MALICIOUS — 298a13a73109bbaa8916a5de2806e320f2d50f7a533f69406bb2a7550224a41d

MALICIOUS — 298a13a73109bbaa8916a5de2806e320f2d50f7a533f69406bb2a7550224a41d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Maldoc family. 3 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 298a13a73109bbaa8916a5de2806e320f2d50f7a533f69406bb2a7550224a41d
SHA-1: d6c33301f9ea16ca2d02a1f7c293ae372752a779
MD5: b2bedd96fc9edbecbb9b511c4c36ae45
imphash: 6261f394332baab962003b7d36f650f6
ssdeep: 1536:DrWjlaJZxgRDdBFB8l9kYBaVJRaCAd1uhNRk98EBsTL:DijlwPITF+lyYBa1098EGTL
TLSH: T167438F789932B2C1C6F29E645E20997C141CA48B1239B55B8ED3A16FF2FB07315B1393
Submitted as: 298a13a73109bbaa8916a5de2806e320f2d50f7a533f69406bb2a7550224a41d
File type: pe · Size: 234004 bytes
Verdict: malicious (97/100) · Family: Maldoc

Detections (3 of 55 engines)

ClamAV (daily): Win.Malware.Generic-9886878-0
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

T1071.001

Why this verdict

The malicious score of 97/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Malware.Generic-9886878-0 (rule Win.Malware.Generic-9886878-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Contacted 23 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787784027&P2=404&P3=2&P4=jrnRmEqFVHurMEoN%2fR1YEuBuzBOnHfEpdhwcC0ojVuC0IEatk4Uk5W5f7%2bsQ7KRKWo1V%2fWClDq48q0Atdy5ekQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com

Embedded IP addresses

52.123.252.231
20.50.201.200
4.144.132.223
4.230.171.124
172.215.188.225
52.123.252.233
74.179.71.159
20.165.94.63
74.178.76.54
203.26.79.13
4.207.44.73
74.178.76.128
20.231.239.246
52.123.128.14
40.103.64.242
52.123.129.14
52.168.117.168
135.234.160.244
52.148.114.188
72.145.35.102
52.110.12.49
172.66.2.5
52.110.12.42

File paths

F:\Office\Target\x64\ship\postc2r\x-none\msoxmled.pdb

More Maldoc samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report