MALICIOUS — 63cd8db640f701949b78fa766ca66aa32e3480b13e4ce1abd85faddb47056e2b

MALICIOUS — 63cd8db640f701949b78fa766ca66aa32e3480b13e4ce1abd85faddb47056e2b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sivis family. 9 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: 63cd8db640f701949b78fa766ca66aa32e3480b13e4ce1abd85faddb47056e2b
• SHA-1: 5939f21db9074360eb12abf5950ee2390ac653b0
• MD5: 16bcd5a565117d924bfe0c89b39f791a
• imphash: b10d16eedb1085ef7262dfc4ab03be6f
• ssdeep: 49152:+EFMFnlVKcmDH0tDh+Qn/Jf4MgVrVjnTKAd+WvwROFCD0u0i/l2jtb3mu+ciFbwQ:0nCUtD/yVPKApb8J+hJQwE
• TLSH: T18B659D8A9A2BB15FE1B7D884A81955FC9451F0FCA471A38CA703CC694097D37F9F006A
• Submitted as: 63cd8db640f701949b78fa766ca66aa32e3480b13e4ce1abd85faddb47056e2b
• File type: pe · Size: 5746889 bytes
• Verdict: malicious (100/100) · Family: Sivis

Detections (9 of 56 engines)

• capa (capabilities): capability:collection/keylog
• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): Win.Dropper.Ausiv-9875523-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Detect It Easy (packer/type): DIE:UPX
• Microsoft Defender: Virus:Win32/Sivis.A
• Emsisoft (Emergency Kit): Win32.Sivis.A
• Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

• T1071.001
• T1056.001
• T1105

Why this verdict

The malicious score of 100/100 is the fusion of 17 weighted signals:

• ClamAV (daily) flagged Win.Dropper.Ausiv-9875523-0 (rule Win.Dropper.Ausiv-9875523-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Virus:Win32/Sivis.A (rule Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Virus.Win32.Agent.es (rule Virus.Win32.Agent.es) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
• capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
• MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://www.gnu.org/licenses/, http://xml.org/sax/features/namespaces, http://xml.org/sax/features/namespace-prefixes - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
• Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

11429 behavior events · 0 ATT&CK techniques · 98 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• ctldl.windowsupdate.com
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• officeclient.microsoft.com
• www.msn.com
• odc.officeapps.live.com
• settings-win.data.microsoft.com
• assets.msn.com

Dropped files

• C:\Program Files\7-Zip\Lang\id.txt - fd3cdda37188d4214a135711b5ed229fc0ad9415d5b5f6742e2db77c852a2e09
• C:\Program Files\7-Zip\Lang\ka.txt - 985ce99cce14dbc9466dc390a6a8fdd398a27e509b98c738fa1419746f8873cf
• C:\$WinREAgent\Backup\SrSettings.ini - 4e38fefa44e538c634cfc6d8dcb72c9bcae86f37285fd5f068fa5df3697497d7
• C:\Program Files\7-Zip\7z.sfx - 4d0c766d254f4caf9587a105ca7e9ab236fc8e48c567a8af1e6423884d139a43
• C:\$WinREAgent\Rollback.xml - 5bd61201e66f4e5249411dcc101852f99643251754a5679dc93c8e20c3e69d5f
• C:\Program Files\7-Zip\Lang\ku-ckb.txt - 26a1284a2089daa7c0aeea8b7382f83c20d9d60a24c047809190ed19faf6ac25
• e795be8b70a6022ca4fdc75994830b32b03690de06943b758390e5739f66df03 - e795be8b70a6022ca4fdc75994830b32b03690de06943b758390e5739f66df03
• C:\Program Files\7-Zip\Lang\pl.txt - 49ea0edcaccb74e9b6c24ff69e0968d97b20584780eeff342d690177c91634a6
• C:\Program Files\7-Zip\Lang\az.txt - 4a66764bf636a3e3cb19ddb9ba612abc86b5b438cadc00a5984cf304dcd03758
• C:\Program Files\7-Zip\Lang\et.txt - 4e0f1cde9be605444ba4947eb7c4ea3adf56ca627da320b68fbc45fced7f546e
• C:\Program Files\7-Zip\Lang\pt.txt - 4114cb284249a6b8d4bcf41b25522bbc944b76e8164d640d85683285fdfc5787
• C:\Program Files\7-Zip\Lang\it.txt - f1e4188f51c19043b8bbb4fa5d4ae52f87b9a06d0d22353bc3600ce885cba5d5
• C:\Program Files\7-Zip\Lang\mn.txt - d1f79482f6adaca23cba98201b5fdd282f6f66d6a8b81c81ec63da17bc8c088d
• C:\Program Files\7-Zip\Lang\el.txt - 6262328ba66a11d9aecc5527163d65b56915beee2e1b95696b6c3d5952568363
• C:\Program Files\7-Zip\Lang\eo.txt - f6b3e261ced00e247532282ecca0d926702d2e32dd725b5dada1a374c2f1db56

Embedded URLs

• https://www.digicert.com/CPS0
• http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
• http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
• http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
• http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
• http://www.digicert.com/ssl-cps-repository.htm0
• http://www.digicert.com/CPS0
• http://crl3.digicert.com/sha2-assured-ts.crl02
• http://crl4.digicert.com/sha2-assured-ts.crl0
• http://crl.verisign.com/tss-ca.crl0
• http://www.microsoft.com/sql0
• http://ardownload.adobe.com/pub/adobe/reader/win/8.x/8.0/misc/WindowsInstaller-KB893803-v2-x86.exe
• http://www.gnu.org/licenses/
• http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
• http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
• http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
• http://office.microsoft.com
• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
• http://office.microsoft.com/0
• http://schemas.microsoft.com/win/2004/08/events
• http://manifests.microsoft.com/win/2004/08/windows/events
• http://www.w3.org/2001/XMLSchema
• http://schemas.microsoft.com/appv/2010/manifest
• http://xml.org/sax/features/namespaces

Embedded domains

• ardownload.adobe.com
• www.adobe.com
• crl3.digicert.com
• crl4.digicert.com
• www.digicert.com
• cacerts.digicert.com
• crl.verisign.com
• crl.microsoft.com
• www.microsoft.com
• cwru.edu
• gnu.org
• www.gnu.org
• ftp.microsoft.com
• office.microsoft.com
• schemas.microsoft.com
• manifests.microsoft.com
• www.w3.org
• xml.org
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 5.1.131.0
• 52.168.117.170
• 20.42.179.192
• 4.230.171.124
• 74.178.76.54
• 74.179.77.204
• 20.42.73.25
• 104.18.33.89
• 20.247.185.124
• 52.110.12.42
• 52.110.12.1
• 40.84.97.4
• 135.234.160.246
• 92.223.78.30
• 52.148.114.188
• 125.56.205.65
• 52.110.12.20
• 52.110.12.19
• 125.56.205.123

Registry keys

• HKEY_USERS\*_Classes
• HKEY_USERS\*\Software\Classes
• HKEY_CURRENT_USER\Software\Classes
• HKCU\Software\Classes

File paths

• L:\plato\po\olapuir\objc_retail\i386\olapuir.pdb
• D:\_Bld\10657\7994\Sources\bin\x86\Release\Product\Binaries\Client\bin\Microsoft.Mashup.OleDbInterop.pdb
• X:\:`:h:
• C:\btvsts\3621\private\softgrid\shared\include\shared\file_utils.hpp
• C:\btvsts\3621\private\softgrid\shared\include\shared\env_utils.hpp
• C:\btvsts\3621\private\softgrid\shared\include\integration_subsystem_data.h
• c:\btvsts\3621\private\softgrid\client\integration\subsystem_tokenizer_collection_factory.h
• C:\btvsts\3621\private\softgrid\client\integration\PublishingCommands.h
• C:\btvsts\3621\private\softgrid\client\integration\isv_client_session.h
• C:\btvsts\3621\private\softgrid\client\integration\TransactionFactory.h
• C:\btvsts\3621\private\softgrid\client\integration\TransactionClasses.h
• C:\btvsts\3621\private\softgrid\client\integration\ActivityTransactionMap.h
• c:\btvsts\3621\private\softgrid\shared\include\SwRpcClient.h
• C:\btvsts\3621\private\softgrid\subsystems\include\integration_rpc_task.hpp
• c:\btvsts\3621\private\softgrid\subsystems\include\integration_rpc_client.hpp
• C:\btvsts\3621\private\softgrid\client\integration\notifier_process.hpp
• c:\btvsts\3621\private\softgrid\shared\clientconfiguration\ValueName.h
• c:\btvsts\3621\private\softgrid\shared\clientconfiguration\RegistryValue.h
• C:\btvsts\3621\private\softgrid\subsystems\shortcuts\unregister_command.hpp
• C:\btvsts\3621\private\softgrid\subsystems\shortcuts\register_command.hpp
• C:\btvsts\3621\private\softgrid\subsystems\include\exclusion_data.h
• C:\btvsts\3621\private\softgrid\shared\include\XMLUtils.h
• c:\btvsts\3621\private\softgrid\subsystems\fta\xml_interface.hpp
• d:\dbs\el\oc\target\x64\ship\click2run\x-none\OfficeC2RCom.pdb
• C:\pkg-store

More Sivis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report