MALICIOUS — afc73bc84ed973f9839b4bd2c988ccf3b41deba428f5ef954cc8ed5352cd7fc6
MALICIOUS — afc73bc84ed973f9839b4bd2c988ccf3b41deba428f5ef954cc8ed5352cd7fc6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Vindor family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
afc73bc84ed973f9839b4bd2c988ccf3b41deba428f5ef954cc8ed5352cd7fc6 - SHA-1:
83dd5f078007bd51eaa2546381c8fb2fbfd312ff - MD5:
64dc15f446cf588638ee12f03826fbfc - imphash:
500ff1538958cc73738bf0c262a1773f - ssdeep:
196608:FAwfUefUefUufURn9Tin9TufUDn9Tin9Tin9Ton9Ta:NFFNacogccm4 - TLSH:
T16D69D0C9512111F2DA92CEA80DC03D1E1851F31669FC3DCC4691592E36EA2F7B48F7AA - Submitted as: afc73bc84ed973f9839b4bd2c988ccf3b41deba428f5ef954cc8ed5352cd7fc6
- File type: pe · Size: 8632339 bytes
- Verdict: malicious (100/100) · Family: Vindor
Detections (6 of 56 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.dafixer,.dafixer,.dafixer,.dafixer,.dafixer
- ClamAV (daily): Win.Virus.Delf-9955432-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Detect It Easy (packer/type): DIE:Turbo Linker
- Microsoft Defender: Trojan:Win32/Vindor!pz
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 12 weighted signals:
- ClamAV (daily) flagged Win.Virus.Delf-9955432-0 (rule
Win.Virus.Delf-9955432-0) - engine signal, weight 0.90, confidence 0.95 - Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in tsk_2ba73c370c (pid 8848) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Microsoft Defender flagged Trojan:Win32/Vindor!pz (rule
Trojan:Win32/Vindor!pz) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Contacted 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule
DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.dafixer,.dafixer,.dafixer,.dafixer,.dafixer (rule
high-entropy-sections:.dafixer,.dafixer,.dafixer,.dafixer,.dafixer) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - Packing/obfuscation: high-entropy-sections:.dafixer,.dafixer,.dafixer,.dafixer,.dafixer, Turbo Linker - static signal, weight 0.25, confidence 0.55
- Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
843 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- windows.msn.com
- www.msn.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
Embedded URLs
- http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
- http://crl.thawte.com/ThawteTimestampingCA.crl0
- http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
- http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
- https://www.digicert.com/CPS0
- http://crl3.digicert.com/sha2-assured-cs-g1.crl05
- http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
- http://www.w3.org/2000/09/xmldsig#
- http://www.w3.org/2001/XMLSchema-instance
- http://www.w3.org/2000/09/xmldsig#sha1
- http://www.w3.org/2001/10/xml-exc-c14n#
- http://www.w3.org/2000/09/xmldsig#rsa-sha1
- http://www.w3.org/2000/09/xmldsig#enveloped-signature
- http://schemas.microsoft.com/windows/rel/2005/reldata
- http://schemas.microsoft.com/windows/pki/2005/Authenticode
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
- http://www.digicert.com/ssl-cps-repository.htm0
- http://appsyndication.org/2006/appsyn
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
Embedded domains
- mb.fi
- www.microsoft.com
- crl.microsoft.com
- crl.thawte.com
- ts-aia.ws.symantec.com
- ts-crl.ws.symantec.com
- cacerts.digicert.com
- crl4.digicert.com
- crl3.digicert.com
- www.digicert.com
- www.w3.org
- schemas.microsoft.com
- appsyndication.org
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 4.150.223.106
- 4.230.171.124
- 57.154.63.210
- 135.232.92.97
- 20.184.175.2
- 74.178.240.61
- 20.184.175.10
- 4.144.132.114
- 172.64.154.167
- 40.84.97.4
- 72.153.5.130
- 52.148.114.188
- 52.110.12.2
- 52.110.12.8
File paths
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System\37a1d51f35918dd36a0d4e34cc91732e\System.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ga41585c2#\7145367d78cd9d75b5533cec821c7353\Microsoft.GroupPolicy.AdmTmplEditor.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\7e5e0d92b127a5150606d81839f29044\System.Drawing.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\028f9e8b0c8b1820df7bec952b01fe12\System.Windows.Forms.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\89bc329e8c65a9e13067c9776d925d78\System.Core.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\b5152c3c02957bbe4459505a39afde20\System.Configuration.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\1fb6db2ce6d2887fe6f8f620cb092343\System.Xml.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Accessibility\21911640a598b9b50a75e4b9b6330330\Accessibility.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System\08f69c55e9284eaab92075159503c897\System.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\c9243edb149eb78c5309c103df69d594\System.Core.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\e40e5dfbda2461704b289f4dd7c99033\System.Management.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\2bef38851483abae82f1172c1aaa604c\System.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\9d04ce1d8a3042f50b54c7f9ccdb4068\System.Core.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\fea996c385fbc624826f8e043f6d5329\System.Management.ni.dll
- C:\agent\_work\8\s\build\ship\x86\burn.pdb
- T:\:d:l:t:
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wad78daf4#\8f73bd36654fa77803c3167f39ead17e\Microsoft.Windows.Diagnosis.SDHost.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wed3937f9#\3dae65a1b718d3a083094b67e1413e9a\Microsoft.Windows.Diagnosis.SDCommon.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\f02732d562721457afde5c189a906d17\System.Management.Automation.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W0bb5dac4#\4c396dcf426dbba8eddd04adc0b562fe\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W69ef49d2#\9dcd27fe1c298162f13c6bdb7c0cfe88\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wd518ee0d#\e9bd08c5c1a8c5fdef45c7025b262edc\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W708fc392#\3c226a9afdce13116b1fdfa9e92b4152\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W79a81d80#\2efe3e39ab8a210a684558961ff266d2\Microsoft.Windows.Diagnosis.Commands.WriteDiagTelemetry.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P1706cafe#\16ab851088227b0798b233d026a1019e\Microsoft.PowerShell.Commands.Diagnostics.ni.dll
More Vindor samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report