MALICIOUS — a106446fa5f832bf0e1c40dd3a22ac15eb33df1cc0080992fade82f81cae6956
MALICIOUS — a106446fa5f832bf0e1c40dd3a22ac15eb33df1cc0080992fade82f81cae6956 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Injection family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
a106446fa5f832bf0e1c40dd3a22ac15eb33df1cc0080992fade82f81cae6956 - SHA-1:
5dec2cb33fb3ba82575a685e270f6a1b698bc801 - MD5:
80ba918a3b734aad8d3b2132f15e00b1 - imphash:
4d8d0261016c5c05b880950a5b0e704a - ssdeep:
24576:C54GXbLfUH6BdPjO7KX53RTh0tFda3TaewsAj9A7wnNTB:CHbLfUaBdrOO53RTqtiGljGwnNTB - TLSH:
T115577C8D5106E305DAF3DA612C407DEC5872F0992ABA648C5743CDBEA1F3CBBA470169 - Submitted as: a106446fa5f832bf0e1c40dd3a22ac15eb33df1cc0080992fade82f81cae6956
- File type: pe · Size: 1585227 bytes
- Verdict: malicious (99/100) · Family: Injection
Detections (5 of 56 engines)
- YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
- ClamAV (daily): Win.Malware.Genpack-9879226-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
- YARA: Yara-Rules community: YR_AntiDebug_Checks
MITRE ATT&CK
YARA
- Windows_Injection_Api_Combo
Why this verdict
The malicious score of 99/100 is the fusion of 11 weighted signals:
- ClamAV (daily) flagged Win.Malware.Genpack-9879226-0 (rule
Win.Malware.Genpack-9879226-0) - engine signal, weight 0.90, confidence 0.95 - Process injection API combination (rule
Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule
Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70 - YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule
TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.30, confidence 0.70 - Embedded network infrastructure: https://www.autoitscript.com/autoit3/, http://www.autoitscript.com/autoit3/ - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - inject code into another process (rule
inject code into another process) - capa signal, weight 0.12, confidence 0.60 - Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- settings-win.data.microsoft.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- aefd.nelreports.net
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
Embedded URLs
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
- http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
- http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
- http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
- http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
- http://ocsp2.globalsign.com/rootr306
- http://crl.globalsign.com/root-r3.crl0c
- https://www.globalsign.com/repository/0
- http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
- http://ocsp2.globalsign.com/gscodesignsha2g30V
- http://crl.globalsign.com/gscodesignsha2g3.crl0
- https://www.autoitscript.com/autoit3/
- http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
- https://www.globalsign.com/repository/06
- http://crl.globalsign.net/root-r3.crl0
- https://hl2rcv.adobe.com/headlights
- http://crl.verisign.com/tss-ca.crl0
- http://crl.verisign.com/pca3.crl0
- https://www.verisign.com/cps0
- http://logo.verisign.com/vslogo.gif04
- https://www.verisign.com/rpa
- http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
- http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
- https://www.verisign.com/cps0*
Embedded domains
- schemas.microsoft.com
- crl.microsoft.com
- www.microsoft.com
- ocsp2.globalsign.com
- crl.globalsign.com
- www.globalsign.com
- secure.globalsign.com
- www.autoitscript.com
- crl.globalsign.net
- hl2rcv.adobe.com
- crl.verisign.com
- www.verisign.com
- logo.verisign.com
- csc3-2010-crl.verisign.com
- csc3-2010-aia.verisign.com
- office.microsoft.com
- autoitscript.com
- aefd.nelreports.net
Embedded IP addresses
- 20.184.175.19
- 4.230.171.124
- 20.42.179.204
- 48.211.4.16
- 135.232.92.97
- 20.247.185.124
- 20.165.94.63
- 20.184.175.7
- 74.179.77.204
- 162.159.142.9
- 52.110.12.25
- 52.110.12.3
File paths
- C:\btvsts\3621\private\softgrid\shared\include\coinitialize.h
- T:\:d:l:t:
- X:\:`:d:h:l:p:t:x:
- X:\:t:
- T:\:
- C:\btvsts\3481\private\softgrid\shared\include\command_line_cleaner.hpp
- T:\:h:
- P:\Target\x86\ship\click2run\x-none\perfboost.pdb
More Injection samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report