MalwareTips
File verdict·Decided by the MT AI Engine
Our call

Suspicious

Unsigned new executable with heuristic AV detections and direct IP connection (Cloudflare) triggers suspicion despite no tier-1 flags or offensive behavior.

Trust score50Caution
MT AI confidence · 65%
citron.exe
61.9 MB
fcb3b8e9782eef8a99…f105c38717
Antivirus engines
2 of 75 flagged
Code signing
Unsigned
Age
First seen 19 days ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

65%Confidence
High
Reasoning

The file lacks code signing and has zero reputation as a brand-new submission, amplifying risks from its rare prevalence. Heuristic detections are present but confined to tier2/low-trust engines without tier1 backing or family consensus, suggesting possible overreach. The direct IP contact to a Cloudflare address fires a medium-severity C2 evasion rule, yet no further malicious runtime (e.g., sandbox verdicts, offensive MITRE) supports escalation. Overall, signals mix weakly toward threat without decisive proof.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. Gridinsoft (tier2): Trojan.Heur!.0205202F

  2. triggeredHeuristics[0]: MalwareTips.Synth.DirectIpC2 fired on 162.159.36.2

  3. engines.tier1Malicious=0 / tier1ReportedClean=17

  4. prevalence.classification: rare_new

  5. signing.signed=false

Points in its favour
  • No tier-1 malicious detections (17 clean)
  • No offensive MITRE techniques
  • No malicious sandbox verdict
  • No contacted malicious hosts
Points against
  • Direct IP C2 heuristic (MalwareTips.Synth.DirectIpC2)
  • Unsigned executable
  • Zero-day age (firstSubmissionDate 2026-05-15)
  • Rare new prevalence (2 submissions)
  • Heuristic Trojan detection (Gridinsoft)
  • Overlay and checks-user-input tags
What to do

Quarantine the file immediately and avoid execution. Monitor for related activity and resubmit after more scans for confirmation.

Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
1

Adversary techniques mapped to the MITRE ATT&CK framework.

T1056
Spawned processes
1
$(unnamed)
"C:\Users\user\Desktop\executable.exe"
Network activity
1
IP addresses1
  • 162.159.36.2
No researcher-database hits
External threat-intel sources were not collected for this scan.
Signature matches

YARA + heuristic rules that fired

One or more medium-severity heuristic rules matched. Not definitive, but the patterns match known malware behaviour.

1 synthesis
MITRE ATT&CK profile
C2× 1
MalwareTips synthesis rules
Our heuristics on VT data + sandbox behaviour
  • DirectIpC2
    T1071
    medium

    Sample contacted 1 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.

    Evidence
    162.159.36.2
Antivirus engine breakdown

2 detections across 75 engines

2 malicious0 suspicious73 clean
Tier-117 engines
0flag
Top commercial AVs (low FP rate)
Tier-238 engines
1flag
Mainstream engines with mixed FP rates
Low-trust20 engines
1flag
Heuristic / generic-AI engines (high FP rate)
Gridinsoft
malicious
Trojan.Heur!.0205202F
Trapmine
malicious
suspicious.low.ml.score
Hash fcb3b8e9782e… cross-referenced against 75 AV engines via our AV network.
PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

ent 5.74Unpacked
Section entropy10 sections
.text
6.51
.rdata
6.13
.buildid
0.67
.data
5.25
.pdata
6.94
.qtversi
0.16
.rodata
7.94
.tls
0.00
.rsrc
7.84
.reloc
5.51
0.0Packed threshold 7.28.0
Prevalence

How often this file shows up in the wild

Barely seen in the wild and first surfaced recently. This is the footprint of targeted malware the AV industry hasn't signatured yet — extra scrutiny is warranted.

Rare & new
Unique uploaders
2
Very few people have ever uploaded this — rare.
Total submissions
2
Includes repeat uploads by the same source.
First seen by VT
19d ago
May 15, 2026
Prevalence quadrant
here
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
5/15/2026, 11:28:07 AM
First seen (MalwareBazaar)
—
Last analysis (VT)
5/15/2026, 11:28:07 AM
Scanned here
5/15/2026, 3:28:44 PM
File name
citron.exe
Size
61.85 MB
MIME type
(unknown)
Detected type
Win32 EXE
SHA-256
fcb3b8e9782eef8a992e989becfdebf879de7c0c1996e8e2c2d9b1f105c38717
MD5
f32908fe21e824071c126f03bc079bc9
SHA-1
0799f37a02589d070e752ec9444748a660a9bcd1
PE imphash
88523bdfa23813abc1972f29e1d967d7
First seen (VT)
5/15/2026, 11:28:07 AM
Last analysis (VT)
5/15/2026, 11:28:07 AM
First scan (MalwareTips)
5/15/2026, 3:28:44 PM
Last scan (MalwareTips)
5/15/2026, 3:28:44 PM
Behavior tags
overlaypeexe64bitschecks-user-input
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scan another
Check a different file
URL instead?
Check if a link is safe
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.