MALICIOUS — 856c5226dc2f5b6d7e1ddcc302ad5f7b7279b98afcd7fd7669e78b5c69029185
MALICIOUS — 856c5226dc2f5b6d7e1ddcc302ad5f7b7279b98afcd7fd7669e78b5c69029185 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100), attributed to the Container family. 4 of 25 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
856c5226dc2f5b6d7e1ddcc302ad5f7b7279b98afcd7fd7669e78b5c69029185 - SHA-1:
885f7207ba234aa3f3c6cb5f577aa912381554ab - MD5:
4c2c4e6b500beb1c8fb02d0a6828b890 - imphash:
5e6955ab958f0427686406bc5d4d6248 - ssdeep:
24576:5HKB8NIyXbacAfUSunEp+XRGEUvkXw6zezNFtW:YB8NIMI8SfpwotkzaxW - TLSH:
T11C5849C942E97E4CF012871639149ECC4971B4E9E47E88AC3852BCAF2D53A97BCB0D45 - Submitted as: 856c5226dc2f5b6d7e1ddcc302ad5f7b7279b98afcd7fd7669e78b5c69029185
- File type: pe · Size: 1647848 bytes
- Verdict: malicious (87/100) · Family: Container
Detections (4 of 25 engines)
- YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
- YARA: Yara-Rules community: YR_AntiDebug_Checks
MITRE ATT&CK
Why this verdict
The malicious score of 87/100 is the fusion of 8 weighted signals:
- Contacted 19 external host(s) at runtime (15 HTTP) - network signal, weight 0.40, confidence 0.80
- YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule
DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule
STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: http://www.symauth.com/cps0, http://www.symauth.com/rpa04, http://www.symauth.com/cps09 - static signal, weight 0.35, confidence 0.60
- enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
Embedded URLs
- http://crl.thawte.com/ThawteTimestampingCA.crl0
- http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
- http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
- http://www.symauth.com/cps0
- http://www.symauth.com/rpa04
- http://crl.verisign.com/pca3-g5.crl0
- http://www.symauth.com/cps09
- http://evcs-crl.ws.symantec.com/evcs.crl0
- http://evcs-aia.ws.symantec.com/evcs.cer0
- http://www.adobe.com/go/reader_system_reqs.Advertising
- http://www.adobe.com/go/reader_system_reqs.LC_UNSUPPORTED_OS_1Adobe
- http://crl.verisign.com/tss-ca.crl0
- https://www.verisign.com/rpa
- http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
- https://www.verisign.com/rpa0
- http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
- https://www.verisign.com/cps0*
- http://logo.verisign.com/vslogo.gif04
- http://crl.verisign.com/pca3-g5.crl04
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
Embedded domains
- pair.name
- tables.name
- item.name
- location.name
- control.name
- shortcut.name
- used.name
- crl.thawte.com
- ts-aia.ws.symantec.com
- ts-crl.ws.symantec.com
- www.symauth.com
- crl.verisign.com
- evcs-crl.ws.symantec.com
- evcs-aia.ws.symantec.com
- www.adobe.com
- armmf.adobe.com
- helpx.adobe.com
- www.microsoft.com
- kb2.adobe.com
- www.verisign.com
- csc3-2010-crl.verisign.com
- csc3-2010-aia.verisign.com
- logo.verisign.com
Embedded IP addresses
- 30.57.13.5
- 0.01.2.2
- 1.1.15.14
- 19.0.0.160
- 20.42.65.88
- 52.123.252.243
- 4.144.132.223
- 172.215.188.232
- 4.230.171.124
- 74.179.77.204
- 4.150.223.115
- 74.178.240.51
- 203.26.79.13
- 52.123.129.14
- 52.148.114.188
- 48.200.63.27
- 20.76.201.171
- 135.232.92.34
- 52.110.12.51
- 52.123.128.14
- 52.110.12.31
- 72.153.5.63
- 172.178.240.163
Registry keys
- HKEY_LOCAL_MACHINE\Software\Adobe\Acrobat
- HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe
- HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat
- HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active
- HKEY_LOCAL_MACHINE\Software\Adobe\
- HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Installer\
- HKEY_LOCAL_MACHINE\Software\Classes\.pdf
- HKEY_LOCAL_MACHINE\Software\Classes\
- HKEY_CLASSES_ROOT\.pdf
- HKEY_CLASSES_ROOT\AcroExch.Document.7\shell
- HKEY_CLASSES_ROOT\AcroExch.Document.7\shell\Read\command
- HKEY_CLASSES_ROOT\AcroExch.Document.7\shell\Open\command
- HKEY_CLASSES_ROOT\SOFTWARE\Adobe\Acrobat\Exe
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PreviewHandlers
- HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\
- HKEY_CLASSES_ROOT\Software\Adobe\Acrobat\EXE
- HKEY_CLASSES_ROOT\CLSID\{D38406DA-E8AA-484b-B80D-3D3DBDCC2FB2}\LocalServer32
- HKEY_CLASSES_ROOT\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\InprocServer32
- HKEY_CLASSES_ROOT\TypeLib\{0F6D3808-7974-4B1A-94C2-3200767EACE8}\1.0\HELPDIR
- HKEY_CLASSES_ROOT\CLSID\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\InProcServer32
- HKEY_CLASSES_ROOT\TypeLib\{41738EEA-442F-477F-92CF-2889BD6CD7E7}\1.0\0\win32
- HKEY_CLASSES_ROOT\MIME\Database\Content
- HKEY_CLASSES_ROOT\.pdf:
File paths
- X:\:`:
- P:\:h:t:
- T:\:d:l:t:
- D:\B\127930\Acrobat\Installers\InstEntryPointBlock\Release\InstEntryPointBlock.pdb
- d:\b\127930\acrobat\installers\adelrcp\..\Common\TstrBuf.h
- C:\Windows\explorer.exe
More Container samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report