MALICIOUS — 564091cd13d987ac3cf81317fe8d5b0da6648ce0fcf060a21d4e9997abce7f50

MALICIOUS — 564091cd13d987ac3cf81317fe8d5b0da6648ce0fcf060a21d4e9997abce7f50 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Ipamor family. 4 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 564091cd13d987ac3cf81317fe8d5b0da6648ce0fcf060a21d4e9997abce7f50
SHA-1: 2e17364156ab7d19ab8b9bf97d26b6e17357e342
MD5: 2e64f10dcaaa44c1c61231f391a76cae
imphash: 7732c84aec7391973c26fbc2c07a6022
ssdeep: 3072:W8nD9UR9whwtvTRMBP3npj4+gLS84UoV37Egvt:W8RUNKBP3npj4/0hvt
TLSH: T1153B299D935F6344C236D5392F1086DC086974F8627E76892E02C33B64A6C37EC7A1E9
Submitted as: 564091cd13d987ac3cf81317fe8d5b0da6648ce0fcf060a21d4e9997abce7f50
File type: pe · Size: 110592 bytes
Verdict: malicious (98/100) · Family: Ipamor

Detections (4 of 55 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Malware.Ipamor-9935088-0
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Ipamor-9935088-0 (rule Win.Malware.Ipamor-9935088-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Contacted 21 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.30, confidence 0.70
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com/0
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787945481&P2=404&P3=2&P4=dnT2CYgWbp2fL4MfBWKF6a8kYaUJwPR4B9ZnDVpv64g%2bdqMpRzd68XWTd40srxFko50yj0TfDZk9vfCR7P2RGw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com

Embedded IP addresses

4.150.223.103
52.123.252.226
172.215.188.225
4.230.171.124
20.247.184.197
40.84.85.40
135.232.92.137
74.179.77.164
40.79.141.154
20.231.239.246
40.103.64.242
40.99.133.210
40.103.64.226
52.123.129.14
52.123.128.14
135.234.160.245
203.26.79.13
72.153.5.141
135.232.92.34
52.148.114.188
52.110.12.1

Registry keys

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft

More Ipamor samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report