MALICIOUS — 04832a4132eefb6b1c1688bd7ce4c2ea20e293a041f817b24139d446ffdbc7c2

MALICIOUS — 04832a4132eefb6b1c1688bd7ce4c2ea20e293a041f817b24139d446ffdbc7c2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 7 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 04832a4132eefb6b1c1688bd7ce4c2ea20e293a041f817b24139d446ffdbc7c2
• SHA-1: 0fcd6d42c92bcbfeaa834f44a31e77e3b9678078
• MD5: 92fe79398004b66d53768fd5b807ce66
• imphash: 500ff1538958cc73738bf0c262a1773f
• ssdeep: 196608:FAXfUsfUvn9Tin9Tyn9TBfU8fUon9TBfUefUJn9TBfUn:0Xccczz/zFqzu
• TLSH: T1816BD0C4A61191F2CA92CED41DD02E0E14A6B34521FCBECD4381A56E3BF94E7B44A2DD
• Submitted as: 04832a4132eefb6b1c1688bd7ce4c2ea20e293a041f817b24139d446ffdbc7c2
• File type: pe · Size: 9922972 bytes
• Verdict: malicious (100/100) · Family: HUILoader

Detections (7 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.dafixer,.dafixer,.dafixer,.dafixer,.dafixer
• ClamAV (daily): Win.Malware.Genpack-9879226-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Detect It Easy (packer/type): DIE:Turbo Linker
• Microsoft Defender: Trojan:Win32/Vindor!pz
• Emsisoft (Emergency Kit): Trojan.Generic.38457250

MITRE ATT&CK

• T1547.001
• T1071.001

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

• ClamAV (daily) flagged Win.Malware.Genpack-9879226-0 (rule Win.Malware.Genpack-9879226-0) - engine signal, weight 0.90, confidence 0.95
• Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in tsk_d30ae29876 (pid 3372) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Microsoft Defender flagged Trojan:Win32/Vindor!pz (rule Trojan:Win32/Vindor!pz) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Generic.38457250 (rule Trojan.Generic.38457250) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• Contacted 21 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.dafixer,.dafixer,.dafixer,.dafixer,.dafixer (rule high-entropy-sections:.dafixer,.dafixer,.dafixer,.dafixer,.dafixer) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: 1.12.1.1, 1.12.1.9 - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-sections:.dafixer,.dafixer,.dafixer,.dafixer,.dafixer, Turbo Linker - static signal, weight 0.25, confidence 0.55
• Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

844 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• ctldl.windowsupdate.com
• update.googleapis.com
• desktop-hsgcbep
• login.live.com
• settings-win.data.microsoft.com
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• officeclient.microsoft.com
• www.msn.com
• odc.officeapps.live.com
• licensing.mp.microsoft.com

Embedded URLs

• http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
• http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
• http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
• http://crl.thawte.com/ThawteTimestampingCA.crl0
• http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
• http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
• https://www.digicert.com/CPS0
• http://crl3.digicert.com/sha2-assured-cs-g1.crl05
• http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
• http://schemas.microsoft.com/SMI/2005/WindowsSettings
• http://www.digicert.com/ssl-cps-repository.htm0
• http://appsyndication.org/2006/appsyn
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/
• http://c.pki.goog/r/gsr1.crl
• http://c.pki.goog/r/r4.crl

Embedded domains

• mb.fi
• www.microsoft.com
• crl.microsoft.com
• crl.thawte.com
• ts-aia.ws.symantec.com
• ts-crl.ws.symantec.com
• cacerts.digicert.com
• crl4.digicert.com
• crl3.digicert.com
• www.digicert.com
• schemas.microsoft.com
• appsyndication.org
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 1.12.1.1
• 1.12.1.9
• 20.42.65.84
• 57.154.63.210
• 52.123.252.215
• 4.230.171.124
• 52.230.60.54
• 57.155.101.212
• 172.215.188.225
• 135.232.92.137
• 20.165.94.54
• 20.42.65.89
• 52.123.252.192
• 52.123.252.222
• 172.64.154.167
• 72.153.5.61
• 52.148.114.188
• 52.110.12.1
• 52.110.12.22

File paths

• C:\Windows\assembly\NativeImages_v4.0.30319_64\System\37a1d51f35918dd36a0d4e34cc91732e\System.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\89bc329e8c65a9e13067c9776d925d78\System.Core.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\dee95ca75ccebe1cc18b31dca334cd53\System.Management.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\System\08f69c55e9284eaab92075159503c897\System.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\c9243edb149eb78c5309c103df69d594\System.Core.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\36d0bbf456e19171162fb117487d13e6\System.Configuration.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\e2507c6929371fa69b5e96a6e097ee69\System.Xml.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\53ae5f55bdb521c15d5cc4f789fb3950\System.Drawing.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\608b1a4f3a44025433437f6d8c52edc2\System.Windows.Forms.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\TaskScheduler\efd95135b5364604e49523f13d992880\TaskScheduler.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\MIGUIControls\ad266da7dce889882d13e3e9c7ec95f4\MIGUIControls.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\CustomMarshalers\7f900344403fdc1a677cb6b77504f8cf\CustomMarshalers.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Accessibility\578140cf5204678870624cf8aeb5fbe6\Accessibility.ni.dll
• C:\btvsts\3621\private\softgrid\shared\include\coinitialize.h
• C:\Windows\assembly\NativeImages_v4.0.30319_32\System\2bef38851483abae82f1172c1aaa604c\System.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\9d04ce1d8a3042f50b54c7f9ccdb4068\System.Core.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\fea996c385fbc624826f8e043f6d5329\System.Management.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wad78daf4#\8f73bd36654fa77803c3167f39ead17e\Microsoft.Windows.Diagnosis.SDHost.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wed3937f9#\3dae65a1b718d3a083094b67e1413e9a\Microsoft.Windows.Diagnosis.SDCommon.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\f02732d562721457afde5c189a906d17\System.Management.Automation.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W0bb5dac4#\4c396dcf426dbba8eddd04adc0b562fe\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W69ef49d2#\9dcd27fe1c298162f13c6bdb7c0cfe88\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wd518ee0d#\e9bd08c5c1a8c5fdef45c7025b262edc\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W708fc392#\3c226a9afdce13116b1fdfa9e92b4152\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W79a81d80#\2efe3e39ab8a210a684558961ff266d2\Microsoft.Windows.Diagnosis.Commands.WriteDiagTelemetry.ni.dll

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report