MALICIOUS — 959072d8aadd4f2b80a770af048809303b469e973f01405b231cb39c76656369

MALICIOUS — 959072d8aadd4f2b80a770af048809303b469e973f01405b231cb39c76656369 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AutoRun family. 9 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 959072d8aadd4f2b80a770af048809303b469e973f01405b231cb39c76656369
SHA-1: 74f95e71a730d4ddafa76d61484f30a9067e4b6f
MD5: 410834c005c47bfc2f991a867c1a195f
imphash: 01392ca861cf87b8d28ad9ea90016bb4
ssdeep: 24576:vcDorPUncDorPUQloA6tTYWcDorPUncDorPUQloA6tTYS:nr6r1lj6tTBr6r1lj6tTj
TLSH: T1A258BF9D43263213E2F7DD50A88C8DDC4012B4AA70BA4B5D5303C12FB6F6977E9B2295
Submitted as: 959072d8aadd4f2b80a770af048809303b469e973f01405b231cb39c76656369
File type: pe · Size: 1665613 bytes
Verdict: malicious (100/100) · Family: AutoRun

Detections (9 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): ASPack
ClamAV (daily): Win.Worm.Vindor-9886047-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Worm:Win32/AutoRun!pz
Emsisoft (Emergency Kit): Gen:Heur.Mint.Autorunner.1
Trellix Stinger (McAfee): W32/Worm-GBW!410834C005C4
Kaspersky (KVRT): Worm.Win32.AutoRun.vx

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Worm.Vindor-9886047-0 (rule Win.Worm.Vindor-9886047-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Worm:Win32/AutoRun!pz (rule Worm:Win32/AutoRun!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Mint.Autorunner.1 (rule Gen:Heur.Mint.Autorunner.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/Worm-GBW!410834C005C4 (rule W32/Worm-GBW!410834C005C4) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.AutoRun.vx (rule Worm.Win32.AutoRun.vx) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged ASPack (rule ASPack) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
Packing/obfuscation: ASPack, high-entropy-sections:.text, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 22 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

26501 behavior events · 1 ATT&CK techniques · 23 dropped files.

Dropped files

C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\MenuCoreApp\AcroShareTarget.exe - 7c0d88320230a6890c4456908f3a1ee34519e5b502ee3ffbebc5e3080db0cb05
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - 377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\7-Zip\7zG.exe - 7b1450e0e2f4a32dacbc1c9aa7f69c1b66c68edb5f4a24303d154f11ca7a72e4
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe - 6a78dba30ca10f3addef5b1683bd7bc97e98ce03c9e6ae7056845ee1b70b7d10
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe - cf03a691486e69448d21d8f402720e443521c62cdde7585822792fca84a77556
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe - 77256c199da68d3fc7a11c7fb74db8b908ea3d3df92cacd2a739ac2f77c1efa4
C:\Program Files\Adobe\Acrobat DC\Acrobat\OSSLLibs\AdobeFips.exe - e0a6b7eb1b33d7ef42f36b0454fc833b405689abbf5689795a28c02f4249d734
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe - 63156ae4b122e6f9584581782b64327bfbf60d31ae39de283fd5beeea5aa6746
C:\Program Files\7-Zip\7z.exe - 634d38c0c414178e2f35de5cc0fb29aa082eec227e630c4481e1af7694980ac9
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe - 7f65f5ae08cc5a15df0c7d70e3fc3ba5b4f083dcbdc02170423867257ffaf076
C:\Program Files\7-Zip\7z.exe - 674230c96bc5bd60128a2a790489fbe98a4d4fbcfdecb877af5f530dd1773bf4
C:\Program Files\7-Zip\7zG.exe - 7b5eda73c21960c451ea3148900b28cdbac7180e43047fbc944028096e497c08
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe - da6d0544ee3a6b75f3c5c545213b10ec93a15d5213e5232e7e224a29ecb91d6b

Embedded URLs

https://www.digicert.com/CPS0
http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
http://www.digicert.com/ssl-cps-repository.htm0
http://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
http://crl3.digicert.com/sha2-assured-cs-g1.crl05
http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl3.digicert.com
crl4.digicert.com
www.digicert.com
cacerts.digicert.com
www.microsoft.com
crl.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

51.132.193.104
52.123.252.215
52.230.59.222
20.247.184.197
40.84.85.40
4.230.171.124
74.178.240.51
4.150.223.105
74.178.76.128
104.18.33.89
4.150.223.99
20.184.175.4
20.50.201.205
85.210.193.152
52.148.114.188
92.223.78.30
72.145.35.108
52.110.12.18
52.110.12.11

File paths

c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\jdk\objs\pack200_objs\pack200.pdb
c:\jenkins\workspace\8-2-build-windows-i586-cygwin\jdk8u281\880\build\windows-i586\jdk\objs\java_objs\java.pdb
X:\:`:
T:\:d:l:t:

More AutoRun samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report