MALICIOUS — 90463e5482491e0bc335502e3ad46d727fcf47b787fac3e5a6ff5be13f7f566c

MALICIOUS — 90463e5482491e0bc335502e3ad46d727fcf47b787fac3e5a6ff5be13f7f566c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the ShellObject family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 90463e5482491e0bc335502e3ad46d727fcf47b787fac3e5a6ff5be13f7f566c
SHA-1: c3be5ee4cd172e3e01e9285d0f7d7c36566567f1
MD5: df31edad9a3c467a06a8e779b579b66f
imphash: 26babd76bbb7f9c516a338b0601b4c9f
ssdeep: 6144:kxJv5u6b7zzzPCU3FlseRSnTylKeyDZYzIWx+7C0eRSnTy:Av46b7zzzPCU3FH0noCdYzIWxOg0n
TLSH: T18D4649892A388B93DE4F444688D9285C4B62A35BB8ADF38175C77E3553F7D0F5080E68
Submitted as: 90463e5482491e0bc335502e3ad46d727fcf47b787fac3e5a6ff5be13f7f566c
File type: pe · Size: 296960 bytes
Verdict: malicious (99/100) · Family: ShellObject

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Trojan.Crypted-29
Microsoft Defender: TrojanDownloader:Win32/Berbew!pz
Emsisoft (Emergency Kit): Gen:Trojan.ShellObject.suZ@amBwvTb
Kaspersky (KVRT): Backdoor.Win32.Padodor.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Trojan.Crypted-29 (rule Win.Trojan.Crypted-29) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged TrojanDownloader:Win32/Berbew!pz (rule TrojanDownloader:Win32/Berbew!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Trojan.ShellObject.suZ@amBwvTb (rule Gen:Trojan.ShellObject.suZ@amBwvTb) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Padodor.gen (rule Backdoor.Win32.Padodor.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Dropped 116 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

3640 behavior events · 1 ATT&CK techniques · 116 dropped files.

Dropped files

C:\Windows\System32\Pmcaln32.exe - afd481fde2023fbe22a2f3f71df7380d68a5c28e601955c4fb3f2f29dc451232
C:\Windows\System32\Pdbojk32.exe - 339030be526133e5dfdd6864daf8b5faae26ad300abcae0bfb8461add7608866
C:\Windows\System32\Dbipcb32.exe - 60ffc1ddb53a50988f3657fc9b0a2df68db36e211fff2547df752d4d135ff035
C:\Windows\System32\Qkgphnng.exe - 38e366e4d9d6eaf04f1b7c315343d6346ea96cdaadd9c3bc667cbe3360b89556
C:\Windows\System32\Holdpa32.dll - 902308416b8c199603144148a7ddedeb1cfa8e4d23d9ec56b977290a0e12cd0e
C:\Windows\System32\Fdjhgo32.dll - 94aece95648567ed3d9ba7a2138bd339040934d17f2f84ca53d4804281d6aa88
C:\Windows\System32\Dgqbfpma.dll - 59da4b86066db791fad4edbe3454d5abaa6084332276688fcb27edeec4ede09c
C:\Windows\System32\Jagpho32.exe - 9f18a18d104733aee24a689d05255419122323c6959319f0756e4de9fe0d4abd
C:\Windows\System32\Kmpfhi32.exe - 2a728e6cfc40647a01e5ba9edc815a4cd49e9c380c5bcce68edeba777aec52d1
C:\Windows\System32\Ohaede32.exe - 1372c42936846d33ce3422e576258ee6dfdc5eac58b89fe4fb88371010f860ff
C:\Windows\System32\Pggaff32.exe - 9e160c0576fcd83de6092b640da102975e345170fedd92ca648b9bf5d71a71ef
C:\Windows\System32\Lahjmj32.dll - 21e97d3fa2fc3f81c32cce319b3391708b84692da68cea9db1dcf22d8e75917a
C:\Windows\System32\Iagfaalc.exe - 20fff4354b589bd629150674ba79681266f61d583ba6337effb7a2ecff662da5
C:\Windows\System32\Kkkohhbo.dll - c30673c50efc7467c237f5b0b7fd38600bc9f5628bf45a47bff7b39ca728eb90
C:\Windows\System32\Klaicb32.dll - f036a2577ce897b8a97caa05841587e1bd79dba732b5000bc4b9de4080a32f5a

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.2
20.247.184.142
52.123.252.242
4.230.171.124
172.215.188.225
20.184.175.17
4.150.223.98
48.211.4.16
172.178.240.162
72.145.35.99
52.148.114.188
52.110.12.1
52.110.12.53

More ShellObject samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report