MALICIOUS — 2adb67c7da1360ce015713049ace6919ab9e7f51cbea2f3737c5bd3d13297fe1

MALICIOUS — 2adb67c7da1360ce015713049ace6919ab9e7f51cbea2f3737c5bd3d13297fe1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Pidgeon family. 10 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 2adb67c7da1360ce015713049ace6919ab9e7f51cbea2f3737c5bd3d13297fe1
SHA-1: 1766c5d8ef195f92c52a3269dc6973aabfc67d06
MD5: c6cd547134b04348d900ab933fcd7fa1
imphash: 01392ca861cf87b8d28ad9ea90016bb4
ssdeep: 24576:bedqN/JWSVWcxDv4/izRXTOkMtrIceMaFPjkjD29:6CWSVFDvakOElMaFLk
TLSH: T1F6568D89821AA21BE3F2DD514C058CECD871F6BD60BDA5CD0282C95EA5E6C37E1540EF
Submitted as: 2adb67c7da1360ce015713049ace6919ab9e7f51cbea2f3737c5bd3d13297fe1
File type: pe · Size: 1384193 bytes
Verdict: malicious (100/100) · Family: Pidgeon

Detections (10 of 55 engines)

capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): ASPack
ClamAV (daily): Win.Packed.Pidgeon-9909600-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Worm:Win32/AutoRun!pz
Emsisoft (Emergency Kit): Gen:Heur.Mint.Autorunner.1
Trellix Stinger (McAfee): W32/Worm-GBW!C6CD547134B0
Kaspersky (KVRT): Worm.Win32.AutoRun.vx

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Packed.Pidgeon-9909600-0 (rule Win.Packed.Pidgeon-9909600-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 28 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.gnu.org/software/coreutils/, http://translationproject.org/team/, 5.1.125.0 - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: ASPack, high-entropy-sections:.text, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 26 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

25001 behavior events · 1 ATT&CK techniques · 27 dropped files.

Dropped files

C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe - 3e27cc6407fc7d7b6e26495c6ff849c23cf3b6e9c8a885ea742ad7b3109af536
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - 51e57fdf672acec905dc11fb467293a6c1251683cb92e769d451e46b9e0e92d6
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\klist.exe - 74e249fe4883767e0e89f2829dec112e6a3ca465a0540b0a660ff5e2aaa10ed5
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jrunscript.exe - 3c6d62569a6dbad19d57ab33039ea0626a3eaf4386fa8b207c136957b26005ab
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - c4c65264e0d3b9b31c5262259ec4b8af6ec62a1fff918a98910aabf17f015959
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe - 8c435a45123e88410f42259fcb3b303b5f60ce00e01d8d4a9c5bd342bf51e184
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - 599e533da3261e2fc678ccc3393bb90cafa7ce620196168b9c5cb41a4e48099b
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccessinspector.exe - a7487ee88d94f322148489c818cc861ee1e77ec31ce5b5e7b5e999c0d5acf6f6
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaw.exe - 00293b1fc4c093b570c7a9433fb5b16b188e938061cacf6f7a35721a6f346acb
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\kinit.exe - 517250e2c2afcaa114d150811af3a89e97632033719d7c26adcc756878d81e90
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - befc040637ab0bc789296cb03990c70e347171828cc0e99600035454cc6bd15a
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jwebserver.exe - cd25e41b47e7af9c48c813165ff16880906ace81984cc15bdea2fcb8fddfd8a1
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - cac59cf53e7c4caa1ee26d889181c3c48fbe6074a1369eed652d9fd957083389
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jrunscript.exe - 37c4980764e6995a9a491e1571cc1c2e593bf0402eb53ef16a1571c24c73e812

Embedded URLs

http://www.gnu.org/software/coreutils/
http://translationproject.org/team/
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/windows0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://schemas.microsoft.com/windows/2004/02/mit/task
https://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-cs-g1.crl05
http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
http://www.digicert.com/ssl-cps-repository.htm0
http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787807456&P2=404&P3=2&P4=THT3BGogkNEn7YqOGl%2bjOgDxyIOai9jHaJH68ZaOVmnJZbmNOGovwJt4O%2bjOu8VUn8QZiL%2bNbHkJm2kGsU9n2Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787807567&P2=404&P3=2&P4=bQvATPSQ38pO%2beKu48XU0Gfa%2fszMV220J%2fQFrYPwhel6jW6I3New2PjcTBwkYAmbPAivX4EtIJgeX76N2TX6jg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.gnu.org
translationproject.org
www.microsoft.com
crl.microsoft.com
schemas.microsoft.com
cacerts.digicert.com
crl4.digicert.com
crl3.digicert.com
www.digicert.com
office.microsoft.com

Embedded IP addresses

5.1.125.0
51.116.246.106
4.230.171.124
52.230.59.222
85.210.193.152
74.178.76.128
74.178.240.51
51.11.192.48
20.112.250.133
52.123.128.14
52.123.129.14
172.66.2.5
203.26.79.13
135.233.45.221
52.110.12.2
52.110.12.25
52.148.114.188
135.232.92.34
52.123.252.242
125.56.205.122
125.56.205.17
92.223.78.30
52.123.252.224
72.153.5.132
57.155.104.224

File paths

C:\Windows\system32\sc.exe
F:\Office\Target\x86\ship\postc2r\x-none\orgchart.pdb
L:\:o:z:
V:\:r:x:
N:\:i:f;~;
V:\:b:h:n:t:z:
c:\\path\to\somefile.exe

More Pidgeon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report