MALICIOUS — 4a95dff266f95dba6671f68e6ee872c1f6401835aa4e14a407bc8932584c3f3b
MALICIOUS — 4a95dff266f95dba6671f68e6ee872c1f6401835aa4e14a407bc8932584c3f3b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the SmJfXr4VEil family. 6 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
4a95dff266f95dba6671f68e6ee872c1f6401835aa4e14a407bc8932584c3f3b - SHA-1:
a4a8045767ad04b358f9ee5176315ee49ce528b8 - MD5:
f5da127bf2e93f728d9545c3eecef3cf - imphash:
6ed4f5f04d62b18d96b26d6db7c18840 - ssdeep:
6144:CnfIzsQMzvbtWIALVMwm0D78FsMZJxnojKxJuQQlpV4SV9z4vMrhSgEAss6cXeG2:6ALg3sszunpV4i9skFxEAsC1S - TLSH:
T19846B1235D4ABA70C72F3F253828E70FB6429A3FA1FD25221251171A761921FD3D162E - Submitted as: 4a95dff266f95dba6671f68e6ee872c1f6401835aa4e14a407bc8932584c3f3b
- File type: pe · Size: 302188 bytes
- Verdict: malicious (99/100) · Family: SmJfXr4VEil
Detections (6 of 56 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:TGOqOPny
- ClamAV (daily): Win.Trojan.Generic-9908423-0
- Detect It Easy (packer/type): DIE:UPX
- Microsoft Defender: TrojanDownloader:Win32/Unruy!pz
- Emsisoft (Emergency Kit): Gen:Trojan.Heur.smJfXr4VEil
- Kaspersky (KVRT): Trojan-Clicker.Win32.Cycler.amiv
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 10 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Generic-9908423-0 (rule
Win.Trojan.Generic-9908423-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged TrojanDownloader:Win32/Unruy!pz (rule
TrojanDownloader:Win32/Unruy!pz) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Trojan.Heur.smJfXr4VEil (rule
Gen:Trojan.Heur.smJfXr4VEil) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Trojan-Clicker.Win32.Cycler.amiv (rule
Trojan-Clicker.Win32.Cycler.amiv) - engine signal, weight 0.55, confidence 0.85 - Contacted 1 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Detect It Easy (packer/type) flagged DIE:UPX (rule
DIE:UPX) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:TGOqOPny (rule
high-entropy-sections:TGOqOPny) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: high-entropy-sections:TGOqOPny, UPX - static signal, weight 0.25, confidence 0.55
- Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 5916) (rule
windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
346 behavior events · 0 ATT&CK techniques · 6 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- desktop-hsgcbep
- login.live.com
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- officeclient.microsoft.com
- www.msn.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
- fe3cr.delivery.mp.microsoft.com
- www.bing.com
- v10.events.data.microsoft.com
- slscr.update.microsoft.com
Dropped files
- C:\program files (x86)\Adobe\acrotray .exe -
5a687f063f0d44e53e1b7f3db33905c99349e7f0ac00fc5996ea127ce8a9977c - C:\Users\analyst\AppData\Local\microsoft\OneDrive\onedrive.exe -
a5f133c393318960df2e7abca414de628e29f980be33f004add9f3cfaadbad6f - C:\program files (x86)\internet explorer\wmpscfgs.exe -
2747cdd035b5eb39cc9029e2b7f653560f7e5b00c0f85704cb7950181f6f5bde - C:\program files (x86)\Adobe\acrotray.exe -
f041dfe59bf277d661c341ef3f4d2496715ca63eb27776614fe5ce87c64c5089 - 7f416cf7ca37ea3f4c93e1c1957c68d22d0d843902e1029f46f42ff65511956f -
7f416cf7ca37ea3f4c93e1c1957c68d22d0d843902e1029f46f42ff65511956f - 70a3c7e47ea3c1e0fc25ad37e7ceb7c4584c9d9b0b1da59c14faacb92c64431e -
70a3c7e47ea3c1e0fc25ad37e7ceb7c4584c9d9b0b1da59c14faacb92c64431e
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788055576&P2=404&P3=2&P4=US5OPm3%2f1feYEenDwGNQOpcqful%2fXUJaP5KLap0eLtVG9%2fgVXoxe%2f%2bX9Y9CJCuJJ8aZ9P%2fjedaVs4B9SZs75%2fg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 20.42.65.89
- 52.123.252.197
- 4.230.171.124
- 40.84.85.40
- 135.232.92.97
- 20.42.65.88
- 74.178.76.128
- 20.247.184.142
- 135.233.95.144
- 20.247.184.197
- 92.223.78.30
- 135.232.92.34
- 135.233.45.221
- 203.26.79.13
- 72.154.7.106
- 52.110.12.44
- 52.110.12.18
More SmJfXr4VEil samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report