Malicious
Unsigned executable exhibits process-injection and direct-IP C2 behaviour; tier-1 engine flagged with high confidence despite lack of named-family consensus.
b18aee985a949b17eb…60e3d511abThe verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
This sample presents a mixed-signal profile. On one hand, Symantec (a tier-1 engine) and Elastic (tier-2) both flagged it with high-confidence malicious labels, and the triggered heuristics document process-injection (T1055, T1055.003, T1134, T1620) and direct-IP C2 contact to 162.159.36.2 without DNS resolution — both strong malware indicators. On the other hand, only 1 tier-1 engine flagged it (not the ≥3 needed for strong consensus), no named malware family was identified, and 11 other tier-1 engines reported clean or failed to analyse. The file is unsigned, rare (9 days old, 1 submitter), and has no external-intel corroboration. The lack of a malicious sandbox verdict and no dropped malicious children further complicate the picture. However, the combination of tier-1 detection + offensive MITRE techniques + direct-IP C2 (which bypasses reputation systems) outweighs the absence of family consensus, especially given the unsigned and rare-new status.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
Symantec (tier-1) flagged 'ML.Attribute.HighConfidence' + Elastic (tier-2) flagged 'malicious (high confidence)' — 1/1 tier-1 engine malicious, 2 low-trust also flagged
triggeredHeuristics: MalwareTips.Synth.ProcessInjection [high] (T1055, T1055.003, T1134, T1620 observed) + MalwareTips.Synth.DirectIpC2 [medium] (direct-IP C2 to 162.159.36.2, no DNS)
unsigned file, no signer history, rare_new prevalence (1 submitter, 9 days old), no similar-hash RAG hits, no external-intel corroboration
behaviour: 4 offensive MITRE techniques (process injection, indirect syscall, process hollowing) + 6 ambient; no malicious sandbox verdict but direct-IP contact + injection pattern is strong malware indicator
tier1FamilyConsensus.family='attribute' but agreeingEngines=1 (not strong); no named-family consensus despite tier-1 + tier-2 detections
- No malicious sandbox verdict rendered
- No malicious dropped children detected
- No contacted hosts matched our malicious-host cache
- 11 tier-1 engines reported clean or failed (not all tier-1 engines agreed malicious)
- Unsigned executable with no publisher history
- Process injection (T1055, T1055.003) and process hollowing (T1134) observed
- Direct-IP C2 contact (162.159.36.2) without DNS resolution
- Tier-1 engine (Symantec) flagged with high-confidence malicious label
- Rare-new prevalence (9 days old, 1 submitter, 4 submissions)
- No external-intel corroboration (CIRCL, YARAify, MalwareBazaar all miss)
Treat this file as malicious and block execution. The process-injection and direct-IP C2 behaviour, combined with tier-1 detection, outweigh the lack of family consensus. If you have additional context suggesting legitimate use, submit it for re-analysis; otherwise, isolate and investigate any systems that may have executed it.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 224.0.0.251
- 224.0.0.252
- 162.159.36.2
YARA + heuristic rules that fired
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
Evidence"C:\Users\<USER>\Desktop\VistaShow.exe"Sample contacted 1 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence162.159.36.2
4 detections across 75 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Barely seen in the wild and first surfaced recently. This is the footprint of targeted malware the AV industry hasn't signatured yet — extra scrutiny is warranted.
Forensic fingerprint
- File name
- VistaShow.exe
- Size
- 2.80 MB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- b18aee985a949b17ebcc48a2bc6a4b33a73e2da171d767571f41de60e3d511ab
- MD5
- 055c9bb97993bf40c3ea11abc2aa157a
- SHA-1
- 30311746ebf0922b7fabc0d7f46d71228c57bf31
- PE imphash
- fde5231c855e73a7be292a3d9269eb32
- First seen (VT)
- 5/31/2026, 8:53:58 AM
- Last analysis (VT)
- 6/7/2026, 9:34:45 PM
- First scan (MalwareTips)
- 6/9/2026, 4:04:57 PM
- Last scan (MalwareTips)
- 6/9/2026, 4:04:57 PM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.