595f…dcd42cNever scanned
    never seen before
  • 6e6bfdc656f0cf22fabb…e57ab2Never scanned
    never seen before
  • b545db2339ae74c52336…619b68Never scanned
    never seen before
  • b9ae70e8f74615ea2dc6…3424f2Never scanned
    never seen before
No researcher-database hits
External threat-intel sources were not collected for this scan.
Antivirus engine breakdown

19 detections across 75 engines

19 malicious0 suspicious56 clean
Tier-117 engines
2flag
Top commercial AVs (low FP rate)
Tier-238 engines
9flag
Mainstream engines with mixed FP rates
Low-trust20 engines
8flag
Heuristic / generic-AI engines (high FP rate)
CrowdStrike
malicious
win/malicious_confidence_60% (W)
CTX
malicious
exe.trojan.generic
Cylance
malicious
Unsafe
Cynet
malicious
Malicious (score: 100)
DeepInstinct
malicious
MALICIOUS
Elastic
malicious
malicious (moderate confidence)
Fortinet
malicious
W32/PossibleThreat
Google
malicious
Detected
Gridinsoft
malicious
Trojan.Win64.Downloader.cl
Jiangmin
malicious
TrojanSpy.Agent.afwu
Lionic
malicious
Trojan.Win64.Shelm.tsCg
McAfeeD
malicious
ti!9F4A97481093
Paloalto
malicious
generic.ml
Sangfor
malicious
Trojan.Win32.Save.a
SentinelOne
malicious
Static AI - Suspicious PE
Skyhigh
malicious
BehavesLike.Win64.Dropper.vc
TrellixENS
malicious
Artemis!B049A74577D2
TrendMicro-HouseCall
malicious
Trojan.Win64.Gen.TL0101DH26ZK
Varist
malicious
W64/ABlTrojan.HZJM-7547
Hash 9f4a97481093… cross-referenced against 75 AV engines via our AV network.
PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

ent 8.00Unpacked
Section entropy7 sections
.text
6.50
.rdata
5.82
.data
1.83
.pdata
5.38
_RDATA
3.70
.rsrc
7.55
.reloc
5.25
0.0Packed threshold 7.28.0
Prevalence

How often this file shows up in the wild

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium
Unique uploaders
29
Moderate upload volume.
Total submissions
32
Includes repeat uploads by the same source.
First seen by VT
1y ago
Apr 19, 2025
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
4/19/2025, 5:45:20 PM
First seen (MalwareBazaar)
—
Last analysis (VT)
5/29/2026, 8:21:29 AM
Scanned here
5/30/2026, 2:52:18 PM
File name
info.exe
Size
6.05 MB
MIME type
(unknown)
Detected type
Win32 EXE
SHA-256
9f4a974810932b8dfc8a80417b3323054cbe4e90cc6885715b2467370bfd2733
MD5
b049a74577d29889cd1db21c80da6761
SHA-1
09d45b4e9be02dfa05dfc60b919f290e88898723
PE imphash
1af6c885af093afc55142c2f1761dbe8
First seen (VT)
4/19/2025, 5:45:20 PM
Last analysis (VT)
5/29/2026, 8:21:29 AM
First scan (MalwareTips)
5/30/2026, 2:52:18 PM
Last scan (MalwareTips)
5/30/2026, 2:52:18 PM
Behavior tags
peexe64bitsoverlaydetect-debug-environment
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scan another
Check a different file
URL instead?
Check if a link is safe
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.