MALICIOUS — 17c8e5e3d023aa0549f3fcbae7fa1e56cd3a57806dac37b8eaac4a725b29fa8d

MALICIOUS — 17c8e5e3d023aa0549f3fcbae7fa1e56cd3a57806dac37b8eaac4a725b29fa8d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Vindor family. 9 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 17c8e5e3d023aa0549f3fcbae7fa1e56cd3a57806dac37b8eaac4a725b29fa8d
SHA-1: c48a1e332a35d027002a7f1f02e0646edaf926fc
MD5: 9de77a4beeb1189eeb29ad1a2d464440
imphash: 01392ca861cf87b8d28ad9ea90016bb4
ssdeep: 6144:vjrMDcDT/yqcNLEJ8O38ggFlZnzpK1FUAmI14QvTyaJFvlP1jgTN:XkcPKqkAlJg/ZnzpK1CIRVjk
TLSH: T18F488DF541E63222C2B2ED18A01DCD8E8423B46C6135179D4307C76EA1F96BBE8F95E4
Submitted as: 17c8e5e3d023aa0549f3fcbae7fa1e56cd3a57806dac37b8eaac4a725b29fa8d
File type: pe · Size: 355523 bytes
Verdict: malicious (100/100) · Family: Vindor

Detections (9 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): ASPack
ClamAV (daily): Win.Worm.Vindor-9886047-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Worm:Win32/AutoRun!pz
Emsisoft (Emergency Kit): Gen:Heur.Mint.Autorunner.1
Trellix Stinger (McAfee): Vindor-FTWO!9DE77A4BEEB1
Kaspersky (KVRT): Worm.Win32.AutoRun.vx

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Worm.Vindor-9886047-0 (rule Win.Worm.Vindor-9886047-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Worm:Win32/AutoRun!pz (rule Worm:Win32/AutoRun!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Mint.Autorunner.1 (rule Gen:Heur.Mint.Autorunner.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Vindor-FTWO!9DE77A4BEEB1 (rule Vindor-FTWO!9DE77A4BEEB1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.AutoRun.vx (rule Worm.Win32.AutoRun.vx) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged ASPack (rule ASPack) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
Packing/obfuscation: ASPack, high-entropy-sections:.text, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 22 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

25204 behavior events · 1 ATT&CK techniques · 24 dropped files.

Dropped files

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - 377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Adobe\Acrobat DC\Acrobat\OSSLLibs\AdobeFips.exe - 88e62fcece7184418446b9f228d46232717aa3dd4e4599b5a4472c3e1db03335
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe - e6df172084f96f4db5b68cf8dbedf6781489db87662be30576d7061d5cae7b38
C:\Program Files\7-Zip\7zG.exe - 3b35ae5bfafcd771b89ebc0ac1bd71522194b50de1f6486cd248694db8c0597f
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe - a90e9652ef6f96eb09448cb6db3697ab10eae6dde89594f714bf3bf764685737
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe - 6a78dba30ca10f3addef5b1683bd7bc97e98ce03c9e6ae7056845ee1b70b7d10
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - 4c3bef1095412cf4345479030f81f4b8a5c24bab0fb3ed54bc8768fd8a80c533
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe - 63156ae4b122e6f9584581782b64327bfbf60d31ae39de283fd5beeea5aa6746
C:\Program Files\7-Zip\7z.exe - 634d38c0c414178e2f35de5cc0fb29aa082eec227e630c4481e1af7694980ac9
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe - 7f65f5ae08cc5a15df0c7d70e3fc3ba5b4f083dcbdc02170423867257ffaf076
C:\Program Files\7-Zip\7zG.exe - 7b5eda73c21960c451ea3148900b28cdbac7180e43047fbc944028096e497c08
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe - da6d0544ee3a6b75f3c5c545213b10ec93a15d5213e5232e7e224a29ecb91d6b
C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\MenuCoreApp\AcroShareTarget.exe - f8e5f96f5d1a4af50ee6a35ecf9d629e1694d8397d681a7d1eb7683c2a3a653c

Embedded URLs

https://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-cs-g1.crl05
http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/windows0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

cacerts.digicert.com
crl4.digicert.com
crl3.digicert.com
www.digicert.com
www.microsoft.com
crl.microsoft.com
cygserver.cc
client.cc
process.cc
msg.cc
sem.cc
shm.cc
pwdgrp.cc
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

51.132.193.104
57.155.101.212
4.230.171.124
135.232.92.97
74.178.240.61
51.116.246.104
20.247.184.197
20.165.94.63
172.66.2.5
52.110.12.30
52.110.12.52
125.56.205.25
125.56.205.123
125.56.205.65
52.148.114.188
72.145.35.103
57.155.104.224
20.184.175.6
51.105.71.136
52.110.12.8
52.110.12.21

File paths

c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\jdk\objs\kinit_objs\kinit.pdb
C:\Users\Vinay\Projects\simple_launcher\dist\t64.pdb
c:\users\george\appdata\local\programs\python\python39\python.exe

More Vindor samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report