MALICIOUS — 97f2424257da5413b8fb11a18264850e61ebe819e522357c1d2d16af1110cfe3

MALICIOUS — 97f2424257da5413b8fb11a18264850e61ebe819e522357c1d2d16af1110cfe3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Bulz family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 97f2424257da5413b8fb11a18264850e61ebe819e522357c1d2d16af1110cfe3
SHA-1: 2961b8d6b9427362b2941a3969e98262647439e0
MD5: 63f16968394b98c11f9c90bd50f827ba
imphash: d3bc783da925e7c48a8f1e0e2c6c25b1
ssdeep: 24576:k/HEp6uuHk3wl9Xq8/Lq6tb8tlGObtX+9L5EK/EHdjV:SEp6dks9XqNSwtIOkL2KMj
TLSH: T12D599D981A01E175CA7B57203F212C6C9A2EEFA621FE1FCC13D7612EF9E21275870564
Submitted as: 97f2424257da5413b8fb11a18264850e61ebe819e522357c1d2d16af1110cfe3
File type: pe · Size: 1884160 bytes
Verdict: malicious (99/100) · Family: Bulz

Detections (5 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Bulz-9885565-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Bulz-9885565-0 (rule Win.Malware.Bulz-9885565-0) - engine signal, weight 0.90, confidence 0.95
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://bestswim.officeisp.net/Shared%20Documents/BESTmeetentryform.doc, http://www.zelphish.com/alki%20pipeline.pdf, http://www.eyuyan.com - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://bestswim.officeisp.net/Shared%20Documents/BESTmeetentryform.doc
http://www.zelphish.com/alki%20pipeline.pdf
http://www.eyuyan.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com
bestswim.officeisp.net
www.zelphish.com
www.eyuyan.com

Embedded IP addresses

6.0.1.0
20.42.73.31
52.123.252.202
4.230.171.124
57.155.104.224
52.230.59.222
74.178.76.54
20.42.73.30
74.178.240.61
51.105.71.136
20.184.175.7
52.123.252.194
92.223.78.30
20.42.65.85
52.110.12.24
52.110.12.15

File paths

F:\Office\Target\x86\ship\postc2r\x-none\msouc.pdb
X:\:d:
H:\:`:p:t:x:
X:\:l:p:

More Bulz samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report