MALICIOUS — 33530a9fa4faeee72b61c169df76777371bd4a640af6dfa6211d84ff994e2c45

MALICIOUS — 33530a9fa4faeee72b61c169df76777371bd4a640af6dfa6211d84ff994e2c45 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 5 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 33530a9fa4faeee72b61c169df76777371bd4a640af6dfa6211d84ff994e2c45
• SHA-1: 2907e1c4eea66d2abe5759fd1deb6884f5a41f7c
• MD5: ea2bea9b778063e184d7251c54864b4e
• imphash: 975416a593605d0dcf303b90eb3a6c03
• ssdeep: 3072:J3Ewo1POGX0J3jaxJwD0rMfCngJvlO6EWe4Vf8ilv1pFH:J3PoFEJGxOD0rO4ZLilv1pF
• TLSH: T118418F6F309289BFC30A27807FD028CC13E257DA21575CA6E049D2D9D9A53FBAE90475
• Submitted as: 33530a9fa4faeee72b61c169df76777371bd4a640af6dfa6211d84ff994e2c45
• File type: pe · Size: 192903 bytes
• Verdict: malicious (99/100)

Detections (5 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
• ClamAV (daily): Win.Malware.Generickdz-10004857-0
• Microsoft Defender: Trojan:Win32/Vbclone.RPX!MTB
• Emsisoft (Emergency Kit): Generic.Dacic.94CCEEA9.A.BE0AB3A0
• Kaspersky (KVRT): Trojan.Win32.VB.dosb

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Win.Malware.Generickdz-10004857-0 (rule Win.Malware.Generickdz-10004857-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/Vbclone.RPX!MTB (rule Trojan:Win32/Vbclone.RPX!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Generic.Dacic.94CCEEA9.A.BE0AB3A0 (rule Generic.Dacic.94CCEEA9.A.BE0AB3A0) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Trojan.Win32.VB.dosb (rule Trojan.Win32.VB.dosb) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://www.iec.ch - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

13786 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• nexusrules.officeapps.live.com
• 210.110.171.150.in-addr.arpa.
• c.pki.goog
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• 163.195.250.142.in-addr.arpa.
• 106.238.33.23.in-addr.arpa.
• 54.133.221.23.in-addr.arpa.
• desktop-hsgcbep
• login.live.com
• update.googleapis.com
• self.events.data.microsoft.com

Embedded URLs

• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/photoshop/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
• http://ns.adobe.com/xap/1.0/sType/ResourceRef#
• http://www.iec.ch
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• ns.adobe.com
• www.w3.org
• url.org
• www.iec.ch
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 72.145.35.96
• 72.145.35.97
• 104.208.16.94
• 20.42.65.89
• 203.26.79.13
• 52.148.114.188
• 57.154.63.210
• 20.52.64.201
• 172.172.255.217
• 4.150.223.105
• 172.172.255.216
• 4.150.223.111
• 20.89.1.9
• 72.153.5.96
• 4.150.223.110
• 4.150.223.109
• 172.215.188.232
• 20.165.94.46
• 40.84.85.40
• 172.66.2.5
• 20.247.184.142
• 52.110.12.21
• 4.230.171.124

File paths

• C:\Program

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report