MALICIOUS — unins000.exe
MALICIOUS — unins000.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (90/100), attributed to the Container family. 4 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
7620688e7e625765ed05d1053e9753473b119294b3bac0286a998e570f571d4e - SHA-1:
ed1b0e768547247e98ec2108a289a9ddc34be996 - MD5:
a742dbbc00411c27be705e6d60f18167 - imphash:
1f5c81c237df944625eb03df8462d1d3 - ssdeep:
24576:KMcMoi3rPR37dzHRA6G7WbuSEmK50Jyx9l0:KMrPR37dzHRA6GCbB80g8 - TLSH:
T166508DBE6757B713C77AC6280D046E9E0466B8A9107D24CD93A3C43DE7F7C676A00268 - Submitted as: unins000.exe
- File type: pe · Size: 787192 bytes
- Verdict: malicious (90/100) · Family: Container
Detections (4 of 55 engines)
- capa (capabilities): capability:collection/keylog
- YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- LIEF (executable format parser): lief:invalid-authenticode
MITRE ATT&CK
Why this verdict
The malicious score of 90/100 is the fusion of 7 weighted signals:
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule
DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.55, confidence 0.70 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - LIEF (executable format parser) flagged lief:invalid-authenticode (rule
lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70 - capa (capabilities) flagged capability:collection/keylog (rule
capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: http://www.innosetup.com/, http://www.remobjects.com/ps, https://secure.comodo.com/CPS0L - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.innosetup.com/
- http://www.remobjects.com/ps
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
- https://secure.comodo.com/CPS0L
- http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
- http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$
- https://sectigo.com/CPS0
Embedded domains
- www.innosetup.com
- www.remobjects.com
- schemas.microsoft.com
- secure.comodo.com
- crl.comodoca.com
- crt.comodoca.com
- sectigo.com
File paths
- c:\directory
More Container samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report