MALICIOUS — virussign.com_69ff05ec09abefcf4f2ed0cacd1a1a40.vir

MALICIOUS — virussign.com_69ff05ec09abefcf4f2ed0cacd1a1a40.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Pvpk family. 5 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 7a79da9e60b884583828796e7af0c697695dcd73129b895e26ae2b05d6d358fc
SHA-1: 3167265a2aceb0232e05c01a14ad6b47c49dbf70
MD5: 69ff05ec09abefcf4f2ed0cacd1a1a40
imphash: e780223af31e5cc3f52e2ebb06482260
ssdeep: 12288:A//kY/q1OvDQuPOvI9DYS2UZ1IME5SxK4xZ02hxbJNPiZBZP+zAxqur:2z/9DnvUtD6v02XmYoj
TLSH: T1A250232B0205379EE5B398A0963E9F8F202740F462F707188B59A51CF5D443FAF72666
Submitted as: virussign.com_69ff05ec09abefcf4f2ed0cacd1a1a40.vir
File type: pe · Size: 779426 bytes
Verdict: malicious (100/100) · Family: Pvpk

Detections (5 of 56 engines)

ClamAV (daily): Win.Malware.Pvpk-10056926-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Worm:Win32/Sfone!pz
Emsisoft (Emergency Kit): Dropped:Generic.Malware.PVPk!!prn!.FE0B916D
Kaspersky (KVRT): UDS:DangerousObject.Multi.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Pvpk-10056926-0 (rule Win.Malware.Pvpk-10056926-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Worm:Win32/Sfone!pz (rule Worm:Win32/Sfone!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dropped:Generic.Malware.PVPk!!prn!.FE0B916D (rule Dropped:Generic.Malware.PVPk!!prn!.FE0B916D) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:DangerousObject.Multi.Generic (rule UDS:DangerousObject.Multi.Generic) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
2 behavioral detection(s) across 2 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.43, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 14 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

106712 behavior events · 2 ATT&CK techniques · 15 dropped files.

Dropped files

C:\Program Files\LibreOffice\share\basic\Template\cw4ymo3u 4fq06c girls boobs .mpeg.exe - c47198ff4d8b736ea83d366db56f41e4a78423cc1c6ed2cfa55919093853e29a
C:\PPLFaultTemp\y6go35p [free] 5n10bh latex (Sarah,Sonja).zip.exe - 9f9b98eeb8ecb55c89364f9df16419e3a4a75fa3e3d0228560b79bfcd298d500
C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\a3xo5xtn 4mvc8yaot big lady .rar.exe - 6c16ab3036cd1c3b061f8e0e616f965f172d1cbf91e23967e2c6779504b72448
C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\cw4ymo3u a3xo5xtn z8dvsxk d2jspkm3 .mpg.exe - 3a616cf7b9005b4c5c4f8b6ddfeec5d309b247921af950e965f4ecd596e696a1
C:\Program Files\LibreOffice\share\template\6mw7u7 xxx nude [milf] .avi.exe - 73768407dd5929f0f4bb327f7855eb8d877e92aeb8266fc894042cd708a4cbcd
C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\bwpt7j l8qccpyq horse wk79oa4s2r04wd .mpg.exe - a764a99c1d4aa1ee32359a6e6962bbdde310223f50cd671ded883b835e2f120f
C:\Program Files\LibreOffice\share\extensions\wiki-publisher\templates\xiwlzi0 4fq06c y6go35p kmozxo (Karin,Jenna).mpg.exe - 0f2b1b4146bdc1113162cb0d98216d595a6944f7f9025fee99e7370107615bad
C:\$WinREAgent\Scratch\WimTempPath\yn0pxd horse mtu2oyuh5 6r3apw4 wifey .avi.exe - 38d45e0b30a7948b0371e26b0187ba6f4a9a8b2cb37bda2d51c82c1b8a13e5cd
C:\Program Files\Common Files\Adobe\Acrobat\Temp\1lwbqss7 z8dvsxk [free] kpbv9mg7 .avi.exe - c63ea5856b6c70614448660cbd9582f5c6a0016795dbf4e3ca38c7a880e790c8
C:\Program Files\Windows Sidebar\Shared Gadgets\bwpt7j 4mvc8yaot 4fq06c hot (!) young .avi.exe - 78bd088f01746e9269b84feb2b4bfac1e9b9d9383c00e7c26a4e3de493990bf0
C:\WINDOWS6g2yf6t03h - 77cef0341981838416920b78faf246fd3ab79a6abc21ff0970f9940e664242ae
C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\tvolgth mtu2oyuh5 kmozxo .rar.exe - 5bc7d7456866fcddeb1ee46b34f95f3cf232bf31589baea9bd9ca8008caf0d21
C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\SA\static\js\plugins\unified-share\gay horse girls titts boots .mpg.exe - b2d3e0520a50eb6ca8840b96f7d420177f31aca6547903310d2899b1b7b82397
C:\Program Files\LibreOffice\share\tvolgth horse 6mjj01 .avi.exe - 8b078c805261741c97cc34a3f1c1f502830342a766938c5f2d562429d8fee424
C:\Program Files\Common Files\microsoft shared\cw4ymo3u cum fs8utd .rar.exe - 6047fc3c5b8d09568709be5fed380a14511cc0c7afad6e494893396e8d5e747c

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

n.pw
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.15
4.230.171.124
20.42.179.204
40.84.97.4
4.144.132.223
74.179.77.204
20.184.175.2
135.232.92.97
74.178.76.128
172.64.154.167
125.56.205.42
135.234.160.244
125.56.205.32
52.148.114.188
72.154.7.110
52.110.12.18
52.110.12.20

File paths

a:\j

More Pvpk samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report