MALICIOUS — client.dll

MALICIOUS — client.dll is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the HUILoader family. 5 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

• SHA-256: 8631e04cc12af5d57d3e61696560354073f7b0c693977931669c2db484716d19
• SHA-1: d153219c9411fc84594cd6355ff52c70d6066bf9
• MD5: b0d3f4bdd6b731e29e02de8a62b4ba06
• imphash: ec3f04b872e92288bbd87742f2b15d45
• ssdeep: 393216:OGRFhm9SeMVHOttDyjTaZrGR6s3vef5fmvUzn/m3B2rq7GEmK2:OG/4w5HOtciqYs2f5eNxCem
• TLSH: T1C476F19585031491F5B6E884F813CEFCC502F8AD9A654A8DA74BF48E07E8F67D2E009D
• Submitted as: client.dll
• File type: pe · Size: 29425664 bytes
• Verdict: malicious (97/100) · Family: HUILoader

Detections (5 of 55 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• capa (capabilities): capability:execution/powershell
• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.mem2,.mem4
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec

MITRE ATT&CK

• T1055
• T1059.001
• T1486
• T1057
• T1056.001

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 97/100 is the fusion of 13 weighted signals:

• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
• capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.mem2,.mem4 (rule high-entropy-sections:.mem2,.mem4) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.30, confidence 0.70
• Embedded network infrastructure: https://pulsevisuals.pro, 8.8.8.8, 85.193.84.172 - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: high-entropy-sections:.mem2,.mem4 - static signal, weight 0.25, confidence 0.55
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
• encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60
• inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://pulsevisuals.pro

Embedded domains

• 93.cc
• joc.ws
• gk.in
• 40.fr
• pulsevisuals.pro
• cosmetics-eu.pulsevisuals.pro
• cosmetics.pulsevisuals.pro
• api.pulsevisuals.pro
• euapi.pulsevisuals.pro
• ruapi.pulsevisuals.pro

Embedded IP addresses

• 8.8.8.8
• 85.193.84.172

File paths

• R:\2
• y:\c8z
• a:\f3
• N:\1

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report