MALICIOUS — 9bb20721720042de8067fe01edaaf9b2975d7d262955a999811d2055e23a75ed

MALICIOUS — 9bb20721720042de8067fe01edaaf9b2975d7d262955a999811d2055e23a75ed is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Cerbu family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 9bb20721720042de8067fe01edaaf9b2975d7d262955a999811d2055e23a75ed
SHA-1: 91f4d5cf540a628309e25a7662c7aad221e986ef
MD5: 15ca32c3bd4ca30f1fe0172cf54273a2
imphash: 5ab4a5fa77f7cef108828b3d18928877
ssdeep: 1536:dY3oRXGDBmCsUyE7r5ky252/JVI8AP56Rmh2oRO356D3XEBEf2b:dYsiky25IVIb56Qh2o0p6D3XEWf2b
TLSH: T1FB3B2AB8425BA332F1FAED756C218CDC8814B0AC5172616C9A07DA3FD0E5537D9B62E0
Submitted as: 9bb20721720042de8067fe01edaaf9b2975d7d262955a999811d2055e23a75ed
File type: pe · Size: 109368 bytes
Verdict: malicious (98/100) · Family: Cerbu

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Cerbu-9886333-0
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: Yara-Rules community: YR_AntiDebug_Checks
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

T1071.001

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Cerbu-9886333-0 (rule Win.Malware.Cerbu-9886333-0) - engine signal, weight 0.90, confidence 0.95
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.70, confidence 0.70
Contacted 22 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787949658&P2=404&P3=2&P4=IxWBLHzDPKzK%2b%2bO%2fvTE%2bhdLgcJIqwT6lU1DxDlDz2t66M9ECNAfu28yrlqp1WfxJcyjQBg1IvIsI27%2bul6YVrQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com

Embedded IP addresses

4.207.44.65
52.123.252.212
4.230.171.124
40.84.97.4
4.144.132.114
74.178.240.61
4.150.223.100
52.123.252.192
74.178.240.51
74.179.77.204
52.123.129.14
20.76.201.171
52.123.128.14
40.104.4.2
4.150.223.104
135.234.160.244
203.26.79.13
72.145.35.102
74.178.76.44
52.148.114.188
52.110.12.32
52.110.12.55

File paths

F:\Office\Target\x64\ship\postc2r\x-none\msohtmed.pdb
C:\Program

More Cerbu samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report