MALICIOUS — 2ac0370d9afece495545c0678d447e05985a79863ca56b1cf7b0fe66985ed11f

MALICIOUS — 2ac0370d9afece495545c0678d447e05985a79863ca56b1cf7b0fe66985ed11f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 6 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 2ac0370d9afece495545c0678d447e05985a79863ca56b1cf7b0fe66985ed11f
• SHA-1: fd2564c3dc37ed969bbb5612b591072ab19f5360
• MD5: ab24ed82a0fb54764a2d023de8bed4a9
• imphash: 54b1e50171d7a2e3aaa47b65a2d0b449
• ssdeep: 98304:cCVMrkbsroCVMrkbsr6CVMrkbsrvCVMrkbsrU:ckMrkQrokMrkQr6kMrkQrvkMrkQrU
• TLSH: T165696CB162B0B3C2F5A1E6A0F4007E1F45E254A56D7A9CEC7182D11B33F9CBB016A356
• Submitted as: 2ac0370d9afece495545c0678d447e05985a79863ca56b1cf7b0fe66985ed11f
• File type: pe · Size: 8655218 bytes
• Verdict: malicious (100/100) · Family: HUILoader

Detections (6 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): Win.Malware.Generic-9891477-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Trojan:Win32/CryptInject!pz
• Emsisoft (Emergency Kit): Trojan.GenericKD.39862403
• Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

• T1547.001

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

• ClamAV (daily) flagged Win.Malware.Generic-9891477-0 (rule Win.Malware.Generic-9891477-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/CryptInject!pz (rule Trojan:Win32/CryptInject!pz) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.GenericKD.39862403 (rule Trojan.GenericKD.39862403) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Virus.Win32.Lamer.ks (rule Virus.Win32.Lamer.ks) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• Contacted 1 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: http://www.pinkworld.com, http://www.youporn.com, http://www.redtube.com - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• licensing.mp.microsoft.com
• assets.msn.com
• www.bing.com
• v10.events.data.microsoft.com
• watson.events.data.microsoft.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Embedded URLs

• http://www.pinkworld.com
• http://www.youporn.com
• http://www.redtube.com
• http://www.assparade.com/
• http://www.freeav.com/
• http://www.antispyware.com/
• http://www.antivirus.com/
• http://www.microsoft.com/pki/certs/CSPCA.crt0
• http://www.microsoft.com/pki/certs/tspca.crt0
• http://www.microsoft.com/directx0
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• www.pinkworld.com
• www.youporn.com
• www.redtube.com
• www.assparade.com
• www.freeav.com
• www.antispyware.com
• www.antivirus.com
• crl.microsoft.com
• www.microsoft.com

Embedded IP addresses

• 4.150.223.112
• 20.247.184.197
• 4.230.171.124
• 135.233.45.223
• 4.150.223.102
• 20.42.73.25
• 52.110.12.46
• 52.110.12.38
• 52.110.12.5
• 184.84.165.136

File paths

• P:\:d:
• T:\:h:
• H:\:d:
• T:\:
• H:\:p:
• X:\:`:d:h:l:p:t:x:
• X:\:`:d:h:l:p:

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report