MALICIOUS — 9e2a5e72d502377bfa41f72aed4aadfd2bede4ad2ba1df003487712d8ee2e74b

MALICIOUS — 9e2a5e72d502377bfa41f72aed4aadfd2bede4ad2ba1df003487712d8ee2e74b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Viking family. 7 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

• SHA-256: 9e2a5e72d502377bfa41f72aed4aadfd2bede4ad2ba1df003487712d8ee2e74b
• SHA-1: 72f27591c2acaa58b814c886bc9bba317af58b7e
• MD5: e5cdd88a1f8fc5dcdac3cb5447e683d1
• imphash: 31d1c48ee7d8e07a5706e963146db875
• ssdeep: 6144:BtfDwsjPThT5zL2gEmsN6R4iibkWtTuFfoIT:B5hVUmsNxiibkC+Qg
• TLSH: T17A456B9D42166789EEB6C7206C406E1E50A2F0AE917D3C4D4A93C03FF7E785FEA20159
• Submitted as: 9e2a5e72d502377bfa41f72aed4aadfd2bede4ad2ba1df003487712d8ee2e74b
• File type: pe · Size: 278528 bytes
• Verdict: malicious (100/100) · Family: Viking

Detections (7 of 56 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• ClamAV (daily): Win.Trojan.Delf-1564
• YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Virus:Win32/Viking.MS
• Emsisoft (Emergency Kit): Trojan.Agent.FPMF
• Kaspersky (KVRT): Virus.Win32.Lamer.xe

MITRE ATT&CK

• T1057
• T1055
• T1543.003
• T1112
• T1518.001
• T1105

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• Dropped a malicious payload (GameThief): virDll.dll - dynamic signal, weight 0.62, confidence 0.90
• Microsoft Defender flagged Virus:Win32/Viking.MS (rule Virus:Win32/Viking.MS) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Agent.FPMF (rule Trojan.Agent.FPMF) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Virus.Win32.Lamer.xe (rule Virus.Win32.Lamer.xe) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.55, confidence 0.70
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• Contacted 38 external host(s) and 12 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://www.rarlab.com - static signal, weight 0.35, confidence 0.60
• 1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

22099 behavior events · 2 ATT&CK techniques · 103 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• 76.0.240.10.in-addr.arpa.
• 1.0.240.10.in-addr.arpa.
• 251.0.0.224.in-addr.arpa.
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• ecs.office.com
• update.googleapis.com
• desktop-hsgcbep
• self.events.data.microsoft.com
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 1.0.240.10.in-addr.arpa
• 251.0.0.224.in-addr.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa

Dropped files

• C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe - 88ff5131b74f490a073730b5745d25b077cc6a80178b4b522611268b9baab805
• C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe - cf73fd67ffa6060fcf8b9778f96f20353fb59f14eaa0d57a75d176b84d54aab8
• C:\Program Files\LibreOffice\program\sbase.exe - 5796a6c15f8064046acb9be2ce67c15941c21015bc1734418403aebc57dd7d1e
• C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe - 741524d61c3751ddbb30d36e3e6621fcda18f77f7d80e304de0a7fc9360a74d4
• C:\Program Files\LibreOffice\program\mar.exe - b95553d662d3a9f6fb25e75831971785717a09a7df62683c7e970bc7610ea35d
• bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
• C:\Program Files\LibreOffice\program\soffice_safe.exe - 0f2eed687b03b24f254b9182f66054cc4f3cf48fe2aa0e4db157b990591bf928
• C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaw.exe - ed2b030ea79f6d430ae4f30ae09f12cdb7b14584794ec14e599663a7bbd2a96c
• C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\w64.exe - a1083572a8f9f7a3c07ed577f658388ff910dd39873cb970acd0abbd513e1fe9
• C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe - 06dc22fa5f8e9c64d51dff751acbc48e02c450595f82c4467da1d5835ee5f9c8
• C:\Program Files\Google\Chrome\Application\chrome_proxy.exe - 74697268d8aa5e082b2a7a2327d79bd1999a36efc6370c3240ad1c1023d857f8
• C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe - cb729c721da4b481ca38ea07f6e2b5df7e5ae0f5e2a79a144a5e829026141428
• C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\MenuCoreApp\AcroShareTarget.exe - 4b96015a76a08c84c8b25da37a97bafdc150593e38687ca8c158e30958ed2063
• C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - c9838996c45d249016b13521a46a4d4f3d08e6481aecd07133d3c1bcd8cb60a5
• C:\Program Files\LibreOffice\program\gpgme-w32spawn.exe - 95e87187c4e6034549981a5814cbd055a1c94f5c95c9b86f67a56cd96da0e31b

Embedded URLs

• http://schemas.microsoft.com/SMI/2005/WindowsSettings
• http://www.rarlab.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• schemas.microsoft.com
• www.rarlab.com
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 192.168.0.30
• 192.168.8.1
• 72.145.35.109
• 52.123.252.193
• 57.154.63.210
• 4.150.223.111
• 13.89.179.15
• 203.26.79.13
• 74.178.76.44
• 20.42.65.89
• 104.46.162.231
• 92.223.78.30
• 172.178.240.163
• 72.145.35.103
• 172.178.240.162
• 4.150.223.105
• 52.148.114.188
• 52.168.117.175
• 20.42.65.85
• 172.172.255.217
• 172.215.188.232
• 52.123.252.212
• 40.84.97.4
• 20.42.179.192
• 52.110.12.38

File paths

• D:\Projects\WinRAR\uninstall\build\uninstall32\Release\uninstall.pdb
• T:\:d:l:t:

More Viking samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report