MALICIOUS — ab560f606a7e9575bb9264f2ad15b92e849f10ff6f40f3bbdfce6649f384ce48

MALICIOUS — ab560f606a7e9575bb9264f2ad15b92e849f10ff6f40f3bbdfce6649f384ce48 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Pidgeon family. 7 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: ab560f606a7e9575bb9264f2ad15b92e849f10ff6f40f3bbdfce6649f384ce48
• SHA-1: 4abf28239311ab41875b8a7981c7cceac978ac46
• MD5: a59016178a843b411f355b381909aec7
• imphash: a3428e46742eaed60b4a85207b578dd3
• ssdeep: 786432:G8zRUvYbppN30rcRA8ThY4N6tXfM/JYsnlMbEfny16pP:G8tUveppN30rcK8TVN6tXfM/JbWbEfn
• TLSH: T1B5759D9A6603BF42E570ABD0ED141D2DA011F9E87473288C2A46506FEBF31B775844BB
• Submitted as: ab560f606a7e9575bb9264f2ad15b92e849f10ff6f40f3bbdfce6649f384ce48
• File type: pe · Size: 25767936 bytes
• Verdict: malicious (98/100) · Family: Pidgeon

Detections (7 of 52 engines)

• capa (capabilities): capability:collection/keylog
• ClamAV (daily): Win.Packed.Pidgeon-9909600-0
• YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

• T1071.001
• T1057
• T1056.001

Why this verdict

The malicious score of 98/100 is the fusion of 10 weighted signals:

• ClamAV (daily) flagged Win.Packed.Pidgeon-9909600-0 (rule Win.Packed.Pidgeon-9909600-0) - engine signal, weight 0.90, confidence 0.95
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://api.onedrive.com/v1.0/, 6.0.1.0 - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
• http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
• http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
• http://office.microsoft.com
• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
• http://schemas.microsoft.com/outlook/phishingstamp
• http://schemas.microsoft.com/outlook/spoofingstamp
• http://schemas.microsoft.com/exchange/junkemailmovestamp
• http://schemas.microsoft.com/exchange/services/2006/messages
• http://schemas.microsoft.com/sharing/2008
• http://schemas.microsoft.com/exchange/sharing/2008
• https://onedrive.live.com/redir?page=view&resid=1229293068B60FF7!2823&authkey=!AKRI09bQru9GsAc
• http://schemas.microsoft.com/exchange/services/2006/messages/GetUserOofSettings
• http://schemas.microsoft.com/exchange/services/2006/messages/GetUserAvailability
• http://schemas.microsoft.com/exchange/services/2006/messages/GetAppManifests
• http://schemas.microsoft.com/exchange/services/2006/messages/ClientExtensionServices
• http://schemas.microsoft.com/exchange/services/2006/messages/ConvertId
• http://schemas.microsoft.com/exchange/services/2006/messages/GetServiceConfiguration
• http://schemas.microsoft.com/exchange/services/2006/messages/GetMailTips
• http://schemas.microsoft.com/exchange/services/2006/messages/SetUserOofSettings
• http://schemas.microsoft.com/exchange/services/2006/messages/GetFolder
• http://schemas.microsoft.com/exchange/services/2006/messages/UpdateFolder
• http://schemas.microsoft.com/exchange/services/2006/messages/GetSharingMetadata
• http://schemas.microsoft.com/exchange/services/2006/messages/CreateItem

Embedded domains

• autodiscover-s.outlook.com
• autodiscover.hotmail.com
• crl.microsoft.com
• www.microsoft.com
• office.microsoft.com
• schemas.microsoft.com
• ipm.network
• ipm.note.rpmsg.microsoft.voicemail.um.ca
• onedrive.live.com
• go.microsoft.com
• msn.com
• aol.com
• compuserve.com
• api.onedrive.com
• mv.int

Embedded IP addresses

• 6.0.1.0

File paths

• F:\Office\Target\x86\ship\postc2r\x-none\outlook.pdb
• Q:\:t:
• T:\:b:s:y:~:
• V:\:c:j:s:x:~:
• V:\:q:w:}:
• R:\:g:
• X:\:`:d:h:l:p:t:x:
• V:\:r:
• R:\:e:l:
• I:\:}:
• M:\:
• H:\:p:
• C:\:
• W:\:
• K:\:b:h:n:t:~:
• U:\:
• L:\:o:
• W:\:g:l:w:
• X:\:`:d:h:
• D:\:t:
• X:\:t:x:
• X:\:x:
• P:\:h:t:
• X:\:`:d:h:x:
• T:\:l:

More Pidgeon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report