MALICIOUS — a9af701a7a57022dcc0b2148a39c08fe45e9b030428652dc6250a8b6e5e00d53

MALICIOUS — a9af701a7a57022dcc0b2148a39c08fe45e9b030428652dc6250a8b6e5e00d53 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the CryptInject family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: a9af701a7a57022dcc0b2148a39c08fe45e9b030428652dc6250a8b6e5e00d53
• SHA-1: 54ff01597efcd9565c4778a55190b6de0b360f15
• MD5: 9514d4c70aece505ab86b3eb843b4926
• imphash: d03f9f9640231f49326c0a848c6feade
• ssdeep: 98304:KsVXH2gbTfJi2plgyPsVXH2gbTfJi2plgy:KstH2g/JlbstH2g/Jl
• TLSH: T13A6539DE161D3341C635C2243A309AAD80E1B0C5227AF51C0E53D5BB96B792BFD721BA
• Submitted as: a9af701a7a57022dcc0b2148a39c08fe45e9b030428652dc6250a8b6e5e00d53
• File type: pe · Size: 5674049 bytes
• Verdict: malicious (100/100) · Family: CryptInject

Detections (5 of 56 engines)

• ClamAV (daily): Win.Trojan.Agent-448770
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Microsoft Defender: Trojan:Win32/CryptInject!pz
• Emsisoft (Emergency Kit): Gen:Variant.Mikey.127601
• Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

• T1547.001
• T1112
• T1218.011

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Agent-448770 (rule Win.Trojan.Agent-448770) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/CryptInject!pz (rule Trojan:Win32/CryptInject!pz) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Mikey.127601 (rule Gen:Variant.Mikey.127601) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Virus.Win32.Lamer.ks (rule Virus.Win32.Lamer.ks) - engine signal, weight 0.55, confidence 0.85
• 1 behavioral detection(s) across 1 rule(s): LOLBin: rundll32 suspicious invocation [medium] (rule tl-lolbin-rundll32) - dynamic signal, weight 0.40, confidence 0.90
• Contacted 22 external host(s) and 10 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: http://www.pinkworld.com, http://www.youporn.com, http://www.redtube.com - static signal, weight 0.35, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

22662 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• settings-win.data.microsoft.com
• v10.events.data.microsoft.com
• 76.0.240.10.in-addr.arpa.
• 1.0.240.10.in-addr.arpa.
• 232.188.215.172.in-addr.arpa.
• d.1.d.1.c.4.2.1.4.9.5.2.6.e.8.b.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa.
• 251.0.0.224.in-addr.arpa.
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• 224.188.247.4.in-addr.arpa.
• 11.196.210.85.in-addr.arpa.
• 108.223.150.4.in-addr.arpa.
• nexusrules.officeapps.live.com
• 77.109.171.150.in-addr.arpa.

Embedded URLs

• http://schemas.microsoft.com/windows/2014/11/printing/generatedkeywords
• http://schemas.microsoft.com/windows/2013/05/printing/printschemakeywordsv11
• http://schemas.microsoft.com/windows/2003/08/printing/printschemakeywords
• http://www.w3.org/2001/XMLSchema
• http://schemas.microsoft.com/2002/print/gdl/1.0
• http://www.w3.org/2001/XMLSchema-instance
• http://schemas.microsoft.com/windows/2003/08/printing/printschemakeywordsW
• http://www.pinkworld.com
• http://www.youporn.com
• http://www.redtube.com
• http://www.assparade.com/
• http://www.freeav.com/
• http://www.antispyware.com/
• http://www.antivirus.com/
• http://schemas.microsoft.com/windows/2003/08/printing/printschemaframework
• http://schemas.microsoft.com/windows/2013/12/printing/printschemaframework2
• http://schemas.microsoft.com/windows/2013/12/printing/printschemakeywordsv12
• http://schemas.microsoft.com/windows/2005/03/printing/bidi
• http://schemas.microsoft.com/windows/2011/08/printing/devmodemap
• http://schemas.microsoft.com/2003/print/asyncui/v1/request
• http://schemas.microsoft.com/windows/2011/08/printing/queueproperties
• http://schemas.microsoft.com/windows/printing/oemdriverpt
• http://www.w3.org/XML/1998/namespace
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Embedded domains

• schemas.microsoft.com
• www.w3.org
• www.pinkworld.com
• www.youporn.com
• www.redtube.com
• www.assparade.com
• www.freeav.com
• www.antispyware.com
• www.antivirus.com
• tartalmazhat.ua
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 172.215.188.225
• 51.116.246.105
• 172.172.255.218
• 4.150.223.109
• 20.184.175.23
• 40.84.85.40
• 40.84.97.4
• 20.184.175.11
• 4.247.188.224
• 172.215.188.232
• 85.210.196.11
• 203.26.79.13
• 4.150.223.108
• 52.123.252.222
• 40.79.163.155
• 162.159.142.9
• 40.79.163.154
• 20.184.175.16
• 20.184.175.12
• 72.145.35.97
• 52.148.114.188
• 72.145.35.106
• 104.208.16.94
• 4.150.223.107
• 48.211.4.16

File paths

• X:\:`:d:h:l:p:t:x:
• X:\:`:d:h:t:
• P:\:h:t:
• X:\:d:h:p:t:
• X:\:`:d:l:p:t:x:
• X:\:`:h:l:p:t:x:
• L:\:l:
• C:\:l:
• T:\:d:l:t:
• T:\:l:x:
• P:\:d:
• X:\:`:h:l:p:t:
• H:\:
• C:\Windows\system32\d3dx10_36.dll
• C:\Program
• C:\Progr

More CryptInject samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report