MALICIOUS — 465caf85b705a5241f1b4d9f1d1aae4262d3b10ed0fce77be976ba7fed70d3d7

MALICIOUS — 465caf85b705a5241f1b4d9f1d1aae4262d3b10ed0fce77be976ba7fed70d3d7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the CryptInject family. 3 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 465caf85b705a5241f1b4d9f1d1aae4262d3b10ed0fce77be976ba7fed70d3d7
SHA-1: f1386b7f72f2e2b8abc45a8b3e20097cd0ea6111
MD5: ee4d38edaea84de6de96c2c75ecbe3da
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 3072:o58ppAsPqEsmwEsmc58ppAsPqEsmwEsmwEsmc58ppAsPA:UwAHZRZjwAHZRZRZjwA9
TLSH: T10545B7D8B22A270ADDF0EC64BD14EA2C74A254B1113F27591543D03B76BFAAB053CD68
Submitted as: 465caf85b705a5241f1b4d9f1d1aae4262d3b10ed0fce77be976ba7fed70d3d7
File type: pe · Size: 275579 bytes
Verdict: malicious (98/100) · Family: CryptInject

Detections (3 of 56 engines)

ClamAV (daily): Win.Trojan.Agent-448770
LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: Trojan:Win32/CryptInject!pz

MITRE ATT&CK

T1547.001

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-448770 (rule Win.Trojan.Agent-448770) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/CryptInject!pz (rule Trojan:Win32/CryptInject!pz) - engine signal, weight 0.55, confidence 0.85
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.pinkworld.com, http://www.youporn.com, http://www.redtube.com - static signal, weight 0.35, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

48 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.pinkworld.com
http://www.youporn.com
http://www.redtube.com
http://www.assparade.com/
http://www.freeav.com/
http://www.antispyware.com/
http://www.antivirus.com/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com
www.pinkworld.com
www.youporn.com
www.redtube.com
www.assparade.com
www.freeav.com
www.antispyware.com
www.antivirus.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.10
4.247.188.224
4.230.171.124
20.247.184.142
135.233.95.144
135.232.92.97
52.168.117.174
4.144.132.223
4.144.132.114
162.159.142.9
125.56.205.26
125.56.205.32
72.145.35.98
52.148.114.188
52.110.12.25
52.110.12.56

File paths

C:\Windows\system32\d3dx10_36.dll
C:\Program
C:\Progr

More CryptInject samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report