MALICIOUS — 4b01b3407c94779490c56b4302404bc0802ff10889cf8cac6b7c4c010a489e70

MALICIOUS — 4b01b3407c94779490c56b4302404bc0802ff10889cf8cac6b7c4c010a489e70 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Fileinfector family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 4b01b3407c94779490c56b4302404bc0802ff10889cf8cac6b7c4c010a489e70
• SHA-1: a713036f3e60b15f5a7a481621a8afa32ce84f5c
• MD5: 3fa3fb48499e2e2e8aff8e1c653af1b3
• imphash: d41d8cd98f00b204e9800998ecf8427e
• ssdeep: 6144:0vFbZvu5ZlvFbZvpvu5ZlvFbZvu5ZS5Zlvpvu5ZlvFb6:0xZ0xZh0xZjh0x6
• TLSH: T1414B08D532547B10EDF5F8149D049C2C7193A9A662362BD8A002D43F74F9EF709B88AE
• Submitted as: 4b01b3407c94779490c56b4302404bc0802ff10889cf8cac6b7c4c010a489e70
• File type: pe · Size: 513535 bytes
• Verdict: malicious (99/100) · Family: Fileinfector

Detections (5 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): Win.Dropper.Fileinfector-9832222-0
• Microsoft Defender: Trojan:Win32/CryptInject!pz
• Emsisoft (Emergency Kit): Trojan.GenericKD.39862403
• Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

• T1547.001
• T1112

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

• ClamAV (daily) flagged Win.Dropper.Fileinfector-9832222-0 (rule Win.Dropper.Fileinfector-9832222-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/CryptInject!pz (rule Trojan:Win32/CryptInject!pz) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.GenericKD.39862403 (rule Trojan.GenericKD.39862403) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Virus.Win32.Lamer.ks (rule Virus.Win32.Lamer.ks) - engine signal, weight 0.55, confidence 0.85
• Contacted 28 external host(s) and 12 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: http://www.pinkworld.com, http://www.youporn.com, http://www.redtube.com - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

5506 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• ecs.office.com
• desktop-hsgcbep
• update.googleapis.com
• self.events.data.microsoft.com
• 251.0.0.224.in-addr.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 1.0.240.10.in-addr.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• watson.events.data.microsoft.com
• 244.160.234.135.in-addr.arpa

Embedded URLs

• http://www.pinkworld.com
• http://www.youporn.com
• http://www.redtube.com
• http://www.assparade.com/
• http://www.freeav.com/
• http://www.antispyware.com/
• http://www.antivirus.com/
• http://www.microsoft.com/pki/certs/CSPCA.crt0
• http://www.microsoft.com/pki/certs/tspca.crt0
• http://www.microsoft.com/DirectX0
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• www.pinkworld.com
• www.youporn.com
• www.redtube.com
• www.assparade.com
• www.freeav.com
• www.antispyware.com
• www.antivirus.com
• crl.microsoft.com
• www.microsoft.com
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 52.123.128.14
• 4.150.223.99
• 4.150.223.114
• 57.154.63.210
• 135.234.160.244
• 203.26.79.13
• 135.234.160.246
• 72.145.35.111
• 172.178.240.161
• 52.148.114.188
• 85.210.193.152
• 172.172.255.217
• 52.123.252.230
• 20.184.175.5
• 72.145.35.96
• 172.178.240.163
• 20.184.175.13
• 52.110.12.15
• 52.123.252.220
• 57.155.101.212
• 74.178.76.44
• 20.184.175.14
• 72.145.35.97
• 4.150.223.109
• 52.123.252.234

File paths

• C:\Program

More Fileinfector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report