MALICIOUS — 76e11752c8d9e5ed2cf30b7ba5fef5a209afa78608b2cc39e969874d86c0c708

MALICIOUS — 76e11752c8d9e5ed2cf30b7ba5fef5a209afa78608b2cc39e969874d86c0c708 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Ulise family. 6 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 76e11752c8d9e5ed2cf30b7ba5fef5a209afa78608b2cc39e969874d86c0c708
SHA-1: f56b8853c313c35ef0e59faca2b8bdfa61764d4c
MD5: c3a4ff64c808d30ab14d012c05b61a3e
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 6144:ohWdrRDNs8RUNKBP3npj4/0hvQzn76ppggmhOF0HFZlx6:SWdrRDNs8bP3nCeIP6ppgg2HFZlx6
TLSH: T1324E6CCD512F6349C2B5C6249E504EDC8866B4E9627DFA8C2A43C23F65D3C379C3906A
Submitted as: 76e11752c8d9e5ed2cf30b7ba5fef5a209afa78608b2cc39e969874d86c0c708
File type: pe · Size: 632548 bytes
Verdict: malicious (100/100) · Family: Ulise

Detections (6 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Ulise-9880529-0
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Trojan.Agent.FQFW

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.Ulise-9880529-0 (rule Win.Trojan.Ulise-9880529-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Vindor!pz (rule Trojan:Win32/Vindor!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.FQFW (rule Trojan.Agent.FQFW) - engine signal, weight 0.55, confidence 0.85
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.30, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
Embedded network infrastructure: 1.9.0.1 - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com/0
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://crl.thawte.com/ThawtePremiumServerCA.crl0
http://crl.verisign.com/tss-ca.crl0
http://crl.thawte.com/ThawteCodeSigningCA.crl02
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com
crl.thawte.com
crl.verisign.com

Embedded IP addresses

1.9.0.1
4.149.160.182
51.104.15.252
4.230.171.124
74.178.76.54
48.211.4.16
4.150.223.113
135.233.95.144
40.79.167.9
52.110.12.14
52.110.12.10
34.104.35.123

File paths

C:\Program
e:\fx19rel\WINNT_5.2_Depend\mozilla\obj-fx-trunk\toolkit\crashreporter\client\crashreporter.pdb

More Ulise samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report