MALICIOUS — 12192ab037706670211011d0a46df32b44909bbdfca3a7285f4b5a74930be3ad

MALICIOUS — 12192ab037706670211011d0a46df32b44909bbdfca3a7285f4b5a74930be3ad is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Fileinfector family. 4 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 12192ab037706670211011d0a46df32b44909bbdfca3a7285f4b5a74930be3ad
SHA-1: f79a493e79be6818bdd76025af237b2568c19193
MD5: 4d6c4b5067b5efd1d982e46c3945bcf4
imphash: ba59aba33cb787f767a7c4d32c839de5
ssdeep: 393216:C52dkuFd8N52dkuFd8F52dkuFd8952dkuFd8V52dkuFd8:C4dksw4dksq4dkso4dksi4dks
TLSH: T10773AF681651F24AE5F4CAA0BC51488D903378D472B6ADEE7343042F37DB9AF124A16F
Submitted as: 12192ab037706670211011d0a46df32b44909bbdfca3a7285f4b5a74930be3ad
File type: pe · Size: 22536703 bytes
Verdict: malicious (98/100) · Family: Fileinfector

Detections (4 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Fileinfector-9834127-0
YARA: Yara-Rules community: YR_AntiDebug_Checks
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Fileinfector-9834127-0 (rule Win.Malware.Fileinfector-9834127-0) - engine signal, weight 0.90, confidence 0.95
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 3 external host(s) and 22 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.pinkworld.com, http://www.youporn.com, http://www.redtube.com - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

52 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.pinkworld.com
http://www.youporn.com
http://www.redtube.com
http://www.assparade.com/
http://www.freeav.com/
http://www.antispyware.com/
http://www.antivirus.com/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.microsoft.com
www.microsoft.com
www.pinkworld.com
www.youporn.com
www.redtube.com
www.assparade.com
www.freeav.com
www.antispyware.com
www.antivirus.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.110.12.14
52.168.117.174
52.110.12.50
4.230.171.124
40.84.85.40
20.247.184.142
74.179.77.164
20.42.65.85
172.215.188.232
74.178.240.61
48.192.143.121
34.104.35.123
4.150.223.101
20.184.175.16
203.26.79.13
57.155.104.224
104.18.33.89
52.148.114.188
13.89.179.12
51.104.15.252
72.145.35.108
52.110.12.42
52.110.12.15

File paths

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxstate.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\daocore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dbcore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dockcont.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleasmon.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olecli1.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleconn.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olefact.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olelink.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olemon.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\sockcore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewform.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

More Fileinfector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report