MALICIOUS — 752e54207de39a13d44683d4ff2b2b202862eca31bcf729cdf01ab132ac62e67

MALICIOUS — 752e54207de39a13d44683d4ff2b2b202862eca31bcf729cdf01ab132ac62e67 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AntiDebug family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 752e54207de39a13d44683d4ff2b2b202862eca31bcf729cdf01ab132ac62e67
SHA-1: 42475a62240d8bea6a23ba93bc485914d33a99e9
MD5: 3f1dd8ba7698906dc545fd909ee5e656
imphash: a9192bab5c7c795c7488b69a1853f9c2
ssdeep: 6144:MZwJNmQfmriZ5UUvs5UdeTC2tmku/iCikka/+MMB6V1aaW9+exIDn:MGJhmTC2tmku/iCikka/+MMB6u9+3T
TLSH: T19C453B8C28372682E776D1217C628E1C2D72342536BFDD3C6247C91E19F3A1B56A4B39
Submitted as: 752e54207de39a13d44683d4ff2b2b202862eca31bcf729cdf01ab132ac62e67
File type: pe · Size: 266240 bytes
Verdict: malicious (100/100) · Family: AntiDebug

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Agent-448770
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: flagged
Trellix Stinger (McAfee): Trojan-FUFL!3F1DD8BA7698
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-448770 (rule Win.Trojan.Agent-448770) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FUFL!3F1DD8BA7698 (rule Trojan-FUFL!3F1DD8BA7698) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.ks (rule Virus.Win32.Lamer.ks) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.pinkworld.com, http://www.youporn.com, http://www.redtube.com - static signal, weight 0.35, confidence 0.60
Dropped 23 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

55080 behavior events · 2 ATT&CK techniques · 37 dropped files.

Dropped files

C:\Windows\System32\msvcp140_atomic_wait.dll - bbe08db11bfe3f444e7b8973ee9ae8de9ef76fb07a0cbbbb3091d281a56020ba
C:\Windows\System32\mmc.exe.config - 88f0ce4744b0ac8b15e5e9b42ebfba102dd719b7d8c1aea60019d43d1bb21e8c
C:\Windows\System32\license.rtf - 1795f3ca151e722fe43decbdde4127211f9c2151e20977cf445e63d0d4575c50
C:\Windows\System32\PrintConfig.dll - 70899c0f4f26971d3135556075ba6771f386b4fdb04b83e60636509b296b3734
C:\Windows\System32\concrt140.dll - 9aa9bce20c5f49eeb9b84296f98d7cd34f545e18e5694b7dd316d5a0351ffac0
C:\Windows\py.exe - 6e6ca88f011bb30478c1696e8625ba4e933a833931f6db5ccc926e64542009d5
C:\Windows\System32\vcruntime140.dll - 0d8cb9970b4f569ac8f55770407204ea833a10534b3d2b5f41f62849298ee929
C:\Windows\pyshellext.amd64.dll - 200c15f5bca2742fca57f414d5182cf5b4c85c0dbf6553faa3752d5558a6f7d9
C:\Windows\SysmonDrv.sys - 539f87fa0e2a429adaf19cddeb437e20ca773f32b8ea36ca72e3fa28fb24de37
C:\Windows\System32\msvcp140_2.dll - 9e717519ff7d52900cadac278a610498feff963116efb5bd176c496f7ad7f122
C:\Windows\System32\vccorlib140.dll - bd367d505682fef42a4c5a66c989374e128bed97a2db535e9c51d6c89fcbde88
C:\Windows\setupact.log - 55b21963cb17b83edc63fcbfb4fed170afb981bcefde099f217c6d8b07969477
C:\Windows\System32\msvcp140_codecvt_ids.dll - 1c5374833b9f046d9298eeac0e12e211866d7d0aa1bd6d7afa7adf88dd48310d
C:\Windows\System32\mfcm140u.dll - 2776e666405fef4b7b81c793162cd0b3accb666ff500273de882be59018e90ea
C:\Windows\System32\msvcp140.dll - 5a2aa32229a3abd2fe77d2ddd03b961b1175369f5f3fcc548db62df93f7e0a3a

Embedded URLs

http://www.pinkworld.com
http://www.youporn.com
http://www.redtube.com
http://www.assparade.com/
http://www.freeav.com/
http://www.antispyware.com/
http://www.antivirus.com/
http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0O
http://office.microsoft.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.pinkworld.com
www.youporn.com
www.redtube.com
www.assparade.com
www.freeav.com
www.antispyware.com
www.antivirus.com
crl.microsoft.com
www.microsoft.com
office.microsoft.com

Embedded IP addresses

184.84.165.168
20.42.65.88
4.155.95.248
52.123.252.230
4.230.171.124
104.18.33.89
74.178.76.54
4.150.223.98
74.179.77.204
20.42.179.192
52.168.117.170
40.74.98.199
4.150.223.106
135.234.160.244
135.234.160.245
72.153.5.134
52.148.114.188
52.110.12.22
52.110.12.18

File paths

L:\:`:d:h:p:t:
X:\:`:d:h:l:p:
X:\:t:
T:\:x:
T:\:
H:\:l:
X:\:`:
X:\:`:d:h:l:p:t:x:

More AntiDebug samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report