MALICIOUS — Vcffipzmnipbxzdl.exe
MALICIOUS — Vcffipzmnipbxzdl.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Cryptolocker family. 7 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
7506c7a843894c03e3e52a2421dd7f628bd1da2b14fbcee6434a3736e3bffc43 - SHA-1:
d59060b8239282b2dc853aeac7768187f45df606 - MD5:
a8af83dac4f48d8b4c30ba2e2b3de40b - imphash:
185adc003fc86c6dcacec19419592432 - ssdeep:
12288:06NINoPgXqvRyq5E3R18y0kQzX3EL1TdB0JUsoSfsJuRqQy5d5ta:06iWP9JAR18ycD3ErB2rs8MQy5s - TLSH:
T138518B0D4F9B0A5FF1F456795C110A5D7C9A25CA19ADAA0CDB0B807DE6E34B30A808F7 - Submitted as: Vcffipzmnipbxzdl.exe
- File type: pe · Size: 846866 bytes
- Verdict: malicious (99/100) · Family: Cryptolocker
Detections (7 of 51 engines)
- capa (capabilities): capability:collection/keylog
- MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
- ClamAV (daily): Win.Trojan.Cryptolocker-3
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Detect It Easy (packer/type): DIE:Microsoft Linker
- Microsoft Defender: Ransom:Win32/Crilock.B
- Emsisoft (Emergency Kit): Gen:Variant.Trojan.Ransomware.390
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 8 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Cryptolocker-3 (rule
Win.Trojan.Cryptolocker-3) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Ransom:Win32/Crilock.B (rule
Ransom:Win32/Crilock.B) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.Trojan.Ransomware.390 (rule
Gen:Variant.Trojan.Ransomware.390) - engine signal, weight 0.55, confidence 0.85 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule
DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
29 behavior events · 1 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- searchapp.bundleassets.example
- desktop-hsgcbep
- licensing.mp.microsoft.com
- v10.events.data.microsoft.com
- settings-win.data.microsoft.com
- login.live.com
- config.edge.skype.com
- fd.api.iris.microsoft.com
- www.bing.com
- windows.msn.com
- officeclient.microsoft.com
- dns.msftncsi.com
- msedge.api.cdp.microsoft.com
- watson.events.data.microsoft.com
- self.events.data.microsoft.com
- ecs.office.com
- g.live.com
- assets.msn.com
Embedded domains
- ki.tk
- inference.location.live.net
File paths
- f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
- f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
- f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl
More Cryptolocker samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report