MALICIOUS — 9f5d92122715f0216b7bc7a9026572deb1cf19ac32b136fce3ffe88fdde2a08c

MALICIOUS — 9f5d92122715f0216b7bc7a9026572deb1cf19ac32b136fce3ffe88fdde2a08c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Maldoc family. 5 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 9f5d92122715f0216b7bc7a9026572deb1cf19ac32b136fce3ffe88fdde2a08c
SHA-1: 0618033918b8017a5c4d9500583d4d8805434fe0
MD5: 08738605c8626fe15915a47b6db20a10
imphash: 6261f394332baab962003b7d36f650f6
ssdeep: 12288:Di8C+lPYflslyElQxDODk2Np3b7giRijCdYHhgCkNscyzcgwD2Tw5icyE4h:Dc+lPYflslynUD5Zfg294hRkNsXE4j
TLSH: T11C556A2995A137E0CAF9EA220D0388ED540F64465929F0DF4ED7E16BF9F78370820697
Submitted as: 9f5d92122715f0216b7bc7a9026572deb1cf19ac32b136fce3ffe88fdde2a08c
File type: pe · Size: 1273856 bytes
Verdict: malicious (98/100) · Family: Maldoc

Detections (5 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Generic-9886878-0
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Generic-9886878-0 (rule Win.Malware.Generic-9886878-0) - engine signal, weight 0.90, confidence 0.95
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 21 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.eyuyan.com - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.eyuyan.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787942464&P2=404&P3=2&P4=X%2bjXdHRV7r5L1gl9JUMn%2fOK0hq4up14Oq2M903JJK7bpZdLTjkH%2ftL0998IHtQBnRj99X9mabCuzxxgeeRC2kg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com
www.eyuyan.com

Embedded IP addresses

20.42.65.93
57.155.104.224
4.144.132.114
4.230.171.124
48.211.4.16
74.178.76.128
52.182.141.63
135.233.95.135
20.236.44.162
52.123.129.14
52.123.128.14
40.104.4.2
162.159.142.9
4.207.44.74
74.178.232.29
203.26.79.13
172.178.240.163
72.145.35.99
52.148.114.188
52.110.12.47
52.110.12.15

File paths

F:\Office\Target\x64\ship\postc2r\x-none\msoxmled.pdb

More Maldoc samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report