MALICIOUS — 7765006677771a5ceb9e02739a6b049090c6c6f51ba3bc02ab00709c918b7ead

MALICIOUS — 7765006677771a5ceb9e02739a6b049090c6c6f51ba3bc02ab00709c918b7ead is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100), attributed to the Maldoc family. 3 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 7765006677771a5ceb9e02739a6b049090c6c6f51ba3bc02ab00709c918b7ead
SHA-1: 38197eea7c687ddaec996002c16ce41b9ef09ea3
MD5: 0be7f5be53dfbcf8fb8cac910dd615d9
imphash: 6261f394332baab962003b7d36f650f6
ssdeep: 1536:DrWjlaJZxgRDdBFB8l9kYBaVJRaCAd1uhNRk98EBsTS:DijlwPITF+lyYBa1098EGTS
TLSH: T1D7438F788932B2C1C6F29E645E20997C140CA49B1639B55B8ED3A16FF2FB07315B1393
Submitted as: 7765006677771a5ceb9e02739a6b049090c6c6f51ba3bc02ab00709c918b7ead
File type: pe · Size: 232938 bytes
Verdict: malicious (95/100) · Family: Maldoc

Detections (3 of 55 engines)

ClamAV (daily): Win.Malware.Generic-9886878-0
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

T1071.001

Why this verdict

The malicious score of 95/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Generic-9886878-0 (rule Win.Malware.Generic-9886878-0) - engine signal, weight 0.90, confidence 0.95
Contacted 24 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787729691&P2=404&P3=2&P4=cYYJaVRtY6t4HC8JXyiDi05yKBuI3qgkwTKECimdeP0ZWrFjayIU8HwQriDI%2f%2fLRDYZiWUwBiJsUGXH%2b4QOLyg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787729725&P2=404&P3=2&P4=V8IMaWtAdB%2fx7y4Orxi%2bPQ2qqUe19FoFk2UbO%2fpfiKRASx3tI9h%2fa%2bUIy4By4zyuDvHKN4QwrO3EsgEMHPIUmg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com

Embedded IP addresses

203.26.79.13
20.184.175.4
57.155.101.212
52.168.117.175
52.123.252.192
135.233.95.144
4.150.223.113
4.144.132.114
4.230.171.124
74.178.240.51
52.110.12.2
52.110.12.38
52.123.129.14
20.231.239.246
40.103.64.226
52.123.128.14
40.103.64.242
135.233.95.80
172.66.2.5
135.234.160.245
52.148.114.188
72.145.35.108
52.110.12.49
52.110.12.5

File paths

F:\Office\Target\x64\ship\postc2r\x-none\msoxmled.pdb

More Maldoc samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report