MALICIOUS — 8767228a2fd74e5f514c426ee3d594429b56d9ef88ba026887cc745b251786dd

MALICIOUS — 8767228a2fd74e5f514c426ee3d594429b56d9ef88ba026887cc745b251786dd is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100), attributed to the Ulise family. 2 of 56 detection engines flagged it.

Identification

• SHA-256: 8767228a2fd74e5f514c426ee3d594429b56d9ef88ba026887cc745b251786dd
• SHA-1: 079fd6f1f3562e1f3b903f74a0c3f2a4ece6dd78
• MD5: 820cba9777056363472fa8f237d7383c
• imphash: d41d8cd98f00b204e9800998ecf8427e
• ssdeep: 6144:ad/mDsV1hc1zudfVh9M9soUvJmylIo1bv:y/mY9ctWdh9MZz8xbv
• TLSH: T19542BFC90B377606C2B5DF51E8804CEC6062F9E522BDE9CDB213E16F97D6427942922C
• Submitted as: 8767228a2fd74e5f514c426ee3d594429b56d9ef88ba026887cc745b251786dd
• File type: pe · Size: 203776 bytes
• Verdict: malicious (89/100) · Family: Ulise

Detections (2 of 56 engines)

• ClamAV (daily): Win.Trojan.Ulise-9880529-0
• YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS

Why this verdict

The malicious score of 89/100 is the fusion of 2 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Ulise-9880529-0 (rule Win.Trojan.Ulise-9880529-0) - engine signal, weight 0.90, confidence 0.95
• YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• licensing.mp.microsoft.com
• config.edge.skype.com
• windows.msn.com
• officeclient.microsoft.com
• www.msn.com
• odc.officeapps.live.com
• assets.msn.com
• www.bing.com
• th.bing.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded URLs

• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• http://www.microsoft.com/windows0
• http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
• http://schemas.microsoft.com/SMI/2005/WindowsSettings
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• www.microsoft.com
• crl.microsoft.com
• schemas.microsoft.com

Embedded IP addresses

• 20.42.73.31
• 4.144.132.114
• 52.123.252.224
• 4.230.171.124
• 104.18.33.89
• 172.66.2.5
• 52.110.12.46
• 52.110.12.19

File paths

• C:\Program

More Ulise samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report