MALICIOUS — 119887da2e0a59e736599230c88316e3b098700687e75799e5a64bd98ab583e7

MALICIOUS — 119887da2e0a59e736599230c88316e3b098700687e75799e5a64bd98ab583e7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Blackie family. 7 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 119887da2e0a59e736599230c88316e3b098700687e75799e5a64bd98ab583e7
SHA-1: 670d1f1f9025ecbb13446faa92cea55b7255b260
MD5: ae3e5653e170697ffb919faf1a4678be
imphash: e7bd1dfd6171afa1bd5777abbf466fd4
ssdeep: 24576:tSI8LUlFl5FpD8OQfPi1dJU43I98U7nYYJ2tHhADSANLHgZpJEMLWF3tm7s7Xw/2:ncY/gOQ/4MnYYJ2ZhqSGLHkJEMISSgu
TLSH: T1F75B3A4811497353DAF2AA3048614D5E405EE4BD71BA38AB0FE7822F7DF65F3A821067
Submitted as: 119887da2e0a59e736599230c88316e3b098700687e75799e5a64bd98ab583e7
File type: pe · Size: 2264124 bytes
Verdict: malicious (100/100) · Family: Blackie

Detections (7 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Blackie-9838328-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
YARA: Yara-Rules community: YR_AntiDebug_Checks
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Trojan.Blackie-9838328-0 (rule Win.Trojan.Blackie-9838328-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.30, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://schemas.datacontract.org/2004/07/Microsoft.DigitalFulfillment.RedemptionService.V1.Contracts
http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://office.microsoft.com/0
http://watson.microsoft.com/dw/dcp.asp
http://watson.microsoft.com/dw/watsoninfo.asp
http://www.microsoft.com/pki/certs/tspca.crt0
http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0O
http://go.microsoft.com/fwlink/?LinkID=398914
http://go.microsoft.com/fwlink/?LinkID=398915
http://go.microsoft.com/fwlink/?LinkID=398916
http://go.microsoft.com/fwlink/?LinkID=398917
http://go.microsoft.com/fwlink/?LinkID=398918
http://go.microsoft.com/fwlink/?LinkID=398919
http://go.microsoft.com/fwlink/?LinkID=398920
http://go.microsoft.com/fwlink/?LinkID=398921
http://go.microsoft.com/fwlink/?LinkID=398298
http://go.microsoft.com/fwlink/?LinkID=398379
http://go.microsoft.com/fwlink/?LinkID=398375
http://go.microsoft.com/fwlink/?LinkID=398380
http://www.msftconnecttest.com/connecttest.txt

Embedded domains

schemas.datacontract.org
crl.microsoft.com
www.microsoft.com
office.microsoft.com
watson.microsoft.com
microsoft.com
msn.com
go.microsoft.com

Embedded IP addresses

20.184.175.6
52.123.252.212
4.230.171.124
4.247.188.224
4.144.132.114
74.179.77.204
135.232.92.97
52.110.12.4
52.110.12.20

Registry keys

HKCU\Software\Microsoft\Shared\OfficeUILanguage
HKCU\Software
HKLM\Software
HKCU\Software\Microsoft\Internet
HKLM\Software\Microsoft\Windows
HKLM\Software\Microsoft\Office\11.0\Registration
HKCU\Software\Policies
HKLM\Software\Policies

File paths

F:\Office\Target\x86\ship\postc2r\x-none\firstrun.pdb
L:\:`:h:
R:\Sg
F:\Office\Target\x86\ship\postc2r\x-none\iecontentservice.pdb
D:\:`:
T:\:t:x:
P:\:d:
U:\:l:s:z:
R:\:t:

More Blackie samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report