MALICIOUS — 6ca49994730c58ad2e8fcbf9b2e4f3ca97c02d778c85561a77e9b454ef4ae344

MALICIOUS — 6ca49994730c58ad2e8fcbf9b2e4f3ca97c02d778c85561a77e9b454ef4ae344 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100). 5 of 55 detection engines flagged it.

Identification

SHA-256: 6ca49994730c58ad2e8fcbf9b2e4f3ca97c02d778c85561a77e9b454ef4ae344
SHA-1: e08c79cbb469461e9071011bed2e043f37075649
MD5: 63acedc9f2c2de1442c33370a4edbc0d
imphash: 1453e4cc355841ff97c2c6f1a86c9c06
ssdeep: 3072:DeA6oDpspACO1Q0U35rhTJftm49MMg7/WnxWVh/yxlv1p8F:DeZoUnO1u3hhTJJSVaxlv1p8
TLSH: T1EB418F6F309389BFC30A27847FD018CC13A217DA21975CA6E049D2D9D9A53FBAE90475
Submitted as: 6ca49994730c58ad2e8fcbf9b2e4f3ca97c02d778c85561a77e9b454ef4ae344
File type: pe · Size: 192705 bytes
Verdict: malicious (97/100)

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Malware.Generickdz-10004857-0
Microsoft Defender: Trojan:Win32/Fareit!pz
Emsisoft (Emergency Kit): Gen:Variant.Worm.VB.112
Kaspersky (KVRT): Trojan.Win32.VB.dosp

Why this verdict

The malicious score of 97/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Malware.Generickdz-10004857-0 (rule Win.Malware.Generickdz-10004857-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Contacted 19 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://www.iec.ch - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/photoshop/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
http://ns.adobe.com/xap/1.0/sType/ResourceRef#
http://www.iec.ch
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787797544&P2=404&P3=2&P4=PZvPD%2f%2bLpAVvnMBa%2ftU%2bOWcLuQQwDisHsi6AbUEyHgJIreIreDhYjBnTtht2KSPv7HR7cygBEbg5hxV1E%2fHbzw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787797571&P2=404&P3=2&P4=Ir9JyF9Ir7DUe2D%2fao6tPwHGnxznbypioK6xvwRxdV0ECdhl6NPKrJ2N5WveK%2f%2fJj24X7ig%2fe3t7LXr7XpSRdQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ns.adobe.com
www.w3.org
url.org
www.iec.ch

Embedded IP addresses

20.184.175.4
4.247.188.233
4.230.171.124
20.247.184.197
74.178.76.128
74.179.71.159
4.150.223.97
74.178.240.51
20.165.94.63
203.26.79.13
20.236.44.162
52.123.128.14
172.178.240.161
52.148.114.188
74.178.76.44
172.66.2.5
72.153.5.60
52.110.12.16
52.110.12.5

File paths

C:\Program

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report