MALICIOUS — BKBLSYFKWLIYBUKT.PIF

MALICIOUS — BKBLSYFKWLIYBUKT.PIF is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 0 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 52f0c0230b580e2fdf53a378b5c6d0db9829af900dae43e0df8f18635cd9f0c1
SHA-1: b7b3dbcf32f3b7a78554efee75f0ad5746126c69
MD5: 7f47d5ea49f77b99e25ca2918cea8920
imphash: f09ca5b7fb5026a683c783d4a5ee3730
ssdeep: 12288:26DGsq60U/A62U1q6CkrlA1NIcjBM4rF3/W:26DGsqEVAWhoIcO4rF3/W
TLSH: T1DD4B6A60522B3130D5B6AD4BF41686DEA013F178BA70160F910BA91D16DC2EFE7F9CA1
Submitted as: BKBLSYFKWLIYBUKT.PIF
File type: pe · Size: 478811 bytes
Verdict: malicious (78/100)

Detections (0 of 55 engines)

No engine flagged this sample.

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

Memory forensics: 6 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 8436) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Contacted 25 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://luajit.org/ - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

45 behavior events · 1 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://luajit.org/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787586696&P2=404&P3=2&P4=JZmMJSymInViHv7woOOrijxHsihUjSdkoEpGTp%2fQFiTnOiBTFeQheehuO9DHvlo9lRL%2b6OIPpjh%2bRwK1v0Uulw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787586742&P2=404&P3=2&P4=fCfhrZEHINaELDW7fbrBXaTUS7cvzGRsNaeYhV95GNzXnW73xMGIrb5k8FIKG%2fNFKNy317trv%2by6BK5B9hY3Ag%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1786983417&P2=404&P3=2&P4=XGK2rrXkHbi1G52RXiavNIZLtHJ5kjH9YWOfFi3QYzASFDkwVhw4RCXiB%2bhqmEG5fgdGYDOE53KxejcJaTLp1w%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1786983071&P2=404&P3=2&P4=fz4KA%2fj0cN0mnEvmGLTzuiit%2f4Shj27wReDsH%2bZU3iJYVIxs3tSnW2BG4bUtuxDF9aRu4Wa1MZc582kuVwd4Lg%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

luajit.org

Embedded IP addresses

20.42.73.31
52.123.252.236
20.247.184.197
4.230.171.124
57.155.104.224
74.179.77.204
74.179.77.164
52.123.252.232
74.179.71.159
74.178.240.61
20.42.73.27
203.26.79.13
20.112.250.133
52.123.129.14
40.99.133.226
135.234.160.247
52.148.114.188
20.42.179.204
20.184.175.8
72.145.35.100
135.233.45.221
20.42.73.26
48.200.63.27
52.110.12.10
52.110.12.14

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report