MALICIOUS — 23ab7e11988a284121ac1231ba9f44e186989d6a6124a02c309f802ae009895b

MALICIOUS — 23ab7e11988a284121ac1231ba9f44e186989d6a6124a02c309f802ae009895b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AutoRun family. 10 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 23ab7e11988a284121ac1231ba9f44e186989d6a6124a02c309f802ae009895b
SHA-1: cb12730bc222d933ec4d77a603bdc306e9e8ca8e
MD5: b7bd873b08b3886d319da2e840b4e12e
imphash: 01392ca861cf87b8d28ad9ea90016bb4
ssdeep: 24576:OcMIOcMIMnpc8iHNFpePjO7KX53RTh0tFda3a4/izRXTOkMtrIceMaFPjkjD29Vz:lXIpc8MNFErOO53RTqtiaakOElMaFLkQ
TLSH: T16857BE895112F305E2F2EE602C055D8CE472F5BD75BE9ACC1382C4AFA6E693761140EE
Submitted as: 23ab7e11988a284121ac1231ba9f44e186989d6a6124a02c309f802ae009895b
File type: pe · Size: 1521704 bytes
Verdict: malicious (100/100) · Family: AutoRun

Detections (10 of 56 engines)

capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): ASPack
ClamAV (daily): Win.Packed.Pidgeon-9909600-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Worm:Win32/AutoRun!pz
Emsisoft (Emergency Kit): Gen:Heur.Mint.Autorunner.1
Trellix Stinger (McAfee): W32/Worm-GBW!B7BD873B08B3
Kaspersky (KVRT): Worm.Win32.AutoRun.vx

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 21 weighted signals:

ClamAV (daily) flagged Win.Packed.Pidgeon-9909600-0 (rule Win.Packed.Pidgeon-9909600-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Worm:Win32/AutoRun!pz (rule Worm:Win32/AutoRun!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Mint.Autorunner.1 (rule Gen:Heur.Mint.Autorunner.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/Worm-GBW!B7BD873B08B3 (rule W32/Worm-GBW!B7BD873B08B3) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.AutoRun.vx (rule Worm.Win32.AutoRun.vx) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 1 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged ASPack (rule ASPack) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.videolan.org/, 5.1.125.0 - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: ASPack, high-entropy-sections:.text, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 22 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

26284 behavior events · 1 ATT&CK techniques · 23 dropped files.

Dropped files

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - 377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\7-Zip\7zFM.exe - 0367c3f40143ab77bd21a16989bfdacb0f6c6e958d162b018626c4bc2e883fff
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe - 4c2078f35d49fb7c3b4b462e4118761904ae426572a3d616531492724e223703
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe - b6c80702462ed1902478fdc3f0077da2ab8ad24ebf34055be4e6442d02ff7265
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe - 6a78dba30ca10f3addef5b1683bd7bc97e98ce03c9e6ae7056845ee1b70b7d10
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe - 63156ae4b122e6f9584581782b64327bfbf60d31ae39de283fd5beeea5aa6746
C:\Program Files\7-Zip\7z.exe - 634d38c0c414178e2f35de5cc0fb29aa082eec227e630c4481e1af7694980ac9
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe - 7f65f5ae08cc5a15df0c7d70e3fc3ba5b4f083dcbdc02170423867257ffaf076
C:\Program Files\7-Zip\7zG.exe - 7b5eda73c21960c451ea3148900b28cdbac7180e43047fbc944028096e497c08
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe - da6d0544ee3a6b75f3c5c545213b10ec93a15d5213e5232e7e224a29ecb91d6b
C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\MenuCoreApp\AcroShareTarget.exe - 7f722983c6131e598b56edd72152b9390628dc453a5e86170d91f8f834e23859
C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\MenuCoreApp\AcroShareTarget.exe - f8e5f96f5d1a4af50ee6a35ecf9d629e1694d8397d681a7d1eb7683c2a3a653c
C:\Program Files\7-Zip\7zFM.exe - 2e030aa5cdf7c562c0acc516e43265d031ec41f448f972d2c3882e9208aa3eb8

Embedded URLs

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/windows0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.videolan.org/
http://www.microsoft.com/pki/certs/CSPCA.crt0
http://www.microsoft.com/pki/certs/tspca.crt0
https://hl2rcv.adobe.com/headlights
http://crl.verisign.com/tss-ca.crl0
http://crl.verisign.com/pca3.crl0
https://www.verisign.com/cps0
http://logo.verisign.com/vslogo.gif04
https://www.verisign.com/rpa
http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
https://www.verisign.com/cps0*
https://www.verisign.com/rpa0
http://crl.verisign.com/pca3-g5.crl04
http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://schemas.microsoft.com/ws/2006/05/framing/faults/UnsupportedMode
http://schemas.microsoft.com/ws/2006/05/framing/faults/ConnectionDispatchFailed
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Embedded domains

www.microsoft.com
crl.microsoft.com
www.videolan.org
hl2rcv.adobe.com
crl.verisign.com
www.verisign.com
logo.verisign.com
csc3-2010-crl.verisign.com
csc3-2010-aia.verisign.com
office.microsoft.com
schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

5.1.125.0
20.42.73.31
52.123.252.192
4.230.171.124
85.210.193.152
20.247.184.142
57.155.101.212
20.165.94.63
172.64.154.167
135.232.92.97
20.184.175.19
172.172.255.216
40.79.167.10
20.42.73.30
125.56.205.24
125.56.205.17
52.148.114.188
20.42.179.192
72.153.5.137
52.110.12.50
52.110.12.3

File paths

f:\dd\Tools\devdiv\FinalPublicKey.snk
X:\:`:d:h:l:p:t:x:
X:\:t:
T:\:
F:\Office\Target\x86\ship\postc2r\x-none\orgchart.pdb
L:\:o:z:
V:\:r:x:
N:\:i:f;~;
V:\:b:h:n:t:z:

More AutoRun samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report