A Secure Malware Analytics report shows no hash match for a file in any reputation source, but it lists behavioral indicators such as modifying autorun registry keys, injecting into another process and contacting a recently registered domain, along with a high threat score. How should the analyst interpret it?

Hash-based reputation identifies files that are already known. New or repacked malware often has no match anywhere, which is precisely why dynamic analysis exists. Secure Malware Analytics executes the sample and maps observed actions to behavioral indicators, each describing a technique and its severity, and summarizes them in a threat score. Autorun registry changes indicate persistence, injection into another process indicates defense evasion or privilege abuse, and contacting a newly registered domain fits command-and-control. Together with a high threat score, these behaviors justify treating the file as malicious. Requiring a hash match before a verdict would make every new sample appear clean and defeat the purpose of sandboxing. Behavioral indicators are not limited to signed files; they describe what any sample did during execution, and signing status is at most one observation among many. The threat score is derived from the indicators found in the analysis, not from how rarely the file is seen. Exam caveat: individual low-severity indicators can appear in benign software, so weigh the combination and severity rather than any single indicator. Operational check: record the file's SHA-256 and network artifacts, add the hash to a custom detection list and the domain to a block list, and search endpoint telemetry for other hosts that have the file.