MALICIOUS — 1cd707d8da6696fff45be9dc05457b5f4bc44a12c744687993a3dd9326ba7efc

MALICIOUS — 1cd707d8da6696fff45be9dc05457b5f4bc44a12c744687993a3dd9326ba7efc is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the Picsys family. 7 of 55 detection engines flagged it.

Identification

SHA-256: 1cd707d8da6696fff45be9dc05457b5f4bc44a12c744687993a3dd9326ba7efc
SHA-1: d714970d721cc9b5ab15a5c08f06d2e33eb0c342
MD5: 05189ccc2f6d9d23ee4adb649e0f752c
imphash: 8ff2a348d8d2908f63d89c70d6eb0c9e
ssdeep: 3072:ucaJvW8koHjmX+1+0cxxsWEsJ0ifXcIp08MoeE8lXRDPp:ucaJuqVxYT52MZME8lXRDPp
TLSH: T1D13FAE696B377B1BEA79C2661C00BF5D5033B4FA61795088438BC42E77DBC23A9A105C
Submitted as: 1cd707d8da6696fff45be9dc05457b5f4bc44a12c744687993a3dd9326ba7efc
File type: pe · Size: 149648 bytes
Verdict: malicious (92/100) · Family: Picsys

Detections (7 of 55 engines)

ClamAV (daily): Win.Worm.Picsys-9630818-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
Microsoft Defender: Worm:Win32/Yoof.E
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Phobos.154
Trellix Stinger (McAfee): W32/Picsys.worm!05189CCC2F6D
Kaspersky (KVRT): P2P-Worm.Win32.Picsys.b

Why this verdict

The malicious score of 92/100 is the fusion of 3 weighted signals:

ClamAV (daily) flagged Win.Worm.Picsys-9630818-0 (rule Win.Worm.Picsys-9630818-0) - engine signal, weight 0.90, confidence 0.95
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded domains

battle.net
hotmail.com

More Picsys samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report