MALICIOUS — 95b5cadac1b32090876c70f9790acd42bf8d5d21cf9db80362eafbb8030c98a2

MALICIOUS — 95b5cadac1b32090876c70f9790acd42bf8d5d21cf9db80362eafbb8030c98a2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Autorun family. 7 of 56 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: 95b5cadac1b32090876c70f9790acd42bf8d5d21cf9db80362eafbb8030c98a2
SHA-1: 7cb4484bee6b14cc46b39057624c38b9a53bf983
MD5: 11f1526247e6ec51dcb774a4168208d5
imphash: ba57cff438d021f24d6f677ef19046de
ssdeep: 12288:VbKsikEy19X6aTCwEy19Xz1aTC1V5KV5izrqFkbH:hKsikt116aTCwt11z1aTCxIifqFuH
TLSH: T189497D69025B3163E2F7CD10640D8F9D8013F8A870351B6DD20BE55CA3F96B7AAF6894
Submitted as: 95b5cadac1b32090876c70f9790acd42bf8d5d21cf9db80362eafbb8030c98a2
File type: pe · Size: 411878 bytes
Verdict: malicious (100/100) · Family: Autorun

Detections (7 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Worm.Autorun-1250
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
Microsoft Defender: Trojan:Win32/Ausiv!pz
Emsisoft (Emergency Kit): Backdoor.Hupigon.AAEA
Kaspersky (KVRT): Worm.Win32.AutoRun.nf

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 21 weighted signals:

ClamAV (daily) flagged Win.Worm.Autorun-1250 (rule Win.Worm.Autorun-1250) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.70, confidence 0.70
Microsoft Defender flagged Trojan:Win32/Ausiv!pz (rule Trojan:Win32/Ausiv!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Backdoor.Hupigon.AAEA (rule Backdoor.Hupigon.AAEA) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.AutoRun.nf (rule Worm.Win32.AutoRun.nf) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 55 external host(s) and 24 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.30, confidence 0.70
Embedded network infrastructure: http://www.2651china.cn/2651/1.txt, http://www.2651china.cn/2651/wm.htm, http://www.gnu.org/software/coreutils/ - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 33 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

16409 behavior events · 3 ATT&CK techniques · 35 dropped files.

Dropped files

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe - d95145b0f1d8a3f7e8295cab6dc1850be54202d1415c21d8b2d2cd48f4892c29
C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe - dfb294f44bc0a37d3e8fa2f4e4fb623e9c7c1d99b2a7bc099ac4ce919ec12977
C:\Sysmon64.exe - 83f397960f49fce5e2c16a38eb664576bdf3f9a83ebdfd0c6adbf215b07ab0f3
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe - 7db8055965864fdef823b6662b4ce5cfde6eef7b3b5621973c946768805b7678
C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe - 62a34056adac9d7e675b408629eddbbfcf2fb40c70523e9149e6881c67a3703e
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe - f9ee240c8f636dd51d01012c12dee102fc955d1ecdf80d1a310281935dc82867
C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe - b05374d1105bcb9f3814f07183c9b4b4c816ec9ca69b3a3219a1fe34103e2a89
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe - 8755d88c5e12a5528c02864ed5a4c2672a9e7f475ae2bbd8e9ff69a135f5ee67
C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe - 38b30ade0e78c0b06162b172631e8a395f7726724aa26386d18c9be89306e297
C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe - b048b43882b272a2006976dcf5be289faed0477e65fe278fb844e7ee817650a0
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe - d11880ae9770fccb916fded871532d9ac9ed981e88babf2f3403d456991d87ab
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe - 3931b2005fbc11957b7bfa7e1ade4c7764253f28b02bcdd934937e8bbb55a5b5
C:\Program Files\Adobe\Acrobat DC\Acrobat\OSSLLibs\AdobeFips.exe - 99bac7c4c88868bd6f0ebe51423b7ca70ec8f58df2b86c34f8faf3942879b2ac
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - 32e36097f1d904c30d40c28460ddc2ab45e45306dcd44748ba76355cd93ff129
C:\Program Files\7-Zip\7zFM.exe - 00e3ca24fc5b876b97ecd868583d02083a2c5cfaa4b39cb67f6bc9d9d09e3d94

Embedded URLs

http://www.2651china.cn/2651/1.txt
http://www.2651china.cn/2651/wm.htm
http://www.gnu.org/software/coreutils/
http://translationproject.org/team/
http://gnu.org/licenses/gpl.html
http://www.gnu.org/gethelp/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.2651china.cn
www.gnu.org
translationproject.org
gnu.org
cygwin.com
debian.org
sb.scorecardresearch.com
btloader.com
img-s.msn.cn
scripts.mf.webcontentassessor.com
cdn.btloader.com
ad-delivery.net
m.adnxs.com
ab.dns-finder.com
cdn.api.btloader.com
res.public.onecdn.static.microsoft
ib.adnxs.com
shftr.adnxs.net
b1t-tokdc1.outbrain.com
imp.control.kochava.com
msft-ssp-apac.adnxs.com
ecn.dev.virtualearth.net
acdn.adnxs.com
api.btloader.com
static.teads.tv

Embedded IP addresses

2.7.6.1
52.168.117.170
4.230.171.124
85.210.193.152
4.247.188.224
20.247.185.124
74.178.76.128
135.232.92.97
20.42.72.131
104.18.33.89
20.42.73.25
4.247.188.233
52.110.12.18
52.110.12.53
172.178.240.161
4.243.157.98
15.197.196.10
4.243.157.107
23.90.68.53
110.44.7.36
18.244.214.42
98.91.111.39
35.75.254.76
34.149.43.113
4.243.157.56

File paths

T:\:p:~:

More Autorun samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report