MALICIOUS — 0911cc000f925cfbe50dd5d5f5821d5aa16b842cc7c4008a5ae2d48e02e7235a

MALICIOUS — 0911cc000f925cfbe50dd5d5f5821d5aa16b842cc7c4008a5ae2d48e02e7235a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Cerbu family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 0911cc000f925cfbe50dd5d5f5821d5aa16b842cc7c4008a5ae2d48e02e7235a
SHA-1: 26615fe34a6718672b25dd6e3536e32f55f75a18
MD5: 80a2cdb4827024d41669bb807f363b1d
imphash: 5ab4a5fa77f7cef108828b3d18928877
ssdeep: 1536:dY3oRXGDBmCsUyE7r5ky252/JVI8AP56Rmh2oRO356D3XEBEfDbmOf:dYsiky25IVIb56Qh2o0p6D3XEWfDP
TLSH: T1673B2BA8425BA332F1FAED756C219CDC8814B0AC5172656C9A07DA3FD0F5037D9B62E0
Submitted as: 0911cc000f925cfbe50dd5d5f5821d5aa16b842cc7c4008a5ae2d48e02e7235a
File type: pe · Size: 109368 bytes
Verdict: malicious (97/100) · Family: Cerbu

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Cerbu-9886333-0
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: Yara-Rules community: YR_AntiDebug_Checks
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

T1071.001

Why this verdict

The malicious score of 97/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Malware.Cerbu-9886333-0 (rule Win.Malware.Cerbu-9886333-0) - engine signal, weight 0.90, confidence 0.95
Contacted 22 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787786455&P2=404&P3=2&P4=ZqsuCx32E30xkqbZdIJ9fYEdexQJP48wItiqqApk3ptGxXRpjjIk0ST5LEPg7sXydfKxKak6fvES5EihGwAOlw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com

Embedded IP addresses

4.150.223.114
52.123.252.197
4.144.132.223
172.215.188.225
4.230.171.124
74.179.77.204
4.150.223.107
74.178.240.51
74.178.76.128
20.76.201.171
52.123.129.14
40.99.133.242
52.123.128.14
162.159.142.9
203.26.79.13
135.233.45.222
57.155.101.212
52.148.114.188
72.145.35.106
20.165.94.46
52.110.12.10
52.110.12.30

File paths

F:\Office\Target\x64\ship\postc2r\x-none\msohtmed.pdb

More Cerbu samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report