MALICIOUS — 8c94e83c321067775bb07fab83a196d6dfc74f4a2cbd857e5bf56054fb5a69e2

MALICIOUS — 8c94e83c321067775bb07fab83a196d6dfc74f4a2cbd857e5bf56054fb5a69e2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Pidgeon family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 8c94e83c321067775bb07fab83a196d6dfc74f4a2cbd857e5bf56054fb5a69e2
SHA-1: ed194969071fa42f290348dfdf8360d98f8be0b8
MD5: 760a38e3cba3225a507844a0664b5a4c
imphash: a6e200b94518b2d5a3a72cffd5a4b402
ssdeep: 24576:j0mbpjWVP7YlZa9lq4BVNdWgvwmJqJHQ6Mjs9ymTNYqZ+G4wUbMQ:wpR8Pa9lq2dWw6MjEbZ+G43MQ
TLSH: T1305849890682E745C1E0D75DBCB0AA5EE4A3F08536765E4C6B82B07A5AF337374D842C
Submitted as: 8c94e83c321067775bb07fab83a196d6dfc74f4a2cbd857e5bf56054fb5a69e2
File type: pe · Size: 1691648 bytes
Verdict: malicious (97/100) · Family: Pidgeon

Detections (4 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Packed.Pidgeon-9909600-0
YARA: Yara-Rules community: YR_AntiDebug_Checks
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

T1056.001

Why this verdict

The malicious score of 97/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Packed.Pidgeon-9909600-0 (rule Win.Packed.Pidgeon-9909600-0) - engine signal, weight 0.90, confidence 0.95
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 19 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 6.0.1.0 - static signal, weight 0.35, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://office.microsoft.com/en-us/onenote-help/
https://go.microsoft.com/fwlink/?LinkID=619267
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787820652&P2=404&P3=2&P4=gNWBLNBIxWp2%2fqGkEiuZuutWLVPEj3Ll%2bT11wyG0AH5BECQ2Mq7aFLqteKfz8TrjB9rVgy5sxLM9JhOZjaQ9iA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
crl.microsoft.com
www.microsoft.com
office.microsoft.com
go.microsoft.com

Embedded IP addresses

6.0.1.0
51.11.192.51
52.123.252.239
172.215.188.225
52.230.60.54
4.230.171.124
74.179.77.204
20.42.73.31
20.231.239.246
52.123.128.14
40.99.133.242
52.123.129.14
172.178.240.161
203.26.79.13
72.153.5.140
52.148.114.188
52.110.12.4
135.233.95.135
135.232.92.34
52.110.12.55

File paths

F:\Office\Target\x86\ship\postc2r\x-none\onenote.pdb
X:\:`:d:p:t:
X:\:`:d:h:l:p:t:x:
X:\:
T:\:d:l:t:
P:\:
P:\:d:
H:\:p:

More Pidgeon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report