MALICIOUS — 2a19fc3d6cca39f5d995f3f1f26940eecbda07ffb450edc96052edc9810f749c

MALICIOUS — 2a19fc3d6cca39f5d995f3f1f26940eecbda07ffb450edc96052edc9810f749c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Ipamor family. 8 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 2a19fc3d6cca39f5d995f3f1f26940eecbda07ffb450edc96052edc9810f749c
SHA-1: e61e9a0d51cf1a57bdea3564145b35bddc2865c9
MD5: 71918823eb2b3f6118167b5aa86da11e
imphash: 7732c84aec7391973c26fbc2c07a6022
ssdeep: 49152:NOafDCC+R2zNsnKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl:z+RYNAKvkTgXuquveY+W2o8oT3ezMrl
TLSH: T16A5A5ACD422E2742DBB6D6249C109DEC8002F4E9603DBE4C1B47C1BA55E6E77EDB50A8
Submitted as: 2a19fc3d6cca39f5d995f3f1f26940eecbda07ffb450edc96052edc9810f749c
File type: pe · Size: 2114773 bytes
Verdict: malicious (100/100) · Family: Ipamor

Detections (8 of 55 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Ipamor-9935088-0
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
YARA: Yara-Rules community: YR_AntiDebug_Checks
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Ipamor-9935088-0 (rule Win.Malware.Ipamor-9935088-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 21 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://nsis.sf.net/NSIS_Error - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com/0
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.digicert.com/ssl-cps-repository.htm0
http://crl3.digicert.com/assured-cs-2011a.crl03
http://crl4.digicert.com/assured-cs-2011a.crl0
http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
http://crl.thawte.com/ThawteTimestampingCA.crl0
http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://nsis.sf.net/NSIS_Error
https://support.mozilla.org
https://www.mozilla.org/firefox/43.0.1/releasenotes
https://www.mozilla.org
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787644363&P2=404&P3=2&P4=iOn9Dx62plWAGbZ6RXDTPNfTjLtqAB0WgeZ2EK2fbi5fwasQnhXRXQeFMDL1v%2fqv6J5avipQ5PjUlkRgeBrNfA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com
www.digicert.com
cacerts.digicert.com
crl3.digicert.com
crl4.digicert.com
ts-aia.ws.symantec.com
ts-crl.ws.symantec.com
crl.thawte.com
schemas.microsoft.com
nsis.sf.net
mozilla.org
support.mozilla.org
www.mozilla.org

Embedded IP addresses

74.178.232.29
4.150.223.98
57.155.104.224
4.230.171.124
40.84.97.4
20.247.184.197
74.179.77.204
135.232.92.97
20.42.65.94
20.112.250.133
52.123.129.14
52.123.128.14
52.168.117.168
203.26.79.13
72.145.35.108
52.110.12.50
52.148.114.188
135.233.45.223
172.66.2.5
52.110.12.37
135.232.92.34

Registry keys

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft

File paths

c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\obj-firefox\dom\plugins\ipc\hangui\plugin-hang-ui.pdb
C:\Users\jim\Desktop\metro
T:\:d:l:t:
C:\Program

More Ipamor samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report