MALICIOUS — BrowserDownloadsView.exe
MALICIOUS — BrowserDownloadsView.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100), attributed to the HUILoader family. 2 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
632e7f78f684e8f76f36849787901dc86b337d820acbc5947310c8c3d178c3c1 - SHA-1:
5502a32af43ed5210a6206563d5d817407574b25 - MD5:
f921a63ef5d30bc71908b0f859235e2b - imphash:
68862b70272610922aab0ff1b36b56c2 - ssdeep:
12288:nuKlZwUMT183pP0teMkqVo6DLfLXI0ZXiPj8:uK/PMyZP0jfVR3fLXvZiPj8 - TLSH:
T1064B8D684607BA32F1F6D5545C50C9ED8062F16C90759EC8DA07DDAE90EC233EDF22A8 - Submitted as: BrowserDownloadsView.exe
- File type: pe · Size: 482168 bytes
- Verdict: malicious (78/100) · Family: HUILoader
Detections (2 of 56 engines)
- capa (capabilities): capability:collection/keylog
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
MITRE ATT&CK
Why this verdict
The malicious score of 78/100 is the fusion of 5 weighted signals:
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - capa (capabilities) flagged capability:collection/keylog (rule
capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://www.nirsoft.net/ - static signal, weight 0.35, confidence 0.60
- enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
- https://sectigo.com/CPS0C
- http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v
- https://sectigo.com/CPS0D
- https://www.nirsoft.net/
Embedded domains
- schemas.microsoft.com
- sectigo.com
- crl.sectigo.com
- crt.sectigo.com
- crl.usertrust.com
- crt.usertrust.com
- www.nirsoft.net
- www.virustotal.com
File paths
- c:\Projects\VS2005\BrowserDownloadsView\x64\Release\BrowserDownloadsView.pdb
- c:\users)GLoad
- c:\users\admin)#Load
More HUILoader samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report