MALICIOUS — 12ebea7a9c354732a854e0994496f4b74166bc6af6c30a9c388d6a8433f10a11

MALICIOUS — 12ebea7a9c354732a854e0994496f4b74166bc6af6c30a9c388d6a8433f10a11 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Pumoo family. 7 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 12ebea7a9c354732a854e0994496f4b74166bc6af6c30a9c388d6a8433f10a11
• SHA-1: 40440d1f4723d1b0e0897390065464947b85de3f
• MD5: 3bb5df8bc1e7abcaa0b286455ad2a3cc
• imphash: a96d166ab17e011e8049d87211158ae5
• ssdeep: 96:TJN2tdaQIBTdIWC6y1coKdx+8taaQidI4RrfryD2t:TMdne6W7K3KdrQidI4RySt
• TLSH: T1A01F0A5276206BDAD303F092D497CE1EC7670D4595EE2E886D1348AEE3DA1073D4198F
• Submitted as: 12ebea7a9c354732a854e0994496f4b74166bc6af6c30a9c388d6a8433f10a11
• File type: pe · Size: 7680 bytes
• Verdict: malicious (97/100) · Family: Pumoo

Detections (7 of 52 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• ClamAV (daily): Win.Worm.Pumoo-1
• YARA: JPCERT/CC: JPCERT_Emotet
• YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
• Microsoft Defender: Worm:Win32/Plurp.A
• Emsisoft (Emergency Kit): Generic.Malware.SMe.E2151C6E
• Kaspersky (KVRT): Email-Worm.Win32.Plemood.b

MITRE ATT&CK

• T1055
• T1547.001

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 97/100 is the fusion of 6 weighted signals:

• ClamAV (daily) flagged Win.Worm.Pumoo-1 (rule Win.Worm.Pumoo-1) - engine signal, weight 0.90, confidence 0.95
• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded domains

• pact518.hit.edu.cn

File paths

• d:\test
• C:\Windows\system32\PurpleMood.scr

More Pumoo samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report