MALICIOUS — 4f8c32f6339cb3995cc3253fbf38f3a62aca96339e40cab74ee2a01a66207727

MALICIOUS — 4f8c32f6339cb3995cc3253fbf38f3a62aca96339e40cab74ee2a01a66207727 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the HUILoader family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 4f8c32f6339cb3995cc3253fbf38f3a62aca96339e40cab74ee2a01a66207727
SHA-1: 8501e6be594a9a6ccfe890fb8f42d10ab1a86dc4
MD5: 3bc3420828ba751efff644baa4562768
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 24576:9+Z3l/v2yrXeWEzpd1bcDqX0iFhShPcMqJb2BRVtsw:M3HvDqXjIdqwN
TLSH: T1215E909DCEA73B00C3E52A34E81F161CE27D1D5265E8B9079ECB50EB95EE523092C05B
Submitted as: 4f8c32f6339cb3995cc3253fbf38f3a62aca96339e40cab74ee2a01a66207727
File type: pe · Size: 2920448 bytes
Verdict: malicious (98/100) · Family: HUILoader

Detections (4 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Generic-9907165-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9907165-0 (rule Win.Trojan.Generic-9907165-0) - engine signal, weight 0.90, confidence 0.95
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.eyuyan.com - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

48 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com/0
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.eyuyan.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com
www.eyuyan.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.107
52.123.252.220
4.230.171.124
40.84.85.40
135.232.92.97
20.247.185.124
135.233.95.144
4.150.223.99
57.154.63.210
52.168.117.169
20.42.73.24
72.145.35.105
52.148.114.188
52.110.12.31
52.110.12.28

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report