MALICIOUS — Bubbles.scr

MALICIOUS — Bubbles.scr is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 1 of 55 detection engines flagged it.

Identification

SHA-256: 0839afa37b6f33f1a80202bc430dc7675b197ce67e136595f79c7c777cdb15f1
SHA-1: 8f80cfd0312c8f5a9706385ea053383ce961c301
MD5: 1f2ed513fc1c3a5929fd0db78523eceb
imphash: f20dde5f424eb5f46727782c757d3d05
ssdeep: 6144:pt9o77GVUYuPPFwrGuC4qNporbwOj8q/BBFrHMObAnTjy6Vg:pt9o77suPg9
TLSH: T11F5192D140C41E74D49CE6F883224D5D4E59EC6133B2AD0C93CAD985BAD4EFB87B4AA0
Submitted as: Bubbles.scr
File type: pe · Size: 860160 bytes
Verdict: malicious (75/100)

Detections (1 of 55 engines)

YARA: Yara-Rules community: YR_AntiDebug_Checks

Why this verdict

The malicious score of 75/100 is the fusion of 3 weighted signals:

Memory forensics: 4 finding(s), e.g. RWX/private injected region in tsk_8454c9cd40 (pid 7452) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Contacted 29 external host(s) at runtime (28 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis (windows)

209 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787818615&P2=404&P3=2&P4=ZNcbSS5inKzXGuxgIs5FaXZXVDuT4Bk1xRXLftLlMhZSEDCJTPMJ3u6pL83bbrA7rJyjbnDdhQDYcBPCf1I1xg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787818628&P2=404&P3=2&P4=YhAXtJQdhTaErKmlXr5sFgyJKrpVC0eggO1xd8NMy7pq293tIvC87wcBN6xwUcBWLuQI3SJU8FMJf3zgGsfFEw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787215259&P2=404&P3=2&P4=FefjqZKSov34Sd2GgE%2bmFF4N%2bNrCXP4%2fNq1X9nkDw%2fnI3lJSghLS%2fzVVu47Zl5AQdxh6W%2bFGF%2bgsQEUFgRZtYw%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787214920&P2=404&P3=2&P4=huDU5JtNr0HF3ZScIIUfy%2fA2%2fUKCbF3OI%2f%2fUw%2fajnVCfdCHUoJSoTkx85ifUkoC8socEiLmw0x%2bp9xI2soLsKw%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
aefd.nelreports.net

Embedded IP addresses

52.123.252.224
4.230.171.124
4.150.223.104
40.84.97.4
20.165.94.63
4.247.188.224
20.247.184.197
135.233.95.135
57.154.63.210
20.52.64.201
20.231.239.246
52.123.129.14
52.123.128.14
172.178.240.162
92.223.78.30
52.123.252.230
52.123.252.241
135.233.95.80
203.26.79.13
20.42.179.204
13.89.179.15
4.150.223.106
52.148.114.188
172.170.180.133
51.104.15.253

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report