MALICIOUS — 714a2c734ec31f4f982ae85acd0cdf8e709145a38a9bc0db850f0d5f73d308f5

MALICIOUS — 714a2c734ec31f4f982ae85acd0cdf8e709145a38a9bc0db850f0d5f73d308f5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Injuke family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 714a2c734ec31f4f982ae85acd0cdf8e709145a38a9bc0db850f0d5f73d308f5
SHA-1: 82116420e05ce6611df8f0d987118669a02bc566
MD5: 5352574db20232e42e433dd8698b708f
imphash: 7ec12b23a79c6a47e2f01ad0ba460f1f
ssdeep: 49152:kUW/ts/KUf4TFgxuEyxw8BUfRr7TeXYQ5gcD5JNm:D4YumOPuZr4YQ5j
TLSH: T1F55BBECD4EAE2711C3BAC52019019EAD8458B1D1A03D794DCE0395BA17F3537EEB24BA
Submitted as: 714a2c734ec31f4f982ae85acd0cdf8e709145a38a9bc0db850f0d5f73d308f5
File type: pe · Size: 2256896 bytes
Verdict: malicious (98/100) · Family: Injuke

Detections (4 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
Microsoft Defender: flagged
Kaspersky (KVRT): UDS:Trojan.Win32.Injuke.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 12 weighted signals:

Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan.Win32.Injuke.gen (rule UDS:Trojan.Win32.Injuke.gen) - engine signal, weight 0.55, confidence 0.85
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.55, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.7-zip.org/ - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

23273 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

3daaf7e98917049b71ac0512f305d1d8e9f72e0dc99120dbea406fac54499097 - 3daaf7e98917049b71ac0512f305d1d8e9f72e0dc99120dbea406fac54499097
11ec2efe682e3daceb7c554c0ab50c67d0adaa92a426a87e3718576fe6a880a4 - 11ec2efe682e3daceb7c554c0ab50c67d0adaa92a426a87e3718576fe6a880a4
e0ef0bffdd5570e4b11f4976b97080f6655bf1cccf0aa26bceecdbb4d5836d18 - e0ef0bffdd5570e4b11f4976b97080f6655bf1cccf0aa26bceecdbb4d5836d18
f01dd026f62ea2a8433acafc6f2881ab1103dc5bacce45ea5a0b11c427f4c00a - f01dd026f62ea2a8433acafc6f2881ab1103dc5bacce45ea5a0b11c427f4c00a

Embedded URLs

http://www.7-zip.org/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.cerious.com
www.7-zip.org
interestourflash.info

Embedded IP addresses

20.184.175.5
52.123.252.235
4.230.171.124
57.155.101.212
57.155.104.224
4.144.132.223
74.178.240.51
40.79.141.154
74.178.76.128
4.150.223.114
104.18.33.89
162.159.142.9
52.110.12.19
52.110.12.20
52.148.114.188
72.154.7.111
92.223.78.30
52.110.12.51
52.110.12.31

File paths

H:\N

More Injuke samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report