MALICIOUS — 63f393fd53a25240632f841a92db8e849bd9caa854434cd3b4dd618fe090b364
MALICIOUS — 63f393fd53a25240632f841a92db8e849bd9caa854434cd3b4dd618fe090b364 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 3 of 56 detection engines flagged it.
Identification
- SHA-256:
63f393fd53a25240632f841a92db8e849bd9caa854434cd3b4dd618fe090b364 - SHA-1:
24114ae8c06aa11355b9efc28727f31af38bd5cf - MD5:
2654e12094636ed60ea603aaf897aed6 - imphash:
d41d8cd98f00b204e9800998ecf8427e - ssdeep:
3072:waIkaI2zPkZk+3hpicdqwXFU+bOWYs38HQxcn54EJyVrzK1Edk5aS4k:vI7IGEnprZkRs38t54c6rzNdfk - TLSH:
T1743E0269846DA742DC945BE4F28D1E2C406FEC87B08A5C83D31E8075D5A62B742F9CB3 - Submitted as: 63f393fd53a25240632f841a92db8e849bd9caa854434cd3b4dd618fe090b364
- File type: pe · Size: 146432 bytes
- Verdict: malicious (93/100)
Detections (3 of 56 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Generickdz-9954155-0
- Detect It Easy (packer/type): DIE:Microsoft Linker
Why this verdict
The malicious score of 93/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Win.Malware.Generickdz-9954155-0 (rule
Win.Malware.Generickdz-9954155-0) - engine signal, weight 0.90, confidence 0.95 - Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule
DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule
UPX) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- windows.msn.com
- www.msn.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- www.msftconnecttest.com/connecttest.txt
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded IP addresses
- 4.150.223.103
- 4.144.132.114
- 52.123.252.204
- 4.230.171.124
- 52.110.12.49
File paths
- C:\\go
- D:\\u
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report