MALICIOUS — node.dll
MALICIOUS — node.dll is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Maldoc family. 5 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
8d31c14a59cccb093ad1264c43e4d032a9cfcefeaa0d45b6862a5776c44fff37 - SHA-1:
be7679e8bbebefd16c0906d15d775b81d81b73aa - MD5:
a1bb20106dfd3330625c98f0acaa38fe - imphash:
58a362896630eb5a34e7f160c4462464 - ssdeep:
49152:9vJjhvv6FzlQKxCjGj+Vd4OscisICzSHgn/1ooOEO3/8CJtQmqFkCn3sSJ5hp6A:95hvydfkj2m4WIu/1IvKP4m - TLSH:
T16665AEAE236C7E9FD2C2D7A83CA04B9D300FB0DA36766CCD4185D611A4E6C43B539199 - Submitted as: node.dll
- File type: pe · Size: 5749248 bytes
- Verdict: malicious (96/100) · Family: Maldoc
Detections (5 of 55 engines)
- YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
- YARA: ESET research: mimban
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: SophosLabs IoCs (public): SOPHOS_Gootloader_JS
- YARA: Yara-Rules community: YR_AntiDebug_Checks
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 7 weighted signals:
- YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule
DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.70, confidence 0.70 - YARA: ESET research flagged mimban (rule
mimban) - engine signal, weight 0.70, confidence 0.70 - YARA: SophosLabs IoCs (public) flagged SOPHOS_Gootloader_JS (rule
SOPHOS_Gootloader_JS) - engine signal, weight 0.70, confidence 0.70 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt, http://www.midnight-commander.org/browser/lib/tty/key.c, https://mathiasbynens.be/notes/javascript-encoding - static signal, weight 0.35, confidence 0.60
- enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://github.com/chalk/ansi-regex/blob/master/index.js
- http://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt
- http://www.midnight-commander.org/browser/lib/tty/key.c
- https://github.com/nodejs/node/pull/1771#issuecomment-119351671
- https://mathiasbynens.be/notes/javascript-encoding
- https://tools.ietf.org/html/rfc3492#section-3.4
- http://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3.4
- http://en.wikipedia.org/wiki/ANSI_escape_code#graphics
- https://goo.gl/t5IS6M
- https://github.com/nodejs/node/pull/13870#discussion_r124515293
- https://github.com/antirez/linenoise
- http://invisible-island.net/xterm/ctlseqs/ctlseqs.html
- http://www.3waylabs.com/nw/WWW/products/wizcon/vt220.html
- https://github.com/nodejs/node-v0.x-archive/issues/2876
- https://github.com/joyent/node/issues/3295
- https://github.com/v8/v8/blob/d6ead37d265d7215cf9c5f768f279e21bd170212/src/js/prologue.js#L152-L156
- https://github.com/nodejs/node/issues/15673
- https://github.com/nodejs/http2
- https://tools.ietf.org/html/rfc3986#section-3.2.2
- https://tools.ietf.org/html/rfc7540#section-8.1.2.5
- https://tools.ietf.org/html/rfc7230#section-3.2.2
- http://www.squid-cache.org/Doc/config/half_closed_clients/
- http://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F
- https://github.com/nodejs/node/issues/13435
- https://github.com/nodejs/node/commit/f7620fb96d339f704932f9bb9a0dceb9952df2d4
Embedded domains
- openssl.org
- github.com
- www.unicode.org
- www.midnight-commander.org
- key.name
- entry.name
- this.name
- func.name
- n2.name
- n1.name
- mathiasbynens.be
- tools.ietf.org
- www.ecma-international.org
- process.release.name
- warning.name
- err.name
- en.wikipedia.org
- constructor.name
- value.name
- module.link
- invisible-island.net
- www.3waylabs.com
- fn.name
- opts.info
- www.squid-cache.org
Embedded IP addresses
- 15.1.3.4
- 8.1.2.5
- 8.1.2.4
File paths
- e:\build\nw29_win32\node-webkit\src\third_party\node-nw\src\util-inl.h
- e:\build\nw29_win32\node-webkit\src\third_party\node-nw\src\env-inl.h
- e:\build\nw29_win32\node-webkit\src\third_party\node-nw\src\base_object-inl.h
- e:\build\nw29_win32\node-webkit\src\third_party\node-nw\src\async_wrap.cc
- D:\\
- C:\node_modules
- C:\\orandea\\test\\aaa
- C:\\orandea\\impl\\bbb
- C:\\foo\\bar
- C:\\foo\\bar\\baz
- C:\\
- C:\\foo
- C:\abc`
- C:\`).
- C:\abc\def`
- C:\abc`).
- c:\\
- e:\build\nw29_win32\node-webkit\src\third_party\node-nw\src\async_wrap-inl.h
- e:\build\nw29_win32\node-webkit\src\third_party\node-nw\src\cares_wrap.cc
- e:\build\nw29_win32\node-webkit\src\third_party\node-nw\src\req_wrap-inl.h
- e:\build\nw29_win32\node-webkit\src\third_party\node-nw\src\stream_base-inl.h
- e:\build\nw29_win32\node-webkit\src\third_party\node-nw\src\connection_wrap.cc
- e:\build\nw29_win32\node-webkit\src\third_party\node-nw\src\env.cc
- e:\build\nw29_win32\node-webkit\src\third_party\node-nw\src\aliased_buffer.h
- e:\build\nw29_win32\node-webkit\src\third_party\node-nw\src\fs_event_wrap.cc
More Maldoc samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report