MALICIOUS — sample.rar

MALICIOUS — sample.rar is a archive sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (90/100), attributed to the Container family. 4 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 0e6fba81fe06971a217ba404b101259ccfc9767216332a29287d88a704f7a5de
• SHA-1: 297fb6a18cdabff2c92f316937245888ca35c1bb
• MD5: 0e05538f83cc080a18c6f7e39ef27d66
• ssdeep: 196608:aL/l5YU8DOCxGcNyjGfndVGA+2TjqeFoXqcO4qC6rnu5NWYEBYEOwaa2:aLUgCxh+GfnSAb7oX+Cku5MpBp1aa2
• TLSH: T1826E337098CCECD3878DA5E51F9212B9EF5AB63222E5754A506AB1D0BC3CD364847C23
• Submitted as: sample.rar
• File type: archive · Size: 13228812 bytes
• Verdict: malicious (90/100) · Family: Container

Detections (4 of 54 engines)

• capa (capabilities): capability:credential-access
• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
• Microsoft Defender: Trojan:PowerShell/PsExec.DA!MTB

MITRE ATT&CK

• T1555
• T1003

Why this verdict

The malicious score of 90/100 is the fusion of 6 weighted signals:

• Microsoft Defender flagged Trojan:PowerShell/PsExec.DA!MTB (rule Trojan:PowerShell/PsExec.DA!MTB) - engine signal, weight 0.55, confidence 0.85
• access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
• YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.55, confidence 0.70
• capa (capabilities) flagged capability:credential-access (rule capability:credential-access) - engine signal, weight 0.35, confidence 0.70
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Archive contents (15 executables)

This archive carries 15 extracted members, each analyzed as its own sample (listing truncated):

• offscreendocument_main.js - 7f55456a8f5a717f38ebf7481e97b3de437bb2b9b35073f526f7edb11311f4d3
• page_embed_script.js - 6ce49065b537fd6e918d3ec6c8c1e72138144472bb51581c4622a714cf7fa10b
• service_worker_bin_prod.js - 5de9e74058524e92c88ecfc5e25dee0f3d9f8af92179b33eb52638eb98022965
• offscreendocument_main.js - ae0a1e0da6effb15bb71856e82d36d69a8253366c941f648b7cbec3f74b0a73e
• page_embed_script.js - 21d28a770a73704374bea8b0eada7e4e4649ea9b85b17a9ba0b01c19e1ae1395
• service_worker_bin_prod.js - 108c7add8cba49512da24b2a1b95cef35d778691ef5a5d01ba66c2ba7dcee00c
• content.js - 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
• content_new.js - d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
• Annual%20Meetings.xlsx.lnk - 1901119a77e200dcf2e27f78795bc5adcedb0c5298783eed60beff9100da0cb5
• Google Chrome.lnk - c4f362da41991bf25e1589897ec9f11e07920839afac98257b89a8edb8f25c24
• Microsoft Edge.lnk - f5bc4c9ad6185dc55ddeab4b1cf29bd9a3e371f4b179209fc8b6deed8d709777
• Microsoft Outlook.lnk - bb43fe5be404990a8f7c20f0cd5751aaa466273e90e2c9b2add34cc9d99e55f8
• Google Chrome.lnk - c13cb85829d46c376bd46396bceb80af6522549c7ffed193cdf49a118031641e
• Excel.lnk - f909dbbbff8b747e15e5388cba821b426683c33b14e2e37ac7191bc7c0911826
• File Explorer.lnk - cf116b33831de9f80847abdb2a0d92ab3d3f956a8e209ec95d35d986eea8c7b5

Dynamic analysis

This archive is a container, so it was not detonated itself. Its extracted members were re-submitted and analyzed as their own samples, and the runtime behaviour lives on those reports.

Embedded domains

• t.sg
• 8.it
• t.cn
• docs.google.com
• worldbankgroup.org
• 4.za

File paths

• v:\&r
• c:\#=
• y:\H7
• B:\+

More Container samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report