MALICIOUS — conficker

MALICIOUS — conficker is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Conficker family. 6 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 523d40c69b0972ddeff0682fcb569e8a346cf10b2894479ab227bbb24e19846e
• SHA-1: f00d3242a4761c55a532d642dd0631262d081af0
• MD5: 566119e4e5f4bda545b3b8af33c23698
• imphash: 1586c9eec7f489bf890fb881c50e6517
• ssdeep: 1536:oUUmZ6gSi9/wx9+krA3XYVBAV/qNDuVb16yMNk7oPwhkLhQ:o2gg8E53IHS2DsboyMNk7EwhihQ
• TLSH: T17C36027F98A0C7CCCAF355078B42322E5B958AC9C56DCA3239A6071A0033BB3D9DD945
• Submitted as: conficker
• File type: pe · Size: 63391 bytes
• Verdict: malicious (100/100) · Family: Conficker

Detections (6 of 51 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): {MD5}bin.worm.conficker.9353.UNOFFICIAL
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Detect It Easy (packer/type): DIE:UPX
• Microsoft Defender: Worm:Win32/Conficker.A
• Emsisoft (Emergency Kit): Worm.Conficker.3

MITRE ATT&CK

• T1543.003
• T1112

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

• ClamAV (daily) flagged {MD5}bin.worm.conficker.9353.UNOFFICIAL (rule {MD5}bin.worm.conficker.9353.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Memory forensics: 6 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7980) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Microsoft Defender flagged Worm:Win32/Conficker.A (rule Worm:Win32/Conficker.A) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Worm.Conficker.3 (rule Worm.Conficker.3) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

593 behavior events · 2 ATT&CK techniques · 2 dropped files.

Runtime network

• searchapp.bundleassets.example
• www.msftconnecttest.com
• getmyip.co.uk
• checkip.dyndns.org
• www.getmyip.org
• www.bing.com
• desktop-hsgcbep
• config.edge.skype.com
• dns.msftncsi.com
• settings-win.data.microsoft.com
• edge.microsoft.com
• watson.events.data.microsoft.com
• aps.prod.windows.com
• ecs.office.com
• g.live.com
• fs.microsoft.com
• self.events.data.microsoft.com
• www.msftncsi.com
• msedge.api.cdp.microsoft.com
• geo.prod.do.dsp.mp.microsoft.com

Dropped files

• 1606fc5a1f0f38554ac0b5f3113304009f8290ed3b4c9f07a6228fb60efe385a - 1606fc5a1f0f38554ac0b5f3113304009f8290ed3b4c9f07a6228fb60efe385a
• 6d8dcb592a377f284294fbac735243ac6ec013eb26be0e33d4bfa83cf4168fe7 - 6d8dcb592a377f284294fbac735243ac6ec013eb26be0e33d4bfa83cf4168fe7

Embedded URLs

• http://www.w3.org/TR/1999/REC-html401-19991224/strict.dtd
• http://www.w3.org/TR/html4/strict.dtd

Embedded domains

• www.w3.org
• getmyip.co.uk
• checkip.dyndns.org
• www.getmyip.org

More Conficker samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report