MALICIOUS — 0c20fddb39af83f21ac9788d9d7d039fd063c9b1331628b45a48f722ad7e9f9f

MALICIOUS — 0c20fddb39af83f21ac9788d9d7d039fd063c9b1331628b45a48f722ad7e9f9f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Sivis family. 7 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 0c20fddb39af83f21ac9788d9d7d039fd063c9b1331628b45a48f722ad7e9f9f
SHA-1: c0480a86cf2f3a85af8ac4894bf7b4181078332f
MD5: 5ced5467b56dd804c87dc2d7aefc6bcf
imphash: b10d16eedb1085ef7262dfc4ab03be6f
ssdeep: 6144:KEaE+6qXnthcCbX46iEaE+6qXnthcCbXsEaE+6qXnthcCbX46:KpnnthcCbGpnnthcCbcpnnthcCb
TLSH: T100497DC6A015605AE97F68BD2475E6AD5842345F31BC588EB04383BFB03BE37E4780A5
Submitted as: 0c20fddb39af83f21ac9788d9d7d039fd063c9b1331628b45a48f722ad7e9f9f
File type: pe · Size: 406129 bytes
Verdict: malicious (99/100) · Family: Sivis

Detections (7 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Sivis-9908038-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Sivis-9908038-0 (rule Win.Malware.Sivis-9908038-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Contacted 21 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0, https://d.symcb.com/rpa0@ - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Dropped 83 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

25431 behavior events · 0 ATT&CK techniques · 98 dropped files.

Dropped files

C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccesswalker.exe - f3c29fd1e39c4edc0de2cd06e03d7aa9d3beb38f7adbf07fa724c4ae584cce23
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - 494390134cca67e173bee9b54a2054faa019797abc4d473ec56afe7c6e86d483
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\kinit.exe - 364db910e37d01307dd5215725c3b3c2430b164a6bc6d58da89c956cfdf86293
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-core-kernel32-legacy-l1-1-1.dll - 687b9c10c0edae6d2ff75105f67f956385124ef46a2e7062b83464fa926601d7
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\msvcp140.dll - 9ae7922a3f009755094707794fb00638827b209ae6bb8a3816070eaab4ed0f3c
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-core-fibers-l1-1-1.dll - 0131c4bb5c69fddc733176432dd617b54b69683d466413c51a2c233e394c28ce
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-core-synch-l1-1-0.dll - 7b31eeb93422de0c7ac95d441d6b4dd666529136b18719e15d734dcb417d22dc
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe - a72219571f445ea1d3c0a5d7b048077a965c6d5f6109a5ac95a9cedd22dd8d73
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll - bb26976c338462dc15ef4b6627a32eacd409ac317710c36f6d95883b0e154980
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\j2pkcs11.dll - 9aefd1f2879fdb679ea35f371149ca746609826bbd1874deb91d12f4da9caf17
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\extnet.dll - 7a63b23b4a079e4a5b0fabdde4f61c907f4350207816c425613a153136ab871d
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaaccessbridge.dll - 41b2b1efcb536dd9499873a40abad39ce5acef0f68336ce492342d78ce8a7cc8
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jrunscript.exe - 27a9f068f2820f61dba8ba1928b4aa3b7670da24e000bbf35d035298e5d681e2
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-crt-string-l1-1-0.dll - ad842d595731d6157e65a9b126105a6dda0418fa40e1f35bcd5063853a1158d1
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-core-file-l2-1-0.dll - 09776b9b58daf654e007cf34b7430b3752f873dabc51975e733fcb846af2269b

Embedded URLs

https://www.digicert.com/CPS0
http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
http://www.digicert.com/ssl-cps-repository.htm0
http://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
http://crl.verisign.com/tss-ca.crl0
http://www.microsoft.com/sql0
http://www.adobe.com/go/reader_system_reqs_es.UnmoveFilesQuitando
http://www.adobe.com/go/reader_system_reqs_es.OLE_VERB_OPEN&Abrir
https://d.symcb.com/rpa0
http://s.symcb.com/universal-root.crl0
https://d.symcb.com/rpa0@
http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787830893&P2=404&P3=2&P4=IKAVWJl%2fVyl0dg66M%2bB2gDwPXxd4XbFVoprvffAkCf8%2bc6TEhGPLdaN0PCZ7wg2NLQqRotUsd5MviixbTlJgxA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787830959&P2=404&P3=2&P4=mhtlDNS69hdrP3dFA5uuhhLallCicpUvk%2ffnGUDaVDhI%2b87IAs%2b9Q%2bwS6PTZ2DefslKXMXvXEoVZolWfVUnZxw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ardownload.adobe.com
www.adobe.com
crl3.digicert.com
crl4.digicert.com
www.digicert.com
cacerts.digicert.com
crl.verisign.com
crl.microsoft.com
www.microsoft.com
helpx.adobe.com
l.no
salir.no
directorio.no
disponible.no
cnico.no
n.no
lida.no
seleccionado.no
existente.no
carpeta.no
fuente.no
fuentes.no
ella.no
sistema.no
entorno.no

Embedded IP addresses

20.42.65.84
172.215.188.225
4.230.171.124
52.253.84.76
20.165.94.63
135.233.95.135
20.42.73.30
20.236.44.162
52.123.129.14
40.103.64.242
52.123.128.14
4.150.223.112
172.178.240.163
52.123.252.241
74.179.71.159
203.26.79.13
52.148.114.188
135.233.45.222
72.154.7.105
52.110.12.47
52.110.12.10

File paths

L:\plato\po\olapuir\objc_retail\i386\olapuir.pdb

More Sivis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report