MALICIOUS — 9d830bd758e711845c30cdf22b9c47e90345464e0bd343aaa5a7a52d87e73f62

MALICIOUS — 9d830bd758e711845c30cdf22b9c47e90345464e0bd343aaa5a7a52d87e73f62 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Blackie family. 7 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 9d830bd758e711845c30cdf22b9c47e90345464e0bd343aaa5a7a52d87e73f62
• SHA-1: ac60d156b2fcefeac4a276887fceaa2bccb315a1
• MD5: d2328c76eba67d4205f377a78270eef0
• imphash: 1cbf379b9b890e14b7cc9db6f1e28ccb
• ssdeep: 12288:3zfday0rUjNFx5tp+AOydeFF3Bz3W7shV7C24Dz:3z1ay0rUR8s0F3tm7s7FSz
• TLSH: T1D453049CCD137646D7F29630DC2F8A6DE47DA48651F8384B4EC6912FA6EA433502C12B
• Submitted as: 9d830bd758e711845c30cdf22b9c47e90345464e0bd343aaa5a7a52d87e73f62
• File type: pe · Size: 1102925 bytes
• Verdict: malicious (98/100) · Family: Blackie

Detections (7 of 53 engines)

• capa (capabilities): capability:collection/keylog
• MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
• ClamAV (daily): Win.Trojan.Blackie-9838328-0
• YARA: JPCERT/CC: JPCERT_Emotet
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Detect It Easy (packer/type): DIE:Microsoft Linker
• LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

• T1056.001

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Blackie-9838328-0 (rule Win.Trojan.Blackie-9838328-0) - engine signal, weight 0.90, confidence 0.95
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
• LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://schemas.datacontract.org/2004/07/Microsoft.Office.LicensingService, http://schemas.datacontract.org/2004/07/Microsoft.Office.LicensingService.Common - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

1 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/CheckMachineStatusRequest
• http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/CheckMachineStatusResponse
• http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetEntitlementsForOlsIdentityRequest
• http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetEntitlementsForOlsIdentityResponse
• http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetEntitlementForMachineKeyRequest
• http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetEntitlementForMachineKeyResponse
• http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetKeyRequest
• http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetKeyResponse
• http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetLicenseRequest
• http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetLicenseResponse
• http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetOlsLicenseRequest
• http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetOlsLicenseResponse
• http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetSessionTokenRequest
• http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetSessionTokenResponse
• http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetTokenRequest
• http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetTokenResponse
• http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetWpkBindingRequest
• http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetWpkBindingResponse
• http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/ReportActivationRequest
• http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/IOlsClient/ReportActivationResponse
• http://schemas.microsoft.com/office/licensingservice/API/2012/01/Api/ServerFault
• http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi
• http://schemas.microsoft.com/2003/10/Serialization/Arrays
• http://schemas.datacontract.org/2004/07/Microsoft.Office.LicensingService
• http://schemas.datacontract.org/2004/07/Microsoft.Office.LicensingService.Common

Embedded domains

• schemas.microsoft.com
• schemas.datacontract.org
• crl.microsoft.com
• www.microsoft.com
• office.microsoft.com
• ols.officeapps.live.com

File paths

• F:\Office\Target\x86\ship\postc2r\x-none\olicenseheartbeat.pdb
• R:\:{:
• X:\:h:l:x:
• d:\w7rtm.public.x86fre\internal\strongnamekeys\fake\windows.snk
• F:\Office\Target\x86\ship\postc2r\x-none\iecontentservice.pdb
• D:\:`:
• T:\:t:x:
• P:\:d:

More Blackie samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report