MALICIOUS — 5a9c39cd93110b2e3c1b5a30d640c47c26a443fc2d3304d909f0064a04177218

MALICIOUS — 5a9c39cd93110b2e3c1b5a30d640c47c26a443fc2d3304d909f0064a04177218 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (86/100). 2 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 5a9c39cd93110b2e3c1b5a30d640c47c26a443fc2d3304d909f0064a04177218
SHA-1: 469794d1d7bd774896981c3bef098bdba68cff2b
MD5: 63fdb5e6e5bceabc3f790651bae61adb
imphash: f96aef664f912bce268a11b37eb882cb
ssdeep: 49152:Aa1rHBNbgTszhsLnbk6tsAz7MIQQOB3OuHb5ZuhZ0heCTgyCpas8:AaZbbhEk6tX3YQOmhmICUy7
TLSH: T1A45B9EA1D102AA01D6F0DDB978E40E4C60D7F4E529BA1C5C6A83E42E739BCCBD071676
Submitted as: 5a9c39cd93110b2e3c1b5a30d640c47c26a443fc2d3304d909f0064a04177218
File type: pe · Size: 2296320 bytes
Verdict: malicious (86/100)

Detections (2 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:__wibu00,__wibu01,__wibu02,__wibu03,__wibu07
Microsoft Defender: flagged

MITRE ATT&CK

Why this verdict

The malicious score of 86/100 is the fusion of 8 weighted signals:

Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Contacted 1 external host(s) and 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:__wibu00,__wibu01,__wibu02,__wibu03,__wibu07 (rule high-entropy-sections:__wibu00,__wibu01,__wibu02,__wibu03,__wibu07) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://www.wibu.com - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:__wibu00,__wibu01,__wibu02,__wibu03,__wibu07 - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

52 behavior events · 1 ATT&CK techniques · 0 dropped files.

Embedded URLs

https://www.wibu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788015978&P2=404&P3=2&P4=FR5CpnMlmvBJjJnvVZpHUERhm5OL5xgyt2odl747YenIggk7ZCxDVxCGJ8hXKBmm3%2bkSbmIECcwXu4LvKHjyVg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.wibu.com

Embedded IP addresses

20.42.65.91
20.247.184.197
4.230.171.124
20.165.94.54
20.42.179.192
20.184.175.20
135.232.92.137
52.123.252.230
20.165.94.46
203.26.79.13
4.247.188.233
135.234.160.244
72.153.5.134
52.110.12.48
52.110.12.8

File paths

B:\RunTimeBuild\master\wibu\dev\lib\Release\winX86V1420U\ixptestdll.pdb
B:\RunTimeBuild\master\wibu\dev\lib\Release\winX86V1420\axenginestat.pdb
X:\:`:d:h:l:p:t:x:
T:\:t:
L:\:`:p:t:x:
X:\:d:
S:\:e:n:
U:\:
T:\:d:l:t:
T:\:p:x:
L:\:l:t:
P:\:
T:\:d:l:

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report