MALICIOUS — b239f0ebabc0108bd8ceee73cf57bca0a81b5f2a8107bb81e988be1ebcaa30be

MALICIOUS — b239f0ebabc0108bd8ceee73cf57bca0a81b5f2a8107bb81e988be1ebcaa30be is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Filerepmalware family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: b239f0ebabc0108bd8ceee73cf57bca0a81b5f2a8107bb81e988be1ebcaa30be
SHA-1: 38ba52b240f0a5f59b8753514de57965c72400dc
MD5: 71645b81cecaed588666d01d14912d94
imphash: 4d8d0261016c5c05b880950a5b0e704a
ssdeep: 24576:RH8bZHF8z3j5D7JaT+KVvrSrtUx7CqnstLyUktHIiLyy59FF96X0JxQx:REHF+3j5D78OBUsqnstLet3LyE
TLSH: T10F5AF7CC510A7A11FEB58DA05E177D9C5452B0B613BF366C9A42C03E52E2E3FF8A1069
Submitted as: b239f0ebabc0108bd8ceee73cf57bca0a81b5f2a8107bb81e988be1ebcaa30be
File type: pe · Size: 2113060 bytes
Verdict: malicious (99/100) · Family: Filerepmalware

Detections (4 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Filerepmalware-9871423-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Filerepmalware-9871423-0 (rule Win.Malware.Filerepmalware-9871423-0) - engine signal, weight 0.90, confidence 0.95
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 1 external host(s) and 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 6.0.1.0 - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 6104) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://schemas.microsoft.com/2003/10/Serialization/Arrays
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi
http://schemas.datacontract.org/2004/07/Microsoft.Office.LicensingService
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetEntitlementsForOlsIdentityResponse
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetEntitlementsForOlsIdentityRequest
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/CheckMachineStatusResponse
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/CheckMachineStatusRequest
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetKeyResponse
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetKeyRequest
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetEntitlementForMachineKeyResponse
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetEntitlementForMachineKeyRequest
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetLicenseInfoForMachineKeyResponse
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetLicenseInfoForMachineKeyRequest
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetLicenseResponse
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetLicenseRequest
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetSessionTokenResponse
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetSessionTokenRequest
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetOlsLicenseResponse
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetOlsLicenseRequest
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetWpkBindingResponse
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetWpkBindingRequest
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetTokenResponse
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetTokenRequest
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/IOlsClient/ReportActivationResponse

Embedded domains

schemas.microsoft.com
schemas.datacontract.org
crl.microsoft.com
www.microsoft.com
office.microsoft.com
go.microsoft.com
ols.officeapps.live.com

Embedded IP addresses

6.0.1.0
20.42.72.131
4.230.171.124
20.42.179.192
74.178.240.61
74.178.240.51
20.42.65.88
20.247.185.124
203.26.79.13
135.233.95.80
52.123.252.234
104.18.33.89
72.154.7.107
162.159.142.9
52.110.12.25
52.110.12.45

File paths

d:\dbs\el\oc\target\x86\ship\postc2r\x-none\olicenseheartbeat.pdb
X:\:`:d:h:l:p:t:x:
P:\:`:l:p:
H:\:d:h:p:
T:\:d:l:t:
d:\dbs\el\oc\target\x86\ship\postc2r\x-none\clview.pdb
U:\:
L:\:l:u:
X:\:d:l:
X:\:`:h:l:p:t:x:
X:\:`:d:
F:\Office\Target\x64\ship\postc2r\x-none\appsharinghookcontroller.pdb

More Filerepmalware samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report