MALICIOUS — 0659e8e24db5df1adeca458d0afff03d2e86d8cac8f514f95f82d81bd3dc9cb0
MALICIOUS — 0659e8e24db5df1adeca458d0afff03d2e86d8cac8f514f95f82d81bd3dc9cb0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fileinfector family. 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.
Identification
- SHA-256:
0659e8e24db5df1adeca458d0afff03d2e86d8cac8f514f95f82d81bd3dc9cb0 - SHA-1:
b53bcb1f60f2e79c1c351d9e22fc3db980da3f57 - MD5:
e36b07d0aa3f0550387a60e693c71717 - imphash:
895fbb56c02c3d2bca3125cef5da8730 - ssdeep:
3072:8EsmCEsmSEsmuEsmuEsmjlQ23MxHSSP1w0VI51yHLHlBhyBjZqMNn:8ZbZLZ5Z5ZoeP1ZVI51yZAv - TLSH:
T1604A3AE022666352EDF5B954ED08AC1C7092E8E3A2763BEC1446C03F75F96F70678429 - Submitted as: 0659e8e24db5df1adeca458d0afff03d2e86d8cac8f514f95f82d81bd3dc9cb0
- File type: pe · Size: 432666 bytes
- Verdict: malicious (100/100) · Family: Fileinfector
Detections (6 of 56 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Fileinfector-9832954-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Detect It Easy (packer/type): DIE:MinGW
- Microsoft Defender: Trojan:Win32/Vindor!pz
- Kaspersky (KVRT): Virus.Win32.Lamer.ks
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 16 weighted signals:
- ClamAV (daily) flagged Win.Malware.Fileinfector-9832954-0 (rule
Win.Malware.Fileinfector-9832954-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Vindor!pz (rule
Trojan:Win32/Vindor!pz) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Virus.Win32.Lamer.ks (rule
Virus.Win32.Lamer.ks) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 1 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
- Extracted JavaDropper config (0 C2) - engine signal, weight 0.45, confidence 0.60
- Detect It Easy (packer/type) flagged DIE:MinGW (rule
DIE:MinGW) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule
UPX) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: http://www.pinkworld.com, http://www.youporn.com, http://www.redtube.com - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: UPX, high-entropy-sections:UPX1, MinGW - static signal, weight 0.25, confidence 0.55
- Dropped 23 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
85683 behavior events · 2 ATT&CK techniques · 38 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- windows.msn.com
- odc.officeapps.live.com
- www.msn.com
- www.bing.com
Dropped files
- C:\Windows\System32\msvcp140_codecvt_ids.dll -
135005f2fc27af49fda3cde19f0d3b68ebcf8899d81e32b9cbeb94ce0445165f - C:\Windows\pyw.exe -
e7e132e1b5b498635fbfdd54635778b1e1b2278b4a1678cc33f992df120eb8ff - C:\Windows\System32\vccorlib140.dll -
8641d122bf77bac4da495503a6828c223aa098acb747e47ea07e21b216a6d11f - C:\Windows\System32\mfcm140u.dll -
d345ec041fc9d7ada9666a6a7ca9906053fb60b4c6410f2b12e63790fb8b92b2 - C:\Windows\System32\msvcp140_1.dll -
5977388d93c3ecd58a128f7d69b92e2c619e86b38d337440f316fd4080e84102 - C:\Windows\System32\mfc140u.dll -
cdc8871aa42cef174e3db8966fd86c94a8d7762d78121436cf8e4bee621452ed - C:\Windows\WindowsUpdate.log -
c87f207f1b3205b6ca78802eca3745dc1f4c1c0ab9ed00912b10ff4e9fd4c790 - C:\Windows\System32\NOISE.DAT -
bf48de7f8167bbb878ecca0c65f8abd6f3c69accb2562376b66046355c4b1b87 - C:\Windows\DtcInstall.log -
398fc3a2f221cd31a751a331ed05e3898697a37bfd46c9f07a9148b6b462c11b - C:\Windows\System32\vcomp140.dll -
9e57312e283c882f9b85ac248126d37677e04c84bc3c80204e521df22b6c4b40 - C:\Windows\System32\msclmd.dll -
65529b41350579a0e10610630eb93309fc81f70421b423bdb4106b41c6da9f0d - C:\Windows\System32\vcruntime140_threads.dll -
b75b6556bb570ff16c336949c9c70e658c46655dd402f729fe136f4d2572bc98 - C:\Windows\lsasetup.log -
3537efcc2bf47ee28bc96930161f55c25ef0be1305cf5a0c3ccb4ad307b1f608 - C:\exc.exe -
c781d5aa467be4bd81503a634ed84c26a38e6d4885fd7aa30ec1459b9738f808 - C:\Windows\System32\mfc140.dll -
c209d101a8b4ef2f7554e99da871cf6adbc41e2862a2aeaf8a559e4cb441c97a
Embedded URLs
- http://www.pinkworld.com
- http://www.youporn.com
- http://www.redtube.com
- http://www.assparade.com/
- http://www.freeav.com/
- http://www.antispyware.com/
- http://www.antivirus.com/
- http://crl.thawte.com/ThawteTimestampingCA.crl0
- http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
- http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
- https://www.verisign.com/rpa
- http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
- https://www.verisign.com/rpa0
- http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
- https://www.verisign.com/cps0*
- http://logo.verisign.com/vslogo.gif04
- http://crl.verisign.com/pca3-g5.crl04
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
- http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
- http://yr.c.lencr.org/
Embedded domains
- www.pinkworld.com
- www.youporn.com
- www.redtube.com
- www.assparade.com
- www.freeav.com
- www.antispyware.com
- www.antivirus.com
- crl.thawte.com
- ts-aia.ws.symantec.com
- ts-crl.ws.symantec.com
- www.verisign.com
- csc3-2010-crl.verisign.com
- csc3-2010-aia.verisign.com
- logo.verisign.com
- crl.verisign.com
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- oneclient.sfx.ms
Embedded IP addresses
- 20.42.65.94
- 4.144.132.114
- 4.230.171.124
- 74.178.240.51
- 4.207.44.64
- 135.232.92.137
- 172.215.188.232
- 57.154.63.210
- 135.234.160.245
- 52.148.114.188
- 104.208.16.94
- 4.247.188.224
- 20.42.73.26
- 20.42.179.192
- 52.123.252.197
- 20.42.73.30
- 52.123.252.239
- 172.172.255.218
- 92.223.78.30
- 72.153.5.135
- 52.110.12.22
- 20.184.175.21
- 52.110.12.30
File paths
- C:\BUILD_~1\jdk6_45\control\build\WINDOW~1\tmp\java\javaw\obj\javaw.pdb
More Fileinfector samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report