MALICIOUS — 3cdd4bd8934c299b580d742c48dd1f680db4bb51221efc7c38b751c265c3978a

MALICIOUS — 3cdd4bd8934c299b580d742c48dd1f680db4bb51221efc7c38b751c265c3978a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sivis family. 9 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 3cdd4bd8934c299b580d742c48dd1f680db4bb51221efc7c38b751c265c3978a
SHA-1: dbaaa725fccd639735aaadbc1fd9e259c1297030
MD5: 26c0bac62fd5facfb405c3ec904ee614
imphash: 38aa7c2ff6ef0e48a9520d6702d08df4
ssdeep: 6144:TeEriRsAxH/K2jye9POln4RUOeinwl5gaO5W2cRFtnWR9C:igixH/dpPOV4uOeinggFQFtWXC
TLSH: T16B4A9FB2111A1135D9FAADB0A01CCE7CD0637949703C6F5E9087EB5C90E8AD7E8FA491
Submitted as: 3cdd4bd8934c299b580d742c48dd1f680db4bb51221efc7c38b751c265c3978a
File type: pe · Size: 441200 bytes
Verdict: malicious (100/100) · Family: Sivis

Detections (9 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Agent-6943819-1
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX 3.91
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Trellix Stinger (McAfee): PolyPatch-UPX
Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-6943819-1 (rule Win.Trojan.Agent-6943819-1) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Sivis.A (rule Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PolyPatch-UPX (rule PolyPatch-UPX) - engine signal, weight 0.55, confidence 0.85
Contacted 33 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:UPX 3.91 (rule DIE:UPX 3.91) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX, UPX 3.91 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

25477 behavior events · 1 ATT&CK techniques · 97 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/12390/files/57b1c23e9a2b40027d0929c40829f2e706014f66d9bc0e18c9ba91e1bffe9a86 - 57b1c23e9a2b40027d0929c40829f2e706014f66d9bc0e18c9ba91e1bffe9a86
/opt/CAPEv2/storage/analyses/12390/files/b5963d4d5cf9f62708c83f30beb6762c7102ffbc8f03d57b70383b34db2b43bd - b5963d4d5cf9f62708c83f30beb6762c7102ffbc8f03d57b70383b34db2b43bd
/opt/CAPEv2/storage/analyses/12390/files/5869af0c9f3885f1a113ed3dc36a975d2174b89a7844bcf8959a29095c4b89b1 - 5869af0c9f3885f1a113ed3dc36a975d2174b89a7844bcf8959a29095c4b89b1
/opt/CAPEv2/storage/analyses/12390/files/f55d8a29de2ed18946bd45b87a85f627773c1c9f48aac1e0471c70d1d388e71c - f55d8a29de2ed18946bd45b87a85f627773c1c9f48aac1e0471c70d1d388e71c
/opt/CAPEv2/storage/analyses/12390/files/1e1e719e9b4994a3882fa6db6a012725f298df94db82bbfb8c8000f185abfb66 - 1e1e719e9b4994a3882fa6db6a012725f298df94db82bbfb8c8000f185abfb66
/opt/CAPEv2/storage/analyses/12390/files/497a8f50b9a57f6bd6c77d26ff2519b672e2dee48744346102297b7bafe14c34 - 497a8f50b9a57f6bd6c77d26ff2519b672e2dee48744346102297b7bafe14c34
/opt/CAPEv2/storage/analyses/12390/files/b7062665d17c76cde3c36cb3f5efc89885601e5dae21d663fabcef594358f034 - b7062665d17c76cde3c36cb3f5efc89885601e5dae21d663fabcef594358f034
/opt/CAPEv2/storage/analyses/12390/files/8ec6244b307766276060ff29c2738f74a3092e9e9efdab0748a501c897d67a58 - 8ec6244b307766276060ff29c2738f74a3092e9e9efdab0748a501c897d67a58
/opt/CAPEv2/storage/analyses/12390/files/59c70aaf1a2851f56afb01c18e7ac78d47d45c3332a53ac29b23ffb5b2a90481 - 59c70aaf1a2851f56afb01c18e7ac78d47d45c3332a53ac29b23ffb5b2a90481
/opt/CAPEv2/storage/analyses/12390/files/8a61d90079f618d6cffb16209b744430ad19c8fcc7dd1dc0b4fb26be45851093 - 8a61d90079f618d6cffb16209b744430ad19c8fcc7dd1dc0b4fb26be45851093
/opt/CAPEv2/storage/analyses/12390/files/e67078dbe95a5d1f7e9cf89c4e2dc02eeda794b8ea9d33b18412dd76b2d6f45e - e67078dbe95a5d1f7e9cf89c4e2dc02eeda794b8ea9d33b18412dd76b2d6f45e
/opt/CAPEv2/storage/analyses/12390/files/1d4e414f68ed2a2720dc8537c1456faeb53e30c6d3f0244bc10e37a39cff854e - 1d4e414f68ed2a2720dc8537c1456faeb53e30c6d3f0244bc10e37a39cff854e
/opt/CAPEv2/storage/analyses/12390/files/52c59d4d5b0acb0cd6c7fd601dc263ef905847bcffdb0327b0c5bf0d9ea947c1 - 52c59d4d5b0acb0cd6c7fd601dc263ef905847bcffdb0327b0c5bf0d9ea947c1
/opt/CAPEv2/storage/analyses/12390/files/93a41055c9aa3168216926f2e1ceaa789db44941813403ed021567d53f100bdc - 93a41055c9aa3168216926f2e1ceaa789db44941813403ed021567d53f100bdc
/opt/CAPEv2/storage/analyses/12390/files/30da156c09f2025d1c4104806af430ac346e3ae7c717452461281bd442e8ed9c - 30da156c09f2025d1c4104806af430ac346e3ae7c717452461281bd442e8ed9c

Embedded URLs

http://creativecommons.org/publicdomain/zero/1.0/
http://www.adobe.com/go/reader_system_reqs_it.UnmoveFilesRimozione
http://www.adobe.com/go/reader_system_reqs_it
https://www.digicert.com/CPS0
http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
http://www.digicert.com/ssl-cps-repository.htm0
https://d.symcb.com/rpa0
http://s.symcb.com/universal-root.crl0
https://d.symcb.com/rpa0@
http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
http://mozilla.org/MPL/2.0/
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786520596&P2=404&P3=2&P4=gaF%2bYGfGixmNshQymCWEJmbepnmZfCDqwU%2bteNqwhyu3QVrQ36RGtnpTblmAGfjqDSAynHeZRsTBLn1hgZjwYw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786520676&P2=404&P3=2&P4=E%2by21sZAwxPH%2bqrzOd7N4rBMPqIcTDHFZq%2bWlcD1%2bPhLFJjcRRjjwbDZPxwwmo%2fAdkAReJ3%2fLwIrG146KS4HsQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

creativecommons.org
geocities.com
www.adobe.com
helpx.adobe.com
www.microsoft.com
crl3.digicert.com
crl4.digicert.com
www.digicert.com
cacerts.digicert.com
d.symcb.com
s.symcb.com
ts-crl.ws.symantec.com
ts-aia.ws.symantec.com
mozilla.org

Embedded IP addresses

52.230.59.222
52.168.117.170
52.123.252.204
20.42.179.204
4.230.171.124
85.210.193.152
74.178.76.128
74.178.76.54
51.105.71.136
4.150.223.102
172.178.240.163
135.232.92.34
203.26.79.13
52.123.252.229
72.154.7.108
4.150.223.96
52.148.114.188
52.110.12.56
52.110.12.1

More Sivis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report