MALICIOUS — 526dee46f6bbcc7a7f84267ea7a2e0f9451cf16fcf811d4787695ee6434e9043

MALICIOUS — 526dee46f6bbcc7a7f84267ea7a2e0f9451cf16fcf811d4787695ee6434e9043 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Pidgeon family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 526dee46f6bbcc7a7f84267ea7a2e0f9451cf16fcf811d4787695ee6434e9043
SHA-1: 8533d61ed53445eb1d2bddf145da3d6241c11cb9
MD5: 5fffc62d8f0b303063aef581b180d3fa
imphash: c4ad2f31e55f8a05bd3f3ff6efb7f6fa
ssdeep: 3072:A58lnlHdiLsxAJfOR+puV1MMwvXb2AESSWxfIT8CAt5CtZdRze8jEJl:A5AlHdksxx0KgD2LSSWxfcAtUtZzzO
TLSH: T1CF416B8C5612B602D232C3546D308E8C94B1F895327D7A5D2B13A12F52F7637BA790BA
Submitted as: 526dee46f6bbcc7a7f84267ea7a2e0f9451cf16fcf811d4787695ee6434e9043
File type: pe · Size: 192512 bytes
Verdict: malicious (98/100) · Family: Pidgeon

Detections (4 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Packed.Pidgeon-9909600-0
YARA: Yara-Rules community: YR_AntiDebug_Checks
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

T1056.001

Why this verdict

The malicious score of 98/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Packed.Pidgeon-9909600-0 (rule Win.Packed.Pidgeon-9909600-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 21 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787825757&P2=404&P3=2&P4=b7soRUkk%2foHqwYVxFzgkahv%2fth00DMcg4EUPIdIFbdBMuTpAM%2bmKo0WomXB9jCs7R5GUV0OBKbO6QMRkjFidKg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com

Embedded IP addresses

172.215.188.232
51.132.193.104
4.144.132.114
4.230.171.124
20.42.179.192
135.233.95.144
74.178.240.51
13.69.109.130
20.231.239.246
172.66.2.5
40.99.133.226
40.103.64.226
40.99.133.210
52.123.129.14
172.178.240.162
203.26.79.13
72.154.7.97
74.179.71.159
52.148.114.188
52.110.12.45
52.110.12.14

File paths

F:\Office\Target\x86\ship\postc2r\x-none\msosrec.pdb

More Pidgeon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report