SUSPICIOUS — 30bbcd1158b7806d69afd76e5c2d95ef83ae5e19108858a7a2c331d4aa849f02
SUSPICIOUS — 30bbcd1158b7806d69afd76e5c2d95ef83ae5e19108858a7a2c331d4aa849f02 is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (55/100), attributed to the Maldoc family. 5 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
30bbcd1158b7806d69afd76e5c2d95ef83ae5e19108858a7a2c331d4aa849f02 - SHA-1:
ac1c854216ed956eb5a864d1e0efb5cf8afcd894 - MD5:
3c865392e6cd28655745c8f7b7ecafeb - imphash:
5e4ee8ddacecc273158d4f920bd3b6de - ssdeep:
12288:TnENyXZ/CpXkhImofJSV+2fr9uqmJ5zADn2ls+KFv9fc8Cq4akGP/6jrWNKzc4VI:TENmZju4AO9uTzSnss+KFvt3h - TLSH:
T1F75407A0A248B242CFF2E5B4F854C72C6BF3A85541B658CC5307A5AB80F55B74E3849F - Submitted as: 30bbcd1158b7806d69afd76e5c2d95ef83ae5e19108858a7a2c331d4aa849f02
- File type: pe · Size: 1123585 bytes
- Verdict: suspicious (55/100) · Family: Maldoc
Detections (5 of 55 engines)
- YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
- YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
- Microsoft Defender: Worm:VBS/Autorun.AG
- Emsisoft (Emergency Kit): Gen:Variant.Jaik.79739
- Kaspersky (KVRT): UDS:Virus.DOS.Trivial-based
MITRE ATT&CK
Why this verdict
The suspicious score of 55/100 is the fusion of 3 weighted signals:
- YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule
DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70 - YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule
TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded domains
- file.name
- ostream-inst.cc
- ios-inst.cc
- ios.cc
- streambuf.cc
- ctype.cc
- functexcept.cc
- streambuf-inst.cc
- misc-inst.cc
- istream-inst.cc
- atomicity.cc
- locale.cc
- ext-inst.cc
- locale-inst.cc
- wlocale-inst.cc
- tinfo.cc
- future.cc
- functional.cc
- stdexcept.cc
- string-inst.cc
- regex.cc
- istream.cc
- wstring-inst.cc
- codecvt.cc
- guard.cc
Registry keys
- HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogoff
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableChangePassword
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
- HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
- HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
- HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoPinnedList
- HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPinningToTaskbar
- HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar
- HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayItemsDisplay
- HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu
- HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSaveSettings
- HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation
- HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
- HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
- HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuPinnedList
- HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMFUprogramsList
- HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMorePrograms,
- HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions
- HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate
- HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun
- HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind
File paths
- C:\windows
- C:\MinGW\msys\1.0\src\mingwrt
- c:\crossdev\build\gcc-tdm32\mingw32\libgcc
- C:\MinGW\msys\1.0\src\mingwrt\mingwex
More Maldoc samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report