MALICIOUS — 0f806f6e5315caff928408ef43bc3ab026c0feac26cbba32fd225e84aa21d72b

MALICIOUS — 0f806f6e5315caff928408ef43bc3ab026c0feac26cbba32fd225e84aa21d72b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fileinfector family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 0f806f6e5315caff928408ef43bc3ab026c0feac26cbba32fd225e84aa21d72b
SHA-1: 2b3433afc83a618dc57a1026c2385ddfe6df6646
MD5: a451b5cec2ac01951682596a4e322fac
imphash: a9192bab5c7c795c7488b69a1853f9c2
ssdeep: 98304:2RDn5yyFBCA4CEuRDn5yyFBCA4CEkRDn5yyFBCA4CEm:M57t4Ch57t4Cv57t4C1
TLSH: T14C628CD5326AF352D8B7DAA0E4005E0D95A390A422BF2C8C4247D05F37FEDB750AB259
Submitted as: 0f806f6e5315caff928408ef43bc3ab026c0feac26cbba32fd225e84aa21d72b
File type: pe · Size: 4461972 bytes
Verdict: malicious (100/100) · Family: Fileinfector

Detections (5 of 56 engines)

ClamAV (daily): Win.Dropper.Fileinfector-9832222-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/CryptInject!pz
Trellix Stinger (McAfee): Trojan-FULM!A451B5CEC2AC
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Dropper.Fileinfector-9832222-0 (rule Win.Dropper.Fileinfector-9832222-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/CryptInject!pz (rule Trojan:Win32/CryptInject!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FULM!A451B5CEC2AC (rule Trojan-FULM!A451B5CEC2AC) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.ks (rule Virus.Win32.Lamer.ks) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1622, T1082 - dynamic signal, weight 0.40, confidence 0.75
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.pinkworld.com, http://www.youporn.com, http://www.redtube.com - static signal, weight 0.35, confidence 0.60
Dropped 23 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

101854 behavior events · 2 ATT&CK techniques · 38 dropped files.

Dropped files

C:\Windows\System32\vulkan-1.dll - be5d14ed70eaff05f7213403178c6c986d86d82bcad3d2d1b3b8931d6dc294ea
C:\Windows\System32\vcruntime140.dll - 60342e0cc0c604e54546f71469d3c0f6069e6c790878ec6a05f9ee3e647c661e
C:\Windows\System32\dssec.dat - ab934e6a8a78d4190d0bd95077ffdf6ba510a0f3340721f666595bb4d430bd7f
C:\Windows\System32\vccorlib140.dll - 062246b2768ed8e032528c3deac6328d41b4a1b1b3f31700d483f669f2fc4254
C:\Windows\System32\mfc140.dll - dfd085cc44f60471a90d8ee89041d4774a82e07ee9393af80cf75b4e39222c13
C:\Windows\System32\vcomp140.dll - 292041ee5ed54a1261ed1fc87e4443868d95311d6a433306df7299a481172760
C:\Windows\System32\opencl.dll - 256cf6523baf35b9de8253a07f79943eecede7d723b648e44416c7940a1c00a3
C:\Windows\setuperr.log - 10da55a4a4b7aec3d51b1cf4266970ab12e9b95f2344d1d03889e7b701747f35
C:\Windows\lsasetup.log - e4112ed286f7be37f134b30af1267021c507af433c9a4bd12ccd6b3bb72502e8
C:\Windows\win.ini - 14a86ea516cd9f488f2f092f60318085c812d06475c451b98bab269db99fd706
C:\Windows\System32\vcruntime140_threads.dll - ed71748c766d1a651f9c9e8377b1d4127ee82a0c29bbf1f0b8ed6ee66fbb3afa
C:\Windows\py.exe - 48b3e620cc2986d1e681469dafc4a4b4046c8a868fb85fc4a6f241964dd82474
C:\exc.exe - 1cacf1c39a4ef6f1f9f1e5e40d58014cf39b5dfc9ae9ac942ab2aa3804db88b2
C:\Windows\system.ini - 44a1c33b91d602d8b3dd3523b74787ea8a5afcccd64050dd56006eb289569c06
C:\Windows\pyshellext.amd64.dll - 86982dd3524d300a60b03b179de0caecd38a640c9086c71f94449ab8426a095d

Embedded URLs

http://www.pinkworld.com
http://www.youporn.com
http://www.redtube.com
http://www.assparade.com/
http://www.freeav.com/
http://www.antispyware.com/
http://www.antivirus.com/
http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0O
http://office.microsoft.com
http://www.microsoft.com/pki/certs/CSPCA.crt0
http://www.microsoft.com/pki/certs/tspca.crt0
http://www.microsoft.com/directx0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.pinkworld.com
www.youporn.com
www.redtube.com
www.assparade.com
www.freeav.com
www.antispyware.com
www.antivirus.com
crl.microsoft.com
www.microsoft.com
office.microsoft.com

Embedded IP addresses

20.184.175.6
52.123.252.248
4.230.171.124
40.84.85.40
52.230.60.54
135.232.92.97
74.178.240.61
104.18.33.89
4.207.44.72
74.178.76.128
135.233.45.221
72.145.35.108
52.148.114.188
52.110.12.48

File paths

T:\:
P:\:d:p:
T:\:h:t:
X:\:`:d:h:l:p:t:x:
X:\:`:d:h:l:p:t:

More Fileinfector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report