MALICIOUS — 0eecfb7ca655c0a0c73ea93470249713da2940c0c4f4ab99cbfb01db24140df4
MALICIOUS — 0eecfb7ca655c0a0c73ea93470249713da2940c0c4f4ab99cbfb01db24140df4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Fileinfector family. 3 of 56 detection engines flagged it.
Identification
- SHA-256:
0eecfb7ca655c0a0c73ea93470249713da2940c0c4f4ab99cbfb01db24140df4 - SHA-1:
88ffdd8c913d4ddc400b5e1da46957eacbdf54b0 - MD5:
fe364dabc9c533f19e103be0b9a4e4bb - imphash:
fe61f693ebb8e81a898df54266208a00 - ssdeep:
24576:4uxbXLDB6J4ZADuxbXLDB6J4ZAFuxbXLDB6J4ZA5uxbXLDB6J4ZA:ndLEyZ1dLEyZVdLEyZVdLEyZ - TLSH:
T15A5B7D936329B448E7F5AE309085445EE9F6F069A67F18848DE1C93B27E1E43087DB34 - Submitted as: 0eecfb7ca655c0a0c73ea93470249713da2940c0c4f4ab99cbfb01db24140df4
- File type: pe · Size: 2259751 bytes
- Verdict: malicious (96/100) · Family: Fileinfector
Detections (3 of 56 engines)
- ClamAV (daily): Win.Malware.Fileinfector-9832954-0
- LIEF (executable format parser): lief:invalid-authenticode
- Microsoft Defender: Trojan:Win32/Vindor!pz
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Win.Malware.Fileinfector-9832954-0 (rule
Win.Malware.Fileinfector-9832954-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Vindor!pz (rule
Trojan:Win32/Vindor!pz) - engine signal, weight 0.55, confidence 0.85 - Contacted 1 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- LIEF (executable format parser) flagged lief:invalid-authenticode (rule
lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70 - Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 5556) (rule
windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
109 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
- slscr.update.microsoft.com
- licensing.mp.microsoft.com
Embedded URLs
- http://www.microsoft.com/pki/certs/tspca.crt0
- http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0O
- http://www.microsoft.com/directx0
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- crl.microsoft.com
- www.microsoft.com
Embedded IP addresses
- 4.150.223.104
- 57.155.104.224
- 4.230.171.124
- 135.232.92.97
- 20.165.94.63
- 20.247.184.197
- 20.42.72.131
- 52.123.252.230
- 52.110.12.11
- 125.56.205.26
- 104.18.33.89
- 52.110.12.3
- 52.110.12.19
- 125.56.205.65
File paths
- Q:\:
More Fileinfector samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report