MALICIOUS — 5f1881a98712a536b3b9348ec351567cd2f01b7d8f7d55c4e9cf166a37e8b15a

MALICIOUS — 5f1881a98712a536b3b9348ec351567cd2f01b7d8f7d55c4e9cf166a37e8b15a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Maldoc family. 5 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 5f1881a98712a536b3b9348ec351567cd2f01b7d8f7d55c4e9cf166a37e8b15a
SHA-1: 8eebdcd3b7fb72b619bcd2aadd3394f4e8ae6357
MD5: ad7bb35b87745e96a1b2c6e52ed016ea
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 3072:SKguF1AQW/Ng3b5t8pnrM3ehD/pXKtcoFoLRqR:71AHokrmwD3q
TLSH: T11A3FBFCA35EBB762DB72DD06A819B75E8DC051914F792E5903D2823A2C20F1B5C33267
Submitted as: 5f1881a98712a536b3b9348ec351567cd2f01b7d8f7d55c4e9cf166a37e8b15a
File type: pe · Size: 151561 bytes
Verdict: malicious (99/100) · Family: Maldoc

Detections (5 of 56 engines)

capa (capabilities): capability:execution/powershell
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
Microsoft Defender: Trojan:Win32/Shaosmine!pz
Emsisoft (Emergency Kit): Gen:Variant.Msilheracles.206790
Kaspersky (KVRT): HEUR:Trojan.MSIL.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 13 weighted signals:

YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.70, confidence 0.70
Microsoft Defender flagged Trojan:Win32/Shaosmine!pz (rule Trojan:Win32/Shaosmine!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Msilheracles.206790 (rule Gen:Variant.Msilheracles.206790) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.MSIL.Agent.gen (rule HEUR:Trojan.MSIL.Agent.gen) - engine signal, weight 0.55, confidence 0.85
2 IDS alert(s): ThreatLens Pastebin exfil/stager lookup - network signal, weight 0.50, confidence 0.80
2 behavioral detection(s) across 2 rule(s): Boot/Logon autostart via Startup folder [medium] (rule tl-bootconf-persistence) - dynamic signal, weight 0.43, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 1 external host(s) and 23 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

123828 behavior events · 1 ATT&CK techniques · 27 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000024.db - 272d60922eccdd3b8371b6080cbb51be2a860d1bd7f9d3f1a8e2b86d9db7b4ad
C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000023.db - 23d4667b35f5744de87c061a7b5804c69d525b6aed2efccd14c47f06fd92bc96
C:\Users\analyst\AppData\Local\Temp\order_ضm.vbs - 9f832ddbf27ca459a4ec31b60c0ecdce963321162f4679252ef7a26e6ad89eba
C:\Users\analyst\AppData\Local\Temp\order_duCч.vbs - cf26175c91c3138055c58d21b29afae3300767f862a8d522970496b3139569d5
C:\Users\analyst\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Pre-Setting 381WHbKSV.lnk - 51dea1db3eeb9a14510a05f48a5a682f1dee0238e977c3dceae6854899d88d50
C:\Windows Configration\sign231.txt - 682059b74246cb2020538c067cf0bbb4529749236e8333640da90b2e5b6abd2e
C:\Users\analyst\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms - df3f00962e2442d30d3435db2e29b2e94be9b30171b0c2bcd2af17a5e955526b
C:\Users\analyst\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms - 2d0577e65e61866ba53da9f5caa4a377130d925a04adefa00059a16a45bd5117
c:\windows configration\bug\dwn_znl.exe - ab24034b6654cd897a921f637a34a08616d8317a8e21899ec95e95c65933af96
C:\Users\analyst\AppData\Local\Temp\order_دئ.vbs - 029fe5a110ab728c92a2690d38371fe5a588bf688e84c4a8c4da8ad72bd719c5
C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\cversions.3.db - 9813cd88b46107c4dc38d1a8786afe1f1ce06795774f2b72ce7647b444134b63
C:\Users\analyst\AppData\Local\Temp\order_HSن.vbs - 969b2ddde41bda031ff847f93ae9aadd6b58bdf02114637ab5678f8c3ce27ccf
C:\Users\analyst\AppData\Local\Temp\order_цKGعн.vbs - fcd6bee8f45ef4115ad7387d178a96a7c3543285dd1e556a1fb704dc306793cb
C:\Users\analyst\AppData\Local\Temp\order_ьCn.vbs - cf5a3fbe3e40ec35631c8c87e5ec02437a34a9bf70965682e2dab207927c68e3
C:\Users\analyst\AppData\Local\Temp\order_хс.vbs - 8788395b8183296d77a49c9bc84db060e8ccfbbb5c5217d50f350a5dcbb11818

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://pastebin.com/download.php?i=DDD0rAXN

Embedded domains

www.google.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
pastebin.com

Embedded IP addresses

4.150.223.97
4.230.171.124
85.210.193.152
52.230.59.222
172.215.188.225
20.184.175.7
172.64.154.167
40.84.97.4
20.165.94.54
74.179.77.204
13.69.116.107
172.184.231.67
40.84.85.40
85.210.196.11
20.42.179.204
52.168.112.67
48.211.4.16
20.42.179.192
57.155.104.224
104.208.16.94
51.132.193.105
52.148.114.188
104.20.29.150
135.233.45.223
72.153.5.137

More Maldoc samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report