MALICIOUS — 1ce9dfd3f1c9a643cc79b66bbeff24251a6381c8210e7614e5c4f284256fcc96

MALICIOUS — 1ce9dfd3f1c9a643cc79b66bbeff24251a6381c8210e7614e5c4f284256fcc96 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the NabucurObfs family. 5 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 1ce9dfd3f1c9a643cc79b66bbeff24251a6381c8210e7614e5c4f284256fcc96
SHA-1: 34afa65aaa360888e1738d88f0292578c73a2d10
MD5: ca66e4dd4c3179cd74a644746c3d0222
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 24576:uDoAk195yRlFvkjxtGNzoEkpAnhUrn8HWFU+X6cePUrLHPG1KWXJNGWdRU5:D1qUHHPMD7ldW5
TLSH: T1FE58CDD49BB854C8507555F2E44A901B8817F88ECC6D44CE3F52BAFA1D85E01E02EBFA
Submitted as: 1ce9dfd3f1c9a643cc79b66bbeff24251a6381c8210e7614e5c4f284256fcc96
File type: pe · Size: 1764352 bytes
Verdict: malicious (99/100) · Family: NabucurObfs

Detections (5 of 25 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
Microsoft Defender: Trojan:Win32/NabucurObfs
Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

Dropped a malicious payload: bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:Win32/NabucurObfs (rule Trojan:Win32/NabucurObfs) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.5 (rule Win32.Virlock.Gen.5) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 39 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

29759 behavior events · 2 ATT&CK techniques · 36 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/8806/files/3e0d563d48f5f70e02fb076f295f393c266786ef89db2261d7c10d9fd8f4b4c4 - 3e0d563d48f5f70e02fb076f295f393c266786ef89db2261d7c10d9fd8f4b4c4
/opt/CAPEv2/storage/analyses/8806/files/5a80c68f5a1675612b7fea73df7f4b58f54d97b4dba0cacbb3d7280b15e968e9 - 5a80c68f5a1675612b7fea73df7f4b58f54d97b4dba0cacbb3d7280b15e968e9
/opt/CAPEv2/storage/analyses/8806/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/8806/files/f8c7805791b6787421a9ce6983037cd45f8d827faf414de91b73f94beaa97e3a - f8c7805791b6787421a9ce6983037cd45f8d827faf414de91b73f94beaa97e3a
/opt/CAPEv2/storage/analyses/8806/files/1b5f5fdb781d5bb0ca6d3596fea4dab5848e9c8e8cfa602b7de1507bdd2436da - 1b5f5fdb781d5bb0ca6d3596fea4dab5848e9c8e8cfa602b7de1507bdd2436da
/opt/CAPEv2/storage/analyses/8806/files/9ce53ec24c62171b97e203e7980aa2d66461eac93c30543f6a12d59dd590a9b9 - 9ce53ec24c62171b97e203e7980aa2d66461eac93c30543f6a12d59dd590a9b9
/opt/CAPEv2/storage/analyses/8806/files/a70f9f61a2730c64f3b85a9652ced60424e6d38454de3e8900998e507adc6055 - a70f9f61a2730c64f3b85a9652ced60424e6d38454de3e8900998e507adc6055
/opt/CAPEv2/storage/analyses/8806/files/67dd3fb5b0f55ecf3e25fad5851cc61942c375e2b1ca8958143019623ac83757 - 67dd3fb5b0f55ecf3e25fad5851cc61942c375e2b1ca8958143019623ac83757
/opt/CAPEv2/storage/analyses/8806/files/cbd526f3664b2a49eb2bed2b8ac48a8540b28dfbaf64550e6a971d93853ffa59 - cbd526f3664b2a49eb2bed2b8ac48a8540b28dfbaf64550e6a971d93853ffa59
/opt/CAPEv2/storage/analyses/8806/files/64f66fa1859c79ddd3d3cd039521e3916be7661965644ea95ab21d63bf7bb8dd - 64f66fa1859c79ddd3d3cd039521e3916be7661965644ea95ab21d63bf7bb8dd
/opt/CAPEv2/storage/analyses/8806/files/3ae3702112572fc0d61d64fa3cefc7e336efb444dfc1b5a447f99fdb87545ff9 - 3ae3702112572fc0d61d64fa3cefc7e336efb444dfc1b5a447f99fdb87545ff9
/opt/CAPEv2/storage/analyses/8806/files/05aa1bbadda04ce021c8c04577539894cfeaa811b90693dbd7c3b9d659ec36af - 05aa1bbadda04ce021c8c04577539894cfeaa811b90693dbd7c3b9d659ec36af
/opt/CAPEv2/storage/analyses/8806/files/570009e4f1fe7a054265f6985097a99465843223a17e8497e16208df5d08a710 - 570009e4f1fe7a054265f6985097a99465843223a17e8497e16208df5d08a710
/opt/CAPEv2/storage/analyses/8806/files/dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d - dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d
/opt/CAPEv2/storage/analyses/8806/files/bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620 - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://google.com/
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786362013&P2=404&P3=2&P4=WOP4USr3aKR7P1NUDXVcmUENsZfr1cb8waZIALeDQ93MoMrJEGsE8%2bk48son%2bzR5Sfs187AoMOW3ZU5Tv4aCag%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786362115&P2=404&P3=2&P4=EWnioek8FwmFCG2Wqop7VE5k5AB1Vu1Rry%2fK9cFiZVeuS8EuEzALB4fi28ub7FcxzkCcuc8HmynDiorRCxHoHw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.42.73.25
52.123.252.193
85.210.193.152
4.230.171.124
20.247.184.197
52.110.12.20
52.110.12.26
20.165.94.63
4.150.223.114
135.233.95.135
172.178.240.163
200.87.164.69
172.178.240.162
203.26.79.13
200.119.204.12
190.186.45.170
20.165.94.46
72.145.35.107
52.148.114.188
20.184.175.16
20.184.175.4
135.234.160.244
142.251.222.238
142.250.207.14
52.110.12.50

More NabucurObfs samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report