SUSPICIOUS — msedgeupdateres_pt-BR.dll

SUSPICIOUS — msedgeupdateres_pt-BR.dll is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (67/100). 0 of 55 detection engines flagged it.

Identification

SHA-256: 8410216e16bf0278a095fc815146e080e8be7275f1b7dd95bf15216f9f33fc80
SHA-1: 1ffb71d89b03e25607a9239435978ec8d0c2f375
MD5: 24d3af1b55e7e54f365710a8334d7216
imphash: 6c8408bb5d7d5a5b75b9314f94e68763
ssdeep: 384:WLVFXh7xWmzIWtfuE6kL6xgNt7W2IHlNiQa2QR9zD40K:QruErOna2s9zA
TLSH: T1422DFBCEA36C5B22D27AD4382720E2FC5458B4D912B8329D5E1B47739572123FD324AE
Submitted as: msedgeupdateres_pt-BR.dll
File type: pe · Size: 29528 bytes
Verdict: suspicious (67/100)

Detections (0 of 55 engines)

No engine flagged this sample.

Why this verdict

The suspicious score of 67/100 is the fusion of 2 weighted signals:

Memory forensics: 7 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 916) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Contacted 26 external host(s) at runtime (29 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

48 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

https://www.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787643563&P2=404&P3=2&P4=JfKAjDxY1F2HN%2bpOrOCQMz4Ey6LATT2DRiHuUXV9bzVYKUxpYxTrhOnE5caeIWfYeyxV8AbVT0MgnKUwd5642g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787643600&P2=404&P3=2&P4=BwtCCgP%2b0Po3EKbuteJw1uFzSdklTNCy3ZRius2L%2fmBlLCzLCWhenlIr11bW5TWexXorAj5%2b0ohEpufa5%2f9IDA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787040329&P2=404&P3=2&P4=huoTMD8DxQZpxgrgneEMEmRoaXZKgCN5YPazsj%2fpTQpKBzB2xMVACYkHRjRAq6APshCEyo8mkpnpVfCw5Yd4AA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787039914&P2=404&P3=2&P4=l6WYQsKPn9dxeX5mpn6RcZOURCsWfeKsJfA81bbht%2bHnxskdjPcYkAURmEPjUyMZ8RPzioHaTJoGQh5hKscPhQ%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.microsoft.com
crl.microsoft.com

Embedded IP addresses

172.83.156.122
20.184.175.14
52.230.60.54
57.154.63.210
4.230.171.124
74.178.76.128
4.150.223.103
74.178.76.54
74.179.77.204
20.76.201.171
52.123.129.14
52.123.128.14
203.26.79.13
52.182.143.212
20.165.94.46
172.178.240.162
52.148.114.188
72.154.7.98
51.11.192.50
4.209.250.170
20.42.72.131
4.150.223.97
142.250.195.131
92.223.78.30
52.110.12.32

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report