MALICIOUS — 2c5bb65cb7f70c23c97c6d4ad6f71660d70a403264d87ff5b8a2ff3af69ac43f
MALICIOUS — 2c5bb65cb7f70c23c97c6d4ad6f71660d70a403264d87ff5b8a2ff3af69ac43f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Pumoo family. 7 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
2c5bb65cb7f70c23c97c6d4ad6f71660d70a403264d87ff5b8a2ff3af69ac43f - SHA-1:
6a4b2d6a32255d675c70c5d15ada56211774ebff - MD5:
eae30535c8a19e6b0c3da50cb59fa10a - imphash:
a96d166ab17e011e8049d87211158ae5 - ssdeep:
96:lxN2tdaQIBjH7IWlVKSD+1coKdxG8paaQi5DPtblYiY:lkdnejcWL3i3K1fQi5DPLjY - TLSH:
T1231F07127A215BD5C343F091D497CE1DC3A70F459AAB6E8C7963486AE3CA1073C0098F - Submitted as: 2c5bb65cb7f70c23c97c6d4ad6f71660d70a403264d87ff5b8a2ff3af69ac43f
- File type: pe · Size: 7680 bytes
- Verdict: malicious (98/100) · Family: Pumoo
Detections (7 of 55 engines)
- YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
- ClamAV (daily): Win.Worm.Pumoo-1
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): Generic.Malware.SMe.9F2094FC
- Kaspersky (KVRT): Email-Worm.Win32.Plemood.b
MITRE ATT&CK
YARA
- Windows_Injection_Api_Combo
Why this verdict
The malicious score of 98/100 is the fusion of 8 weighted signals:
- ClamAV (daily) flagged Win.Worm.Pumoo-1 (rule
Win.Worm.Pumoo-1) - engine signal, weight 0.90, confidence 0.95 - Process injection API combination (rule
Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90 - Contacted 26 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule
TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- inject code into another process (rule
inject code into another process) - capa signal, weight 0.12, confidence 0.60
Dynamic analysis (windows)
1334 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
Dropped files
- C:\Windows\System32\PurpleMood.scr -
aad6d7a4ed24d849394037111d30b5f84cfd6199f5532f70cdf7356b21c49b31
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787784381&P2=404&P3=2&P4=Wbvu366%2f8o8ha5aDRMvAnX2OB4E3yHJfKtVCPjEIzBErNCIJHP4FUxES4aaCisf%2fquQoMb3rSaabMpwNaJq8Fw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787784480&P2=404&P3=2&P4=n0uR1VwZsRwSn5VtxGrUSfLPKOTK0ChioWZu%2fPkEgu09Uwb68VDG9o0hi1nIT96QuT6kftmDeRCPste1oaK6bw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- pact518.hit.edu.cn
Embedded IP addresses
- 20.184.175.9
- 52.253.84.76
- 4.230.171.124
- 4.247.188.224
- 20.165.94.63
- 20.165.94.54
- 52.178.17.234
- 20.231.239.246
- 40.104.4.2
- 52.123.128.14
- 52.123.129.14
- 20.42.72.131
- 135.234.160.246
- 203.26.79.13
- 85.210.193.152
- 172.178.240.161
- 52.148.114.188
- 135.233.45.223
- 172.178.240.162
- 135.234.160.245
- 135.233.95.80
- 92.223.78.30
- 72.153.5.141
- 74.178.232.29
- 52.110.12.50
File paths
- d:\test
- C:\Windows\system32\PurpleMood.scr
More Pumoo samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report