MALICIOUS — 95fbf89ddaf3eadc09d862cb26739f8c86873670d2a68f96dd2c8ab7c401f754

MALICIOUS — 95fbf89ddaf3eadc09d862cb26739f8c86873670d2a68f96dd2c8ab7c401f754 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the FuBu family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 95fbf89ddaf3eadc09d862cb26739f8c86873670d2a68f96dd2c8ab7c401f754
SHA-1: a9959bfa70a0a4cc377c4816c76ecb6d99f93e35
MD5: 32fac87fbaca19680a1cdb47ad31b229
imphash: 77f13bc24efea5a05601b43cf44d1f1a
ssdeep: 3072:NR2FoCe4wHbSwn1kxNSKou5IfoE1N5XcSR6E9J9Hwkk+cF2Bx:NStwHWwnWNPoGYoEv5XVR6SQ8y2T
TLSH: T1E1444BE901079AA0F1F3EFE758658F4E006670BE11B005C9D3C3D8ADA5E6CC7A592687
Submitted as: 95fbf89ddaf3eadc09d862cb26739f8c86873670d2a68f96dd2c8ab7c401f754
File type: pe · Size: 243712 bytes
Verdict: malicious (99/100) · Family: FuBu

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.FuBu-1
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Shodi
Emsisoft (Emergency Kit): Win32.HLLP.Shodi.A
Kaspersky (KVRT): Virus.Win32.HLLP.Shodi.a

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Trojan.FuBu-1 (rule Win.Trojan.FuBu-1) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Shodi (rule Virus:Win32/Shodi) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.HLLP.Shodi.A (rule Win32.HLLP.Shodi.A) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.HLLP.Shodi.a (rule Virus.Win32.HLLP.Shodi.a) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 1 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
Dropped 12 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

13657 behavior events · 0 ATT&CK techniques · 25 dropped files.

Dropped files

C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe - 1a184f2510cf4018c5d2737c059bfc3ecd815e150360254763c922340e5ee5e9
C:\Program Files\7-Zip\Uninstall.exe - c7677cb4841ff0bcc9b1666e1681d8a1862c998f6ce60698a85df6a622611440
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe - 55e4bbd2dfa4a607b8b12c48231738b558e1f57457692d70bee25c82b3caae72
C:\Program Files\7-Zip\7zFM.exe - b8ef7af3f6fa6c788788760bcd01adab55c43eefd6975ca3c25d4cf07635a859
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.usa - 79671bf6759f645dfeb021e3fcece87abe20b7c6be7ee7bf9c362603056a23ee
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.usa - 7ab807b2f85d1de86a4ddbdc9efffe045c74d75668f9e7428999e863a062507b
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.usa - c82577476eb3c66d0e8e4e1c57c1cb88e453d988bd7cbc41abd5faa1449b30ca
C:\Program Files\Adobe\Acrobat DC\Acrobat\CPInstCU.exe - e6ee26b209052f249a8685982efd23d6e0ff51d690dc6f01d3979d2abcbbb645
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.usa - ac57673f2caf4d337e22c1bddee94aa35db245b1f4701356c73da34731ca1fa0
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe - a879ec6b5183f41afe388d97ddbddef25b7001eddb83193492121224198f3e36
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe - 43ab5b6bc1316d6623e768bf4a0db1310584f2aea1e9f4d2fe0036261d5aa820
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.usa - ae2a000af454e8c936e325f88105268855dd266252d50ce2be3eac66b1e57c7e
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe - 68789cc06618b17201787335ffc1e636d03c0da937d8ba33581102661cc1e1c7
C:\Windows\System32\UsaShohdi.asu - 71ecf147c70fb8b63b1a7559aa179321160e04572ea33becbb9cb6e7b2981640
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe - c6008c60bd3b9ac5cd82943d4a76f2d883edf5b817ad3700be3f46d58c98963b

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

20.42.65.89
52.123.252.218
4.230.171.124
20.247.184.197
4.247.188.233
74.178.240.51
20.165.94.63
4.150.223.100
172.66.2.5
52.110.12.11
52.110.12.19
20.42.72.131
51.132.193.104
72.145.35.96
52.148.114.188
52.110.12.47

More FuBu samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report