MALICIOUS — 30be5fedaf63f0a75259eba04ddeadb689302cb4ceb8674c11e0ca81b3f794db

MALICIOUS — 30be5fedaf63f0a75259eba04ddeadb689302cb4ceb8674c11e0ca81b3f794db is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the FuBu family. 5 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 30be5fedaf63f0a75259eba04ddeadb689302cb4ceb8674c11e0ca81b3f794db
SHA-1: c5f9e22d6dce9f0a2c86efc2b4f691437824c20a
MD5: c3e3897de021e2a879ffa3340e5c6ae7
imphash: 77f13bc24efea5a05601b43cf44d1f1a
ssdeep: 3072:NR2FoCe4JS8H4sHb8ydTfPkx4lvipg5e78:NStIDCfTXkxqDz
TLSH: T12C3E8D4C422BA211E2FACD65AC508E9C943374EE39BAA28DD383D86F54D5C33E4F1454
Submitted as: 30be5fedaf63f0a75259eba04ddeadb689302cb4ceb8674c11e0ca81b3f794db
File type: pe · Size: 136585 bytes
Verdict: malicious (99/100) · Family: FuBu

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.FuBu-1
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Shodi
Emsisoft (Emergency Kit): Win32.HLLP.Shodi.A
Kaspersky (KVRT): Virus.Win32.HLLP.Shodi.a

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Trojan.FuBu-1 (rule Win.Trojan.FuBu-1) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Shodi (rule Virus:Win32/Shodi) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.HLLP.Shodi.A (rule Win32.HLLP.Shodi.A) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.HLLP.Shodi.a (rule Virus.Win32.HLLP.Shodi.a) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 2 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://www.symauth.com/cps0, http://www.symauth.com/rpa04, http://www.symauth.com/cps09 - static signal, weight 0.35, confidence 0.60
Dropped 11 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

10932 behavior events · 0 ATT&CK techniques · 25 dropped files.

Dropped files

C:\Windows\System32\UsaShohdi.asu - 53f7e8133b9e587f2d87087ed67a725ccb319fc518bb50cf1701c40108f2e6e5
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe - 1119b08dc7189eeebc955407f739b05a87184df3eb2aec7348d2b73746a9a2a4
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe - 71865f157e28848629f85714264e078e370ec3c6b1fd2dcc3531a9d8f0acdfa1
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe - c4a6c033ee85a9e704f09d8ae02da3d0cab2355ea0a34063e68e7ddef0d0bbd7
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.usa - 79671bf6759f645dfeb021e3fcece87abe20b7c6be7ee7bf9c362603056a23ee
C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe - 964c61085813d39cf90fc6ae2b36fe3689d82cf32647a53e9d5fda23793d33f1
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe - 1aa9ac1feffd9f968e31871526286ee9edfb7c292f65fa8d2961f03ae1dde766
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.usa - 7ab807b2f85d1de86a4ddbdc9efffe045c74d75668f9e7428999e863a062507b
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.usa - c82577476eb3c66d0e8e4e1c57c1cb88e453d988bd7cbc41abd5faa1449b30ca
C:\Program Files\7-Zip\7zG.exe - 0b90a524db439fa141c91e56765c1d344f465954b2782da691456f65778abbac
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.usa - ac57673f2caf4d337e22c1bddee94aa35db245b1f4701356c73da34731ca1fa0
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe - 6308755a38fd306173a409ea6733c8ad285bae78037b98046ac6ed44bc8c15c3
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.usa - ae2a000af454e8c936e325f88105268855dd266252d50ce2be3eac66b1e57c7e
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe - 94bfd9ac7d061eb14fdb7ef5fb4c80c1347c64525170dda90d50814c793332e9
C:\Program Files\7-Zip\7zFM.exe - f6ef6ba630c8265e5c2b0607290287f64e5acbd2c5084a0d6ea7a85a9c648c69

Embedded URLs

http://crl.thawte.com/ThawteTimestampingCA.crl0
http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
http://crl.verisign.com/pca3.crl0
https://www.verisign.com/cps0
http://logo.verisign.com/vslogo.gif04
http://www.symauth.com/cps0
http://www.symauth.com/rpa04
http://crl.verisign.com/pca3-g5.crl0
http://www.symauth.com/cps09
http://evcs-crl.ws.symantec.com/evcs.crl0
http://evcs-aia.ws.symantec.com/evcs.cer0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.thawte.com
ts-aia.ws.symantec.com
ts-crl.ws.symantec.com
crl.verisign.com
www.verisign.com
logo.verisign.com
www.symauth.com
evcs-crl.ws.symantec.com
evcs-aia.ws.symantec.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.108
4.230.171.124
4.144.132.223
85.210.196.11
135.232.92.97
74.178.240.61
162.159.142.9
52.110.12.10
52.110.12.42
72.145.35.97
92.223.78.30
20.50.201.195
52.148.114.188
52.110.12.3
52.110.12.40
4.150.223.112

File paths

F:\CB\11X_MainQ\BuildResults\bin\Release\chrome_wow_helper.pdb

More FuBu samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report