MALICIOUS — 36eee58461066177a9ad983ec2bacb9e8344c3d4e05d913c235c5dfd764a195e
MALICIOUS — 36eee58461066177a9ad983ec2bacb9e8344c3d4e05d913c235c5dfd764a195e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the Guap family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
36eee58461066177a9ad983ec2bacb9e8344c3d4e05d913c235c5dfd764a195e - SHA-1:
165902e477e81f324fd4950a123b87388f8b2704 - MD5:
6095badfdbbe9556e10c94fecf3ae906 - imphash:
b6230692891661869cecd581561a21f4 - ssdeep:
12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXt:zW6ncoyqOp6IsTl/mXt - TLSH:
T1394CBED87AC7CD54E8E97B86E44554BDD68BD12F582D2E8F0392C2386F812F3A472112 - Submitted as: 36eee58461066177a9ad983ec2bacb9e8344c3d4e05d913c235c5dfd764a195e
- File type: pe · Size: 534737 bytes
- Verdict: malicious (94/100) · Family: Guap
Detections (6 of 55 engines)
- ClamAV (daily): Win.Worm.Guap-4
- YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
- YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
- Microsoft Defender: Trojan:Win32/Fsysna!pz
- Emsisoft (Emergency Kit): Gen:Heur.Spesr.VB.1
- Kaspersky (KVRT): Trojan.Win32.Fsysna.gevi
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Win.Worm.Guap-4 (rule
Win.Worm.Guap-4) - engine signal, weight 0.90, confidence 0.95 - YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule
DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70 - YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule
TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded domains
- server.com
- tsymantec.com
- tsecurityresponse.symantec.com
- tsarc.com
- twww.sarc.com
- twww.sophos.com
- tsophos.com
- twww.mcafee.com
- tmcafee.com
- tliveupdate.symantecliveupdate.com
- twww.viruslist.com
- tviruslist.com
- tf-secure.com
- twww.f-secure.com
- tf-prot.com
- twww.f-prot.com
- tkaspersky.com
- tkaspersky-labs.com
- twww.avp.com
- tavp.com
- twww.kaspersky.com
- twww.networkassociates.com
- tnetworkassociates.com
- twww.ca.com
- tca.com
Registry keys
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
File paths
- C:\Program
- C:\WINDOWS\system32\drivers\etc\hosts
More Guap samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report