MALICIOUS — 302f2ad9107d8f57118f70343c8fd46d663cd5fefea838820f423c5f8aa6d4ea

MALICIOUS — 302f2ad9107d8f57118f70343c8fd46d663cd5fefea838820f423c5f8aa6d4ea is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100). 2 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 302f2ad9107d8f57118f70343c8fd46d663cd5fefea838820f423c5f8aa6d4ea
SHA-1: 975c8c4de0e0171306e3364f0175f498257815ff
MD5: 16fc0282e8072185f7abe5cdb9eaf8e5
imphash: d0c59b9a9b9f2208ab9452466b7f74a6
ssdeep: 3072:uefeft5L7pVDujN/vTI89+6fSAFkRjHTacl5w+432f4Si9yCT:85PpFuZ/vTL9+6NkaC5DbCT
TLSH: T1933F73DE862F7311D6F6D838652089ED400AB488617D7FCD4A03D67640E2E37ECB64A9
Submitted as: 302f2ad9107d8f57118f70343c8fd46d663cd5fefea838820f423c5f8aa6d4ea
File type: pe · Size: 158882 bytes
Verdict: malicious (89/100)

Detections (2 of 56 engines)

capa (capabilities): capability:credential-access
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

Why this verdict

The malicious score of 89/100 is the fusion of 6 weighted signals:

Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in tsk_fda6f22aa1 (pid 7192) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
Contacted 4 external host(s) and 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:credential-access (rule capability:credential-access) - engine signal, weight 0.35, confidence 0.70
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

459 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

3d2827a9401d77b019bd7e967d71d4cffc523dffd0e126a3789d45c4aac86386 - 3d2827a9401d77b019bd7e967d71d4cffc523dffd0e126a3789d45c4aac86386

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

crl.microsoft.com
www.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.65.94
4.230.171.124
48.211.4.16
20.42.179.192
74.178.240.51
20.247.184.197
74.178.240.61
52.182.143.212
20.184.175.7
92.223.78.30
74.178.76.128
172.170.180.133
34.104.35.123
52.178.17.233
52.110.12.11
52.110.12.45
52.168.117.168
104.18.33.89
203.26.79.13
52.110.12.4
52.110.12.18
72.145.35.101
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report