MALICIOUS — b52a779a0594aede244bd61a4c14d6bdce327b3f40c70c26e7371b7ee6720129

MALICIOUS — b52a779a0594aede244bd61a4c14d6bdce327b3f40c70c26e7371b7ee6720129 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Pidgeon family. 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: b52a779a0594aede244bd61a4c14d6bdce327b3f40c70c26e7371b7ee6720129
SHA-1: 0cd8b4b4dc6fb5a516840ebb08681645db316c80
MD5: c646689b2a3c1abe5c7f5a6c154c11e1
imphash: b57870dcf1f3e91ff7814fe4ffd1b747
ssdeep: 49152:LakOElMaFLkzM7/4MnYYJ2ZhqSGLHkJEMDrGphKPgssSt2gUZqhaK6zbfqdl:Lak7gMEIDQUhv7Stix
TLSH: T1095F8ECD421E6711D275CB205C609D9E9462B2E8307DFAAC0E87C5BE11E2A37F97109E
Submitted as: b52a779a0594aede244bd61a4c14d6bdce327b3f40c70c26e7371b7ee6720129
File type: pe · Size: 3465963 bytes
Verdict: malicious (99/100) · Family: Pidgeon

Detections (6 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Packed.Pidgeon-9909600-0
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Packed.Pidgeon-9909600-0 (rule Win.Packed.Pidgeon-9909600-0) - engine signal, weight 0.90, confidence 0.95
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.70, confidence 0.70
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 1 external host(s) and 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.symauth.com/cps0, http://www.symauth.com/rpa04, http://www.symauth.com/cps09 - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.w3.org/2001/XMLSchema-instance
https://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-cs-g1.crl05
http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
http://www.digicert.com/ssl-cps-repository.htm0
http://watson.microsoft.com/dw/dcp.asp
http://watson.microsoft.com/dw/watsoninfo.asp
http://www.microsoft.com/pki/certs/tspca.crt0
http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0O
http://crl3.digicert.com/assured-cs-2011a.crl03
http://crl4.digicert.com/assured-cs-2011a.crl0
http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
http://crl.thawte.com/ThawteTimestampingCA.crl0
https://armmf.adobe.com/arm-manifests/win/
http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows
http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows
http://crl.verisign.com/pca3.crl0

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com
www.w3.org
shim.app
cacerts.digicert.com
crl4.digicert.com
crl3.digicert.com
www.digicert.com
watson.microsoft.com
microsoft.com
msn.com
ts-aia.ws.symantec.com
ts-crl.ws.symantec.com
crl.thawte.com
armmf.adobe.com
www.adobe.com
crl.verisign.com
www.verisign.com
logo.verisign.com
www.symauth.com
evcs-crl.ws.symantec.com
evcs-aia.ws.symantec.com
schemas.microsoft.com

Embedded IP addresses

0.10.5.0
1.7.2.0
20.184.175.21
4.230.171.124
4.247.188.224
74.179.77.204
52.253.84.76
74.178.240.51
4.150.223.99
4.144.132.223
172.64.154.167
52.110.12.49
52.110.12.48
52.110.12.22

Registry keys

HKCU\Software\Microsoft\Shared\OfficeUILanguage
HKCU\Software
HKLM\Software
HKCU\Software\Microsoft\Internet
HKLM\Software\Microsoft\Windows
HKLM\Software\Microsoft\Office\11.0\Registration
HKCU\Software\Policies
HKLM\Software\Policies

File paths

F:\Office\Target\x86\ship\postc2r\x-none\orgchart.pdb
L:\:o:z:
V:\:r:x:
N:\:i:f;~;
V:\:b:h:n:t:z:
R:\Sg
c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\obj-firefox\toolkit\crashreporter\client\crashreporter.pdb
f:\CB\ARM_Sustaining\BuildResults\bin\Win32\Release\AdobeARM.pdb
R:\:m:{:
D:\:q:
X:\:`:d:h:l:p:t:
T:\:d:l:t:
T:\:d:l:x:
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
C:\Program

More Pidgeon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report