SUSPICIOUS — 1a397c9ab5481ff947c82f6f1799555d1d42715f5a328a708478bb774c6e7e5e

SUSPICIOUS — 1a397c9ab5481ff947c82f6f1799555d1d42715f5a328a708478bb774c6e7e5e is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (64/100). 1 of 56 detection engines flagged it.

Identification

• SHA-256: 1a397c9ab5481ff947c82f6f1799555d1d42715f5a328a708478bb774c6e7e5e
• SHA-1: ddd07ce218cf2ee93d909a1488a29ba9b29258f7
• MD5: 228bcc107534c61c913d610a3a624512
• imphash: ad1f23519bbfc8977066f6d732164041
• ssdeep: 1536:KQZZTGFWbE6bBMYoRoqiq8EpKP1dwLImur2WYW9V9N+Mf1yUfq:KAZToEE6ooqiq8EpKP1dwLFurHN9V9NA
• TLSH: T120377C5552572163E5F3DC44601E8D9C8413B8B8B67007AEE20FB2AD11B53B7BBF28A1
• Submitted as: 1a397c9ab5481ff947c82f6f1799555d1d42715f5a328a708478bb774c6e7e5e
• File type: pe · Size: 74984 bytes
• Verdict: suspicious (64/100)

Detections (1 of 56 engines)

• Microsoft Defender: flagged

Why this verdict

The suspicious score of 64/100 is the fusion of 3 weighted signals:

• Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
• Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Memory forensics: 5 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 5936) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• licensing.mp.microsoft.com
• config.edge.skype.com
• officeclient.microsoft.com
• windows.msn.com
• www.msn.com
• odc.officeapps.live.com
• www.bing.com
• assets.msn.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• www.msftconnecttest.com/connecttest.txt

Embedded URLs

• https://www.digicert.com/CPS0
• http://crl3.digicert.com/sha2-assured-cs-g1.crl05
• http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
• http://crl3.digicert.com/sha2-assured-ts.crl02
• http://crl4.digicert.com/sha2-assured-ts.crl0
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• cacerts.digicert.com
• crl4.digicert.com
• crl3.digicert.com
• www.digicert.com

Embedded IP addresses

• 40.74.98.197
• 20.247.184.197
• 52.123.252.232
• 4.230.171.124
• 52.110.12.48
• 52.110.12.16

File paths

• c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\jdk\objs\keytool_objs\keytool.pdb

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report