MALICIOUS — 453e1d43c6c8df5a7b0ae0e75cb64d7ec62bd589a9dbff41a6ce01090a77848b

MALICIOUS — 453e1d43c6c8df5a7b0ae0e75cb64d7ec62bd589a9dbff41a6ce01090a77848b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Bulz family. 7 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 453e1d43c6c8df5a7b0ae0e75cb64d7ec62bd589a9dbff41a6ce01090a77848b
SHA-1: 294e4764b9086d6880c96221a4857200d03035d9
MD5: 985e350fced6317d639f9329e42c8f5a
imphash: 7732c84aec7391973c26fbc2c07a6022
ssdeep: 49152:NOJBMO+YrovpU/9bv9MRydB3I1HF+3j5D78OBUC/IabjKoh9WsY:LOg29uWCXCs1SIabjKoh9WsY
TLSH: T1B55D6BC8A61BEB01D1BAD75858200F5C303AF0D1767E285CDB43EAAD45E7C3798A0679
Submitted as: 453e1d43c6c8df5a7b0ae0e75cb64d7ec62bd589a9dbff41a6ce01090a77848b
File type: pe · Size: 2811995 bytes
Verdict: malicious (100/100) · Family: Bulz

Detections (7 of 55 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Bulz-9871427-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
YARA: Yara-Rules community: YR_AntiDebug_Checks
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Bulz-9871427-0 (rule Win.Malware.Bulz-9871427-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 18 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.symauth.com/cps0, http://www.symauth.com/rpa04, http://www.symauth.com/cps09 - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com/0
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://office.microsoft.com
http://crl.thawte.com/ThawteTimestampingCA.crl0
http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
http://crl.verisign.com/pca3.crl0
https://www.verisign.com/cps0
http://logo.verisign.com/vslogo.gif04
http://www.symauth.com/cps0
http://www.symauth.com/rpa04
http://crl.verisign.com/pca3-g5.crl0
http://www.symauth.com/cps09
http://evcs-crl.ws.symantec.com/evcs.crl0
http://evcs-aia.ws.symantec.com/evcs.cer0
http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787793051&P2=404&P3=2&P4=hzBAbJs1EXybjxhUTxvvNbTnn0pOQ8qfU0inrA6NLAiOyY19TBcXJwU6u5mWKl7xfB2JTHp5Mu1Ri54vihmkow%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com
crl.thawte.com
ts-aia.ws.symantec.com
ts-crl.ws.symantec.com
crl.verisign.com
www.verisign.com
logo.verisign.com
www.symauth.com
evcs-crl.ws.symantec.com
evcs-aia.ws.symantec.com
schemas.microsoft.com

Embedded IP addresses

11.0.07.79
4.150.223.96
20.42.179.204
4.230.171.124
52.230.60.54
135.233.95.144
135.232.92.97
52.123.252.195
20.42.65.94
20.236.44.162
52.123.128.14
40.99.134.2
203.26.79.13
135.234.160.245
72.154.7.105
20.165.94.46
52.148.114.188
52.110.12.50
52.110.12.51

Registry keys

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft
HKEY_CURRENT_USER\Software\Adobe\Adobe
HKEY_CURRENT_USER\Software\Adobe\Acrobat

File paths

d:\dbs\el\oc\target\x86\ship\postc2r\x-none\selfcert.pdb
V:\:b:h:n:t:z:
X:\:`:d:h:l:p:t:x:
P:\:d:
T:\:d:l:t:
X:\:@=D=H=L=P=T=X=\=`=d=h=l=p=t=x=
P:\:
C:\btvsts\3783\private\softgrid\shared\include\shared\file_utils.hpp
X:\:`:h:
L:\:h:p:

More Bulz samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report