MALICIOUS — 341a8b682c30f52417d6bcb4468008d1245009e0e631b29a68325e0b2fd11d3e

MALICIOUS — 341a8b682c30f52417d6bcb4468008d1245009e0e631b29a68325e0b2fd11d3e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (76/100). 1 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 341a8b682c30f52417d6bcb4468008d1245009e0e631b29a68325e0b2fd11d3e
• SHA-1: 667661444e54aa96de5e988952308b0005835e38
• MD5: 4bbcaad9772381c5217931ec8a23b11a
• imphash: 1be36ef5a216b659eeb9cc73a1d37914
• ssdeep: 49152:GFEzKgT0I/plYcRNMZXUlKia6iQQ5QJ+MsSVnMGVj+fNp6USPTopS3K22MgyXKh:aEV/plYcfMarvVQ5QpsOxj+fNyP0bnqY
• TLSH: T1265D3305C7192BB8E5B4096F78EA9D0DE5E357AE717CBC43A010D1C27A8C29F82C25E5
• Submitted as: 341a8b682c30f52417d6bcb4468008d1245009e0e631b29a68325e0b2fd11d3e
• File type: pe · Size: 2832125 bytes
• Verdict: malicious (76/100)

Detections (1 of 56 engines)

• capa (capabilities): capability:collection/keylog

MITRE ATT&CK

• T1056.001

Why this verdict

The malicious score of 76/100 is the fusion of 4 weighted signals:

• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• Contacted 21 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
• capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis (windows)

642 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• ctldl.windowsupdate.com
• update.googleapis.com
• desktop-hsgcbep
• login.live.com
• v20.events.data.microsoft.com
• config.edge.skype.com
• fe3cr.delivery.mp.microsoft.com
• v10.events.data.microsoft.com
• windows.msn.com
• officeclient.microsoft.com
• www.msn.com
• odc.officeapps.live.com

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/
• http://c.pki.goog/r/gsr1.crl
• http://c.pki.goog/r/r4.crl

Embedded domains

• cx.ga
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 4.150.223.105
• 52.123.252.241
• 74.178.76.54
• 4.150.223.98
• 20.42.179.204
• 74.179.77.204
• 4.230.171.124
• 20.247.184.142
• 20.52.64.201
• 52.123.252.219
• 104.208.16.94
• 52.110.12.53
• 52.110.12.2
• 72.153.5.131
• 52.148.114.188

File paths

• C:\Program
• R:\_v
• O:\@

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report