MALICIOUS — 8126e6ca66141ec9fb091be7d59a6e10e2ed146cb0aeda46040a43a6d6c347eb

MALICIOUS — 8126e6ca66141ec9fb091be7d59a6e10e2ed146cb0aeda46040a43a6d6c347eb is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Pioneer family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: 8126e6ca66141ec9fb091be7d59a6e10e2ed146cb0aeda46040a43a6d6c347eb
• SHA-1: 256532d8ed162ee5413c982b6fcfc9f714915608
• MD5: 25f9ad11995293b77d22f841cad95f6d
• imphash: f7d15d43ae80dd0f936ce5a1146865b1
• ssdeep: 6144:mTETQgqkpCQxB+bI9XBV+UdvrEFp7hKSMKV:0ETQgqLsB+bI9XBjvrEH7XMKV
• TLSH: T17D46E7CE51197312DB3489281E208BAE90A2B0E155B27E5D4E46877F28D346BFD3B07D
• Submitted as: 8126e6ca66141ec9fb091be7d59a6e10e2ed146cb0aeda46040a43a6d6c347eb
• File type: pe · Size: 301399 bytes
• Verdict: malicious (100/100) · Family: Pioneer

Detections (5 of 56 engines)

• ClamAV (daily): Win.Virus.Pioneer-9111434-0
• LIEF (executable format parser): lief:invalid-authenticode
• Microsoft Defender: Virus:Win32/Floxif.H
• Emsisoft (Emergency Kit): Win32.Floxif.A
• Kaspersky (KVRT): Virus.Win32.Pioneer.cz

MITRE ATT&CK

• T1543.003
• T1112
• T1105

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

• ClamAV (daily) flagged Win.Virus.Pioneer-9111434-0 (rule Win.Virus.Pioneer-9111434-0) - engine signal, weight 0.90, confidence 0.95
• Dropped a malicious payload: symsrv.dll - dynamic signal, weight 0.62, confidence 0.90
• Microsoft Defender flagged Virus:Win32/Floxif.H (rule Virus:Win32/Floxif.H) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Win32.Floxif.A (rule Win32.Floxif.A) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Virus.Win32.Pioneer.cz (rule Virus.Win32.Pioneer.cz) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• Contacted 1 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Extracted FloodFix config (0 C2) - engine signal, weight 0.45, confidence 0.60
• LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Memory forensics: 5 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 6092) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

6391 behavior events · 2 ATT&CK techniques · 7 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• 5isohu.com
• www.aieov.com
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• assets.msn.com
• licensing.mp.microsoft.com
• www.bing.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

• C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe - ff3c1e8534ca7a73a9a3735340950d41028e49e4869f093957e4888de811f937
• C:\program files\common files\System\symsrv.dll.000 - aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
• C:\Users\analyst\AppData\Local\Temp\A1D26E2\3E3B4CDA8.tmp - 7209d144d97ca57288e829fb5f026b5c4576433aaa7f5fb0adc6504a33b21656
• C:\Program Files\Common Files\System\symsrv.dll - de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
• C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe.dat - e730922f614e4dffe70d229ec118cd3052a31e9ca4dab274a1a15df1cbfa5674
• 7f6850638fc784f77a3dc88621a4f0a95a61ddf2d747c04d3bbcc6f9b0c95885 - 7f6850638fc784f77a3dc88621a4f0a95a61ddf2d747c04d3bbcc6f9b0c95885
• 068634cd0f67fb267dc01ba8001c3409932bbfde59d72f28d8bb0c72e12a5c25 - 068634cd0f67fb267dc01ba8001c3409932bbfde59d72f28d8bb0c72e12a5c25

Embedded URLs

• http://schemas.microsoft.com/SMI/2005/WindowsSettings
• https://www.microsoft.com
• http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://www.aieov.com/logo.gif

Embedded domains

• schemas.microsoft.com
• www.microsoft.com
• crl.microsoft.com
• 5isohu.com
• www.aieov.com

Embedded IP addresses

• 20.42.65.88
• 52.123.252.236
• 4.230.171.124
• 52.230.60.54
• 13.248.169.48
• 52.110.12.44
• 52.110.12.30

File paths

• X:\:`:d:l:p:t:x:

More Pioneer samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report