MALICIOUS — 1d1819cb7a22b2a452e6eca1a4f212a68a66217a7df8eb1a58046a3e04899533
MALICIOUS — 1d1819cb7a22b2a452e6eca1a4f212a68a66217a7df8eb1a58046a3e04899533 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (90/100), attributed to the HUILoader family. 4 of 56 detection engines flagged it.
Identification
- SHA-256:
1d1819cb7a22b2a452e6eca1a4f212a68a66217a7df8eb1a58046a3e04899533 - SHA-1:
a7a045abb5709bd3402bb0a4e4fd74aed47c70aa - MD5:
13d7f13693d3fed66d521f0529676b13 - imphash:
98b9ce77a5e39121a585c86672496860 - ssdeep:
96:3PoU01qwLKr//20Px71OH3r6mf6bhqXf4X21Bml:/Hw8/uAxC6HlA4X21u - TLSH:
T1841FE9EE4662123DC5F5A5102C0A148C50E124A098FF49CEE72B71B916FB0BB6D7217F - Submitted as: 1d1819cb7a22b2a452e6eca1a4f212a68a66217a7df8eb1a58046a3e04899533
- File type: pe · Size: 7168 bytes
- Verdict: malicious (90/100) · Family: HUILoader
Detections (4 of 56 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Detect It Easy (packer/type): DIE:Microsoft Linker
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
Why this verdict
The malicious score of 90/100 is the fusion of 6 weighted signals:
- Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule
HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule
DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule
UPX) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
197 behavior events · 0 ATT&CK techniques · 2 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- v20.events.data.microsoft.com
- desktop-hsgcbep
- config.edge.skype.com
- windows.msn.com
- officeclient.microsoft.com
- www.msn.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
- www.bing.com
- th.bing.com
- licensing.mp.microsoft.com
- fe3cr.delivery.mp.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Local\Temp\file.txt -
932789a0c3815ccf7835407c7816b0428c506148c7280cb303048f5e0fa6fcae - b07840368b78f5b6466b41850b9216184a5a1b8095fdf64191639091f8552e2b -
b07840368b78f5b6466b41850b9216184a5a1b8095fdf64191639091f8552e2b
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded IP addresses
- 4.150.223.115
- 52.123.252.229
- 4.247.188.224
- 4.230.171.124
- 4.247.188.233
- 20.247.185.124
- 135.232.92.97
- 20.165.94.63
- 104.18.33.89
- 20.42.73.24
- 4.150.223.105
- 52.110.12.33
- 52.110.12.32
File paths
- C:\vgram
More HUILoader samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report