MALICIOUS — 9df4cdeeff04092cd8f726231fc4a441b87723a347278bff7cae52315383cd78

MALICIOUS — 9df4cdeeff04092cd8f726231fc4a441b87723a347278bff7cae52315383cd78 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Pidgeon family. 7 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 9df4cdeeff04092cd8f726231fc4a441b87723a347278bff7cae52315383cd78
SHA-1: d43ce0757a064804985a8708b8bdb8c0aeaf8caf
MD5: 13707704438ec7a0b5a7c5c959fa08fa
imphash: 1bc18422ce3ff8b1f4b00d97efa67a6b
ssdeep: 49152:8CIabjKoh9WZrG7v9MPeOD7ljyakOElMaFLk8mUi6AjW/MUSdGRf3/bhbuRKwpB:pIabjKoh9WS9uenak74jxAZbH
TLSH: T1E1608BCD511BA302E2F69B541C206E9C507AB0E9617E388E8EC3E4AF65F6C37556009F
Submitted as: 9df4cdeeff04092cd8f726231fc4a441b87723a347278bff7cae52315383cd78
File type: pe · Size: 3693103 bytes
Verdict: malicious (100/100) · Family: Pidgeon

Detections (7 of 55 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Packed.Pidgeon-9909600-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Microsoft Defender: Trojan:Win32/Vindor!pz

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Packed.Pidgeon-9909600-0 (rule Win.Packed.Pidgeon-9909600-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 19 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.symauth.com/cps0, http://www.symauth.com/rpa04, http://www.symauth.com/cps09 - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/CSPCA.crt0
http://www.microsoft.com/pki/certs/tspca.crt0
http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com/0
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.digicert.com/ssl-cps-repository.htm0
http://crl3.digicert.com/assured-cs-2011a.crl03
http://crl4.digicert.com/assured-cs-2011a.crl0
http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
http://crl.thawte.com/ThawteTimestampingCA.crl0
http://crl.verisign.com/pca3.crl0
https://www.verisign.com/cps0
http://logo.verisign.com/vslogo.gif04
http://www.symauth.com/cps0
http://www.symauth.com/rpa04
http://crl.verisign.com/pca3-g5.crl0
http://www.symauth.com/cps09
http://evcs-crl.ws.symantec.com/evcs.crl0
http://evcs-aia.ws.symantec.com/evcs.cer0
http://schemas.microsoft.com/SMI/2005/WindowsSettings

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com
www.digicert.com
cacerts.digicert.com
crl3.digicert.com
crl4.digicert.com
ts-aia.ws.symantec.com
ts-crl.ws.symantec.com
crl.thawte.com
crl.verisign.com
www.verisign.com
logo.verisign.com
www.symauth.com
evcs-crl.ws.symantec.com
evcs-aia.ws.symantec.com
schemas.microsoft.com

Embedded IP addresses

11.0.07.79
4.150.223.97
4.247.188.233
4.230.171.124
20.247.184.197
20.165.94.63
20.165.94.54
20.42.73.31
135.233.95.144
20.184.175.3
20.76.201.171
52.123.129.14
52.123.128.14
40.99.133.226
162.159.142.9
135.233.45.222
52.148.114.188
92.223.78.30
52.110.12.46
52.110.12.15

Registry keys

HKEY_CURRENT_USER\Software\Adobe\Adobe
HKEY_CURRENT_USER\Software\Adobe\Acrobat

File paths

c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\obj-firefox\toolkit\crashreporter\client\crashreporter.pdb
X:\:@=D=H=L=P=T=X=\=`=d=h=l=p=t=x=
P:\:
X:\:`:d:h:l:p:t:x:
c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\obj-firefox\ipc\app\plugin-container.pdb
T:\:d:l:t:
D:\:`:
C:\btvsts\3481\private\softgrid\shared\include\command_line_cleaner.hpp
T:\:h:
F:\Office\Target\x86\ship\postc2r\x-none\orgchart.pdb
L:\:o:z:
V:\:r:x:
N:\:i:f;~;
V:\:b:h:n:t:z:
F:\Office\Target\x86\ship\postc2r\x-none\protocolhandler.pdb
T:\:h:p:
T:\:l:
c:\\path\to\somefile.exe

More Pidgeon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report