MALICIOUS — 9a4082168c7e8445092c672c98e8b986efaf3f937a7a08f75470cb77c0a6482d

MALICIOUS — 9a4082168c7e8445092c672c98e8b986efaf3f937a7a08f75470cb77c0a6482d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Muldrop family. 5 of 55 detection engines flagged it.

Identification

SHA-256: 9a4082168c7e8445092c672c98e8b986efaf3f937a7a08f75470cb77c0a6482d
SHA-1: 7c38815232e29be16448fb494501802e22be2228
MD5: 046d2f2b50b053fc3b8a6278729e78fa
imphash: b7b1d154ca47a083b83fddc13f54b733
ssdeep: 3072:mGaToM9CyAWN+fMF3Hp4J8CTkMoCtsUE0SHRhMgmlNpuvOFY:mGOo07N+63J4J8OlahYNpuvOF
TLSH: T159418F6F309389BFC31A27807FD028CC13A257DA21575CA6E049D2D9D9A53FBAE90075
Submitted as: 9a4082168c7e8445092c672c98e8b986efaf3f937a7a08f75470cb77c0a6482d
File type: pe · Size: 192648 bytes
Verdict: malicious (96/100) · Family: Muldrop

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Packed.Generic-9967832-0
Microsoft Defender: TrojanDropper:Win32/Muldrop.V!MTB
Emsisoft (Emergency Kit): Gen:Variant.Worm.VB.112
Kaspersky (KVRT): Trojan.Win32.VB.dosb

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Packed.Generic-9967832-0 (rule Win.Packed.Generic-9967832-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Contacted 31 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://purl.org/dc/elements/1.1/, http://www.iec.ch - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

10310 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://ns.adobe.com/xap/1.0/
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/photoshop/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
http://ns.adobe.com/xap/1.0/sType/ResourceRef#
http://www.iec.ch
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787898372&P2=404&P3=2&P4=RJAkxCQbkbZRjsT2Stlr6p7cLkwO7LY4QSi169f0mXEeiwoE9VFcioDeSNdEWYI80ECCx9pMRBdRqLLzb0IRGQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787898487&P2=404&P3=2&P4=k3jk14aEqQ4vKmubk3LSL3%2fCBYBeYMutvzWw7Vq%2fM2t5JeP5ycbR3gOwt6%2brJGCebu9pgLEthF%2fogH%2bADvLXng%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ns.adobe.com
www.w3.org
purl.org
www.iec.ch

Embedded IP addresses

51.104.15.253
52.123.252.245
52.230.60.54
20.42.179.192
4.230.171.124
40.84.97.4
135.233.95.144
135.232.92.97
4.150.223.112
74.179.77.204
20.231.239.246
52.123.129.14
52.123.128.14
135.233.45.222
203.26.79.13
172.178.240.163
162.159.142.9
135.234.160.246
135.233.45.221
52.148.114.188
135.233.45.223
74.178.232.29
135.234.160.245
172.178.240.162
72.145.35.102

File paths

C:\Program

More Muldrop samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report