MALICIOUS — 813dc5022085ef7c1e7e987607e7c0584cac0a92cbb4f753d02d4be379812b43
MALICIOUS — 813dc5022085ef7c1e7e987607e7c0584cac0a92cbb4f753d02d4be379812b43 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Fileinfector family. 6 of 56 detection engines flagged it.
Identification
- SHA-256:
813dc5022085ef7c1e7e987607e7c0584cac0a92cbb4f753d02d4be379812b43 - SHA-1:
b9eb5200c63b285cf14e17af67c1d95feaf23a6e - MD5:
bf7805125b2868a392bb3d7427fb9b55 - imphash:
bd0434162c6865df4fd801e30aa2ee8d - ssdeep:
98304:T/0f2tgOh2/0f2tgOhM/0f2tgOh6/0f2tgOhw/0f2tgOh:T5KOQ5KOG5KOM5KO65KO - TLSH:
T100644AC91A211383D8F5A690FEC0D81D10ABBC62916DEA5C5B8BC12FE3F11E3D2D6465 - Submitted as: 813dc5022085ef7c1e7e987607e7c0584cac0a92cbb4f753d02d4be379812b43
- File type: pe · Size: 5179466 bytes
- Verdict: malicious (99/100) · Family: Fileinfector
Detections (6 of 56 engines)
- ClamAV (daily): Win.Malware.Fileinfector-9834127-0
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- LIEF (executable format parser): lief:invalid-authenticode
- Microsoft Defender: Trojan:Win32/Vindor!pz
- Emsisoft (Emergency Kit): Trojan.Generic.38751518
- Kaspersky (KVRT): Virus.Win32.Lamer.ks
Why this verdict
The malicious score of 99/100 is the fusion of 8 weighted signals:
- ClamAV (daily) flagged Win.Malware.Fileinfector-9834127-0 (rule
Win.Malware.Fileinfector-9834127-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Vindor!pz (rule
Trojan:Win32/Vindor!pz) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Generic.38751518 (rule
Trojan.Generic.38751518) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Virus.Win32.Lamer.ks (rule
Virus.Win32.Lamer.ks) - engine signal, weight 0.55, confidence 0.85 - Contacted 2 external host(s) and 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - LIEF (executable format parser) flagged lief:invalid-authenticode (rule
lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70 - Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
639 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- edgedl.me.gvt1.com
- desktop-hsgcbep
- login.live.com
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- fe3cr.delivery.mp.microsoft.com
- settings-win.data.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- c:\python3\lib\__pycache__\rlcompleter.cpython-312.pyc -
7b7ba38a1382677446e99bdb0e244509e962e61f2223ef0eac31437246eb4f93
Embedded URLs
- http://schemas.microsoft.com/SMI/2016/WindowsSettings
- https://www.digicert.com/CPS0
- http://crl3.digicert.com/sha2-assured-cs-g1.crl05
- http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
- http://www.digicert.com/CPS0
- http://crl3.digicert.com/sha2-assured-ts.crl02
- http://crl4.digicert.com/sha2-assured-ts.crl0
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
- http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
- http://yr.c.lencr.org/
- http://c.pki.goog/r/gsr1.crl
- http://c.pki.goog/r/r4.crl
Embedded domains
- schemas.microsoft.com
- cacerts.digicert.com
- crl4.digicert.com
- crl3.digicert.com
- www.digicert.com
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 20.42.73.25
- 52.123.252.195
- 4.247.188.224
- 74.178.76.54
- 4.207.44.65
- 135.233.95.144
- 51.105.71.137
- 20.247.184.142
- 40.84.97.4
- 4.230.171.124
- 135.232.92.137
- 48.200.63.27
- 34.104.35.123
- 20.42.73.28
- 20.42.65.88
- 52.123.252.236
- 203.26.79.13
- 104.18.33.89
- 52.148.114.188
- 52.110.12.26
- 72.153.5.130
- 52.110.12.46
File paths
- D:\a\1\b\bin\win32\py.pdb
More Fileinfector samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report