MALICIOUS — virussign.com_80bf3d4b31a9910e90cc9de704a38600.vir

MALICIOUS — virussign.com_80bf3d4b31a9910e90cc9de704a38600.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Muldrop family. 4 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 70aa16cf226f246d07f9ce0bbc20b5165d901d10307e34929499c735539559eb
SHA-1: ce0c86aedffad4fd8302eb4900550c41c527c4e5
MD5: 80bf3d4b31a9910e90cc9de704a38600
imphash: b7b1d154ca47a083b83fddc13f54b733
ssdeep: 3072:LEujVAo5WWiIkx6eB4cTYOLs3vMqgvnuL:LEzo8t6ePYOLs3Eqgvnu
TLSH: T1FB418EAF309249BFC30A63847BD018CC17E353DA21575CAAE148DA99D9B53FBAD90071
Submitted as: virussign.com_80bf3d4b31a9910e90cc9de704a38600.vir
File type: pe · Size: 188464 bytes
Verdict: malicious (99/100) · Family: Muldrop

Detections (4 of 52 engines)

ClamAV (daily): Win.Malware.Midie-6847893-0
Microsoft Defender: TrojanDropper:Win32/Muldrop.V!MTB
Emsisoft (Emergency Kit): Gen:Heur.Conjar.9
Kaspersky (KVRT): HEUR:Trojan.Win32.Agent.pef

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Midie-6847893-0 (rule Win.Malware.Midie-6847893-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged TrojanDropper:Win32/Muldrop.V!MTB (rule TrojanDropper:Win32/Muldrop.V!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Conjar.9 (rule Gen:Heur.Conjar.9) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Agent.pef (rule HEUR:Trojan.Win32.Agent.pef) - engine signal, weight 0.55, confidence 0.85
Contacted 29 external host(s) at runtime (12 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://purl.org/dc/elements/1.1/, http://www.iec.ch - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

28441 behavior events · 1 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://ns.adobe.com/xap/1.0/
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/photoshop/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/sType/ResourceRef#
http://www.iec.ch
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786197408&P2=404&P3=2&P4=L4FUBYUe9ZYtLgaMI4HrLyS%2bPSe6mUPFizXeuyy6gG9zKXY%2b9HJFIl14Rhft1s1zx8nlBx1ppRC%2bN4BPzpxEiQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786197438&P2=404&P3=2&P4=E0UAslZnmIhcLBSxHk6%2fhBRq4l3iHVHKvgollEIg8Yu1suvaQ3VMl%2fWb56DfGwX0xt9UfPkQ1NXsWtFtMlCAEQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ns.adobe.com
www.w3.org
purl.org
www.iec.ch
aefd.nelreports.net

Embedded IP addresses

20.184.175.16
52.123.252.239
4.144.132.114
4.230.171.124
135.234.160.245
52.123.252.247
20.165.94.46
52.123.252.220
40.84.97.4
203.26.79.13
52.110.12.49
52.110.12.54
184.84.165.136
4.243.160.21
52.123.252.238
52.148.114.188
52.110.12.2
52.110.12.15

File paths

C:\Program

More Muldrop samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report