MALICIOUS — 4a3383d42836fa8e80351c2af5a2722c1131d69ce150b3862de2d15a153a7075
MALICIOUS — 4a3383d42836fa8e80351c2af5a2722c1131d69ce150b3862de2d15a153a7075 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100), attributed to the Blackie family. 5 of 52 detection engines flagged it.
Identification
- SHA-256:
4a3383d42836fa8e80351c2af5a2722c1131d69ce150b3862de2d15a153a7075 - SHA-1:
407bbf3cc7dc93ae69b5e409f573c1d6795da305 - MD5:
e0616019949a38e88765ea98e3a1ab56 - imphash:
4d8d0261016c5c05b880950a5b0e704a - ssdeep:
12288:RCACm/UbCzfday0rUjdVX86avEF8JMkKdF3Bz3W7shV7CjDEpUE9QDV9U11SR:RH8bCz1ay0rUPXVav9Mk2F3tm7s7xAR - TLSH:
T1F0546BCB8113BA81E5B29B518A209E5C5562F0BA317D0CCD5743C73E67BA8E791E304E - Submitted as: 4a3383d42836fa8e80351c2af5a2722c1131d69ce150b3862de2d15a153a7075
- File type: pe · Size: 1210292 bytes
- Verdict: malicious (95/100) · Family: Blackie
Detections (5 of 52 engines)
- ClamAV (daily): Win.Trojan.Blackie-9838328-0
- YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Microsoft Defender: Trojan:Win32/Wacatac.B!ml
Why this verdict
The malicious score of 95/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Blackie-9838328-0 (rule
Win.Trojan.Blackie-9838328-0) - engine signal, weight 0.90, confidence 0.95 - YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule
DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://www.symauth.com/cps0, http://www.symauth.com/rpa04, http://www.symauth.com/cps09 - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/CheckMachineStatusRequest
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/CheckMachineStatusResponse
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetEntitlementsForOlsIdentityRequest
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetEntitlementsForOlsIdentityResponse
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetEntitlementForMachineKeyRequest
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetEntitlementForMachineKeyResponse
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetKeyRequest
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetKeyResponse
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetLicenseRequest
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetLicenseResponse
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetOlsLicenseRequest
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetOlsLicenseResponse
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetSessionTokenRequest
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetSessionTokenResponse
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetTokenRequest
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetTokenResponse
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetWpkBindingRequest
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetWpkBindingResponse
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/ReportActivationRequest
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/IOlsClient/ReportActivationResponse
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/Api/ServerFault
- http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi
- http://schemas.microsoft.com/2003/10/Serialization/Arrays
- http://schemas.datacontract.org/2004/07/Microsoft.Office.LicensingService
Embedded domains
- schemas.microsoft.com
- schemas.datacontract.org
- crl.microsoft.com
- www.microsoft.com
- office.microsoft.com
- crl.thawte.com
- ts-aia.ws.symantec.com
- ts-crl.ws.symantec.com
- crl.verisign.com
- www.verisign.com
- logo.verisign.com
- www.symauth.com
- evcs-crl.ws.symantec.com
- evcs-aia.ws.symantec.com
- mozilla.org
- survey.mozilla.com
- en-us.www.mozilla.com
Embedded IP addresses
- 1.9.0.1
- 11.0.07.79
Registry keys
- HKEY_CURRENT_USER\Software\Adobe\Adobe
- HKEY_CURRENT_USER\Software\Adobe\Acrobat
File paths
- F:\Office\Target\x86\ship\postc2r\x-none\olicenseheartbeat.pdb
- R:\:{:
- X:\:h:l:x:
- X:\:@=D=H=L=P=T=X=\=`=d=h=l=p=t=x=
- P:\:
- X:\:`:d:h:l:p:t:x:
- F:\Office\Target\x86\ship\postc2r\x-none\iecontentservice.pdb
- D:\:`:
- T:\:t:x:
- P:\:d:
- C:\Program
More Blackie samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report