MALICIOUS — 2f3eaa39bba938a3bee3627c5f4f6bc669f5f790f7017aa20c6d5d9f6f627571

MALICIOUS — 2f3eaa39bba938a3bee3627c5f4f6bc669f5f790f7017aa20c6d5d9f6f627571 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Bulz family. 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 2f3eaa39bba938a3bee3627c5f4f6bc669f5f790f7017aa20c6d5d9f6f627571
SHA-1: 04c5bf142ea9730ef8523e6bddd74404dcad5531
MD5: d4b1518b0cd4597c3f89a19622207ec4
imphash: d3bc783da925e7c48a8f1e0e2c6c25b1
ssdeep: 6144:XyX/HEpgPCbV1fNm3Tx0TpKidq2o7D29fx+J9zyHqYLL+o63kOQSzB:k/HEp64lQaVH8vaZ/M
TLSH: T15F4C8D980902EA52D9B187515F303D6CA93EF8E6327E2B4C23D3961FFAE316351750A4
Submitted as: 2f3eaa39bba938a3bee3627c5f4f6bc669f5f790f7017aa20c6d5d9f6f627571
File type: pe · Size: 540672 bytes
Verdict: malicious (98/100) · Family: Bulz

Detections (4 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Bulz-9885565-0
YARA: Yara-Rules community: YR_AntiDebug_Checks
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

T1056.001

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Bulz-9885565-0 (rule Win.Malware.Bulz-9885565-0) - engine signal, weight 0.90, confidence 0.95
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://bestswim.officeisp.net/Shared%20Documents/BESTmeetentryform.doc, http://www.zelphish.com/alki%20pipeline.pdf, 6.0.1.0 - static signal, weight 0.35, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://bestswim.officeisp.net/Shared%20Documents/BESTmeetentryform.doc
http://www.zelphish.com/alki%20pipeline.pdf
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com
bestswim.officeisp.net
www.zelphish.com

Embedded IP addresses

6.0.1.0
4.207.44.72
52.123.252.222
4.230.171.124
4.144.132.223
85.210.196.11
74.178.76.54
74.178.76.128
51.116.246.106
52.110.12.30
52.110.12.11

File paths

F:\Office\Target\x86\ship\postc2r\x-none\msouc.pdb
X:\:d:
H:\:`:p:t:x:
X:\:l:p:

More Bulz samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report