MALICIOUS — 202d2a13df6cf7da3c58c7f1c988eee040fd6ff58b12a0fb8c546b5a2df6b2c5
MALICIOUS — 202d2a13df6cf7da3c58c7f1c988eee040fd6ff58b12a0fb8c546b5a2df6b2c5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Fileinfector family. 5 of 56 detection engines flagged it.
Identification
- SHA-256:
202d2a13df6cf7da3c58c7f1c988eee040fd6ff58b12a0fb8c546b5a2df6b2c5 - SHA-1:
26dd02908832dae1f535f1204d8e9b79f565a291 - MD5:
9b4e52b3db0ea10510948795270f45f8 - imphash:
6ba7b0e4e74a8eea96dca4fffc88b859 - ssdeep:
196608:/9HP6Zpy9KyhMI54u8LljslNsyHFOxKAU9HP6Zpy9KyhMI54u8LljslNsyHFOxK:/9HP62FCdU9HP62FCdZ9HP62FCdO9HP - TLSH:
T1C6697D8652247742E0F1C7A0FC418F5E59A2A1A921FA5DEC4643D05E3BF8C7B10BA3B5 - Submitted as: 202d2a13df6cf7da3c58c7f1c988eee040fd6ff58b12a0fb8c546b5a2df6b2c5
- File type: pe · Size: 8679327 bytes
- Verdict: malicious (99/100) · Family: Fileinfector
Detections (5 of 56 engines)
- ClamAV (daily): Win.Malware.Fileinfector-9834127-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- LIEF (executable format parser): lief:invalid-authenticode
- Microsoft Defender: Trojan:Win32/CryptInject!pz
- Kaspersky (KVRT): Virus.Win32.Lamer.ks
Why this verdict
The malicious score of 99/100 is the fusion of 6 weighted signals:
- ClamAV (daily) flagged Win.Malware.Fileinfector-9834127-0 (rule
Win.Malware.Fileinfector-9834127-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/CryptInject!pz (rule
Trojan:Win32/CryptInject!pz) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Virus.Win32.Lamer.ks (rule
Virus.Win32.Lamer.ks) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Contacted 3 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- LIEF (executable format parser) flagged lief:invalid-authenticode (rule
lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
Dynamic analysis (windows)
109 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- edgedl.me.gvt1.com
- desktop-hsgcbep
- login.live.com
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- licensing.mp.microsoft.com
- assets.msn.com
- settings-win.data.microsoft.com
- fe3cr.delivery.mp.microsoft.com
- slscr.update.microsoft.com
Embedded URLs
- http://www.microsoft.com/pki/certs/CSPCA.crt0
- http://www.microsoft.com/pki/certs/tspca.crt0
- http://www.microsoft.com/directx0
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- crl.microsoft.com
- www.microsoft.com
Embedded IP addresses
- 51.116.246.105
- 4.230.171.124
- 52.230.59.222
- 57.155.101.212
- 135.232.92.97
- 135.233.95.144
- 20.42.65.90
- 172.66.2.5
- 52.110.12.10
- 52.110.12.19
- 4.150.223.99
- 20.42.65.91
- 135.234.160.246
- 203.26.79.13
- 72.145.35.104
- 20.184.175.4
- 172.175.111.170
- 52.110.12.1
- 34.104.35.123
- 52.110.12.8
File paths
- P:\:h:t:
- E:\:
- X:\:`:d:h:
- X:\:`:d:h:l:p:t:x:
- X:\:`:J;c;
More Fileinfector samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report