MALICIOUS — b02318fd36dbb66df4b9144042d216272e5669cbafa12ea5cc57b8b134e6e7e1

MALICIOUS — b02318fd36dbb66df4b9144042d216272e5669cbafa12ea5cc57b8b134e6e7e1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Container family. 10 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: b02318fd36dbb66df4b9144042d216272e5669cbafa12ea5cc57b8b134e6e7e1
• SHA-1: 995815c8c274291c6f96b13ccf9b1365a0dd779e
• MD5: a7171c86ca7a31236b1dc5136806cbdc
• imphash: e2a41a8128a8092d9a0d230ec500cfa3
• ssdeep: 196608:9OZP87OBObOBOZP8gcOZP87OBObOBOZP8gi:sqywSwqeqywSwqN
• TLSH: T1496ABE84520D6251EAF3CE50584C5E1F8053B69C71BDEBAC4243E1AE72E56B3B8B20DD
• Submitted as: b02318fd36dbb66df4b9144042d216272e5669cbafa12ea5cc57b8b134e6e7e1
• File type: pe · Size: 8997092 bytes
• Verdict: malicious (98/100) · Family: Container

Detections (10 of 55 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): Win.Malware.Generickdz-9968327-0
• YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Detect It Easy (packer/type): DIE:Microsoft Linker
• LIEF (executable format parser): lief:invalid-authenticode
• Microsoft Defender: Trojan:Win32/Xiaoba!pz
• Emsisoft (Emergency Kit): Gen:Variant.Ransom.XiaoBa.8
• Trellix Stinger (McAfee): Trojan-FOZT!A7171C86CA7A
• Kaspersky (KVRT): Virus.Win32.Lamer.ko

MITRE ATT&CK

• T1547.001
• T1071.001
• T1057

Why this verdict

The malicious score of 98/100 is the fusion of 10 weighted signals:

• ClamAV (daily) flagged Win.Malware.Generickdz-9968327-0 (rule Win.Malware.Generickdz-9968327-0) - engine signal, weight 0.90, confidence 0.95
• YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
• LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: http://crls1.wosign.com/ca1.crl0g, http://ocsp1.wosign.com/ca10, http://aia1.wosign.com/ca1-tsa.cer0 - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• http://crls1.wosign.com/ca1.crl0g
• http://ocsp1.wosign.com/ca10
• http://aia1.wosign.com/ca1-tsa.cer0
• http://schemas.microsoft.com/SMI/2005/WindowsSettings
• http://crl.verisign.com/tss-ca.crl0
• https://www.verisign.com/rpa
• https://www.verisign.com/cps0*
• https://www.verisign.com/rpa0
• http://logo.verisign.com/vslogo.gif0
• http://crl.verisign.com/pca3.crl0
• http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
• http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
• http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
• http://www.gnu.org/software/coreutils/
• http://translationproject.org/team/
• http://gnu.org/licenses/gpl.html
• http://www.gnu.org/gethelp/
• http://www.w3.org/2001/XMLSchema-instance
• https://www.digicert.com/CPS0
• http://crl3.digicert.com/sha2-assured-cs-g1.crl05
• http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
• http://www.digicert.com/ssl-cps-repository.htm0
• http://www.microsoft.com/contentredirect.asp

Embedded domains

• hoo.com
• duba.net
• crls1.wosign.com
• ocsp1.wosign.com
• aia1.wosign.com
• schemas.microsoft.com
• crl.verisign.com
• www.verisign.com
• logo.verisign.com
• csc3-2009-2-crl.verisign.com
• csc3-2009-2-aia.verisign.com
• crl.microsoft.com
• www.microsoft.com
• www.gnu.org
• translationproject.org
• gnu.org
• cygwin.com
• www.w3.org
• shim.app
• cacerts.digicert.com
• crl4.digicert.com
• crl3.digicert.com
• www.digicert.com
• 360.cn

Embedded IP addresses

• 124.40.51.17
• 7.0.0.147
• 0.10.5.0

File paths

• C:\jdk7_32P\jdk7\build\windows-i586\tmp\sun\launcher\extcheck\obj\extcheck.pdb
• C:\jdk7_32P\jdk7\build\windows-i586\tmp\sun\launcher\native2ascii\obj\native2ascii.pdb
• C:\jdk7_32P\jdk7\build\windows-i586\tmp\sun\launcher\jar\obj\jar.pdb
• d:\xpsprtm\inetsrv\iis\exe\main.c
• C:\jdk7_32P\jdk7\build\windows-i586\tmp\sun\launcher\jdb\obj\jdb.pdb
• C:\Users\Vinay\Projects\simple_launcher\dist\t32.pdb
• X:\:`:d:h:l:p:t:x:
• c:\python38\python.exe
• E:\delivery\Dev\wix37\build\ship\x86\burn.pdb
• U:\:c:j:q:x:
• c:\\path\to\somefile.exe

More Container samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report