MALICIOUS — b335f6e5bfde4aa5a3cb2c0d020ce0b3c8434a71be1abdefa47f198c30c3e046

MALICIOUS — b335f6e5bfde4aa5a3cb2c0d020ce0b3c8434a71be1abdefa47f198c30c3e046 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the HUILoader family. 5 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: b335f6e5bfde4aa5a3cb2c0d020ce0b3c8434a71be1abdefa47f198c30c3e046
SHA-1: d3d91dc00883a6139deafbd28a2e60091b6bab5e
MD5: b96d9699ca172bddbe35d3098c648958
imphash: edf4e75ead3f8f12a6448e6d357d1297
ssdeep: 786432:ppeXqoAugc9nh2Sf5wdzCl/isPvBzPEqRqFI:WXqoVgInhJyCl/isPv1PEkqi
TLSH: T12F758DC905A2FF01E4F4DB90DF208A6C9092E1EDB0BC19CC4A93607E27FB56B64952D5
Submitted as: b335f6e5bfde4aa5a3cb2c0d020ce0b3c8434a71be1abdefa47f198c30c3e046
File type: pe · Size: 26017792 bytes
Verdict: malicious (99/100) · Family: HUILoader

Detections (5 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Generic-9950561-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9950561-0 (rule Win.Trojan.Generic-9950561-0) - engine signal, weight 0.90, confidence 0.95
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://purl.org/dc/elements/1.1/, http://purl.oclc.org/ooxml/officeDocument/bibliography, http://purl.oclc.org/ooxml/drawingml/chartDrawing - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://schemas.microsoft.com/xps/2005/06
http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://schemas.microsoft.com/office/2007/6/19/audiovideo
http://schemas.microsoft.com/office/spreadsheetml/2016/revision9
http://schemas.microsoft.com/office/powerpoint/2013/contentapp
http://schemas.microsoft.com/office/drawing/2015/9/8/chartex
http://schemas.microsoft.com/office/spreadsheetml/2016/revision10
http://schemas.microsoft.com/office/drawing/2015/10/21/chartex
http://schemas.microsoft.com/office/powerpoint/2012/roamingSettings
http://schemas.openxmlformats.org/presentationml/2006/main
http://schemas.microsoft.com/internal/powerpoint/test
http://schemas.microsoft.com/server/powerpoint/2009/main
http://schemas.microsoft.com/internal/drawing/test
http://schemas.microsoft.com/internal/diagram/test
http://schemas.microsoft.com/office/office/2011/9/metroDictionary
http://schemas.microsoft.com/office/drawing/2014/chart
http://schemas.microsoft.com/server/powerpoint/2009/mobile
http://schemas.microsoft.com/internal/ID/Story/test
http://schemas.microsoft.com/schemaLibrary/2003/core
http://schemas.microsoft.com/office/drawing/2014/chart/command

Embedded domains

schemas.microsoft.com
window.name
c.style.top
crl.microsoft.com
www.microsoft.com
office.microsoft.com
schemas.openxmlformats.org
www.w3.org
purl.org
purl.oclc.org
www.msn.com

Embedded IP addresses

6.0.1.0
20.184.175.1
52.123.252.197
20.247.184.142
4.230.171.124
20.42.179.204
57.155.104.224
20.184.175.17
74.179.77.164
20.165.94.63
40.79.167.9
104.18.33.89
52.110.12.44
52.110.12.33

File paths

F:\Office\Target\x86\ship\postc2r\x-none\excelcnv.pdb
V:\:e:m:
S:\:b:~:
R:\:
R:\:u:
P:\:i:z:I;W;s;
K:\:
X:\:`:d:h:l:p:t:x:
V:\;d;
R:\:~:
U:\:c:j:r:z:
B:\:t:
W:\:r:w:
M:\:y:
W:\:
V:\:b:h:n:t:z:
U:\:c:j:q:x:
Q:\:c:j:q:x:
X:\:
X:\:d:h:
X:\:d:h:p:t:
X:\:h:l:x:
X:\:`:d:h:l:p:t:
X:\:`:d:h:l:
X:\:h:l:t:

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report