MALICIOUS — 868e23e8c38b0bfbb6a28410a54230f133b7ee91a54196b46042291c66a1b928
MALICIOUS — 868e23e8c38b0bfbb6a28410a54230f133b7ee91a54196b46042291c66a1b928 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sivis family. 7 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
868e23e8c38b0bfbb6a28410a54230f133b7ee91a54196b46042291c66a1b928 - SHA-1:
67ac50434906ad2dae2879ee7ea075377c8dc11b - MD5:
76aa73266852bd8bb1ca9a7947d1f878 - imphash:
b10d16eedb1085ef7262dfc4ab03be6f - ssdeep:
12288:KgnnBKZpFhNGpW87PdKCT+V5KV5izrqFkbd:3nnBwpFhNGpW871KCTuIifqFud - TLSH:
T1EB49AEC84268621AD273EE65546ACDACE043F4AE3170056E62D6C33FB4F9173B8B95C1 - Submitted as: 868e23e8c38b0bfbb6a28410a54230f133b7ee91a54196b46042291c66a1b928
- File type: pe · Size: 401473 bytes
- Verdict: malicious (100/100) · Family: Sivis
Detections (7 of 56 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Sivis-9908038-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Detect It Easy (packer/type): DIE:UPX
- Microsoft Defender: Virus:Win32/Sivis.A
- Emsisoft (Emergency Kit): Win32.Sivis.A
- Kaspersky (KVRT): Virus.Win32.Agent.es
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 13 weighted signals:
- ClamAV (daily) flagged Win.Malware.Sivis-9908038-0 (rule
Win.Malware.Sivis-9908038-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Virus:Win32/Sivis.A (rule
Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule
Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Virus.Win32.Agent.es (rule
Virus.Win32.Agent.es) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
- Detect It Easy (packer/type) flagged DIE:UPX (rule
DIE:UPX) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule
UPX) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0 - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
- Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
16175 behavior events · 0 ATT&CK techniques · 98 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- licensing.mp.microsoft.com
- settings-win.data.microsoft.com
- assets.msn.com
- www.bing.com
- th.bing.com
- fe3cr.delivery.mp.microsoft.com
Dropped files
- C:\Program Files\7-Zip\Lang\co.txt -
4487f90d5686e98363a6402c89235e6e60be58c2c747c908b457c1d5a656dd2b - C:\Program Files\7-Zip\Lang\ne.txt -
529148e493c12498b5b2e3bd66815260d9841c707264bd335ab15b2654676592 - C:\Program Files\7-Zip\Lang\en.ttt -
561281b54991e0f07376e8b8c7ddbba6550bad5f2892d91a143d2993b3cfc7e4 - C:\Program Files\7-Zip\Lang\mn.txt -
ba2fe1e6bdb53dc715075ec9c43f2c92ca5c94f02d82faa7ef27bed6f2fecf1a - C:\Program Files\7-Zip\Lang\ps.txt -
d70c672a7493f5494b57706e8455454871fff906e08efca41b4102ef89bfd60a - C:\Program Files\7-Zip\Lang\gl.txt -
79c576a3db25cdc6550907b24e03985908f0ad1368ffb19acceb9fedd225bfcf - C:\Config.Msi\PTA956.tmp -
4a41828aa39ea4e64ebba7d2d665dda97a0b1df8da565074c1267b6f3bac8888 - C:\Program Files\7-Zip\Lang\pl.txt -
de2e1d769f1cea17da2b982e71e0a813745f48e8607f879f9ea7077743a35a56 - C:\Program Files\7-Zip\Lang\br.txt -
9742f87d0a410b932515b0daa949481f094ecb478d86468a9c180aea1b86f4b9 - C:\Program Files\7-Zip\Lang\eo.txt -
9babd036024a47e1dffa40c41e621445e0ee2474c6a59f54f75fe924b551fbd0 - C:\Program Files\7-Zip\7z.sfx -
bbb661c5b0155ae5a963184a517cf84edf2c32a7b2fa98a11d10604aa56e9e99 - C:\Program Files\7-Zip\Lang\eu.txt -
be3bee7e100900f333b327092687a2300a693df3e5bd285343ae52f137ff77ff - C:\Program Files\7-Zip\Lang\mng2.txt -
4a9329c356560599e356d13c0ccfad1a38f17732108ab7be031def5f3d0d25ef - C:\800.ini -
a45f9bf8c3daaf187f9301d08fccedb82c5753df770c1ccea5afbc0034587c7d - a680dc21ee5cf53354351a7bd100de2f15726f71b55f42181d485690217d45db -
a680dc21ee5cf53354351a7bd100de2f15726f71b55f42181d485690217d45db
Embedded URLs
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#
- http://ns.adobe.com/xap/1.0/
- http://creativecommons.org/publicdomain/zero/1.0/
- http://www.adobe.com/go/reader_system_reqs_pl.UnmoveFilesUsuwanie
- http://www.microsoft.com/pl-pl/default.aspx.LC_UNSUPPORTED_OSLC_UNSUPPORTED_OS_1Tej
- http://www.adobe.com/go/reader_system_reqs_pl.OLE_VERB_OPEN&Otw
- https://www.digicert.com/CPS0
- http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
- http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
- http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
- http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
- http://www.digicert.com/ssl-cps-repository.htm0
- https://d.symcb.com/rpa0
- http://s.symcb.com/universal-root.crl0
- https://d.symcb.com/rpa0@
- http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
- http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
- http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
- http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
- http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
- http://office.microsoft.com/0
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
- http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
Embedded domains
- www.w3.org
- ns.adobe.com
- creativecommons.org
- geocities.com
- www.adobe.com
- helpx.adobe.com
- www.microsoft.com
- systemowych.us
- pliku.us
- crl3.digicert.com
- crl4.digicert.com
- www.digicert.com
- cacerts.digicert.com
- d.symcb.com
- s.symcb.com
- ts-crl.ws.symantec.com
- ts-aia.ws.symantec.com
- crl.microsoft.com
- office.microsoft.com
Embedded IP addresses
- 20.42.73.27
- 52.123.252.226
- 20.247.185.124
- 4.230.171.124
- 4.247.188.224
- 57.155.104.224
- 74.178.240.51
- 104.18.33.89
- 135.232.92.137
- 20.184.175.2
- 74.178.76.128
- 172.178.240.162
- 125.56.205.26
- 52.110.12.19
- 125.56.205.113
- 52.110.12.26
File paths
- P:\Target\x86\ship\osm\x-none\msbarcode.pdb
- f:\dd\tools\devdiv\FinalPublicKey.snk
- f:\dd\trinity\appnet\fx\office\viewcontrols\AddInAdapters\Word\objr\i386\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.pdb
More Sivis samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report