MALICIOUS — b8236efcfcdeb61c932b19488d58ba10c2033ca0b9a4bcf95d0dadc8620af196.exe
MALICIOUS — b8236efcfcdeb61c932b19488d58ba10c2033ca0b9a4bcf95d0dadc8620af196.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Maldoc family. 7 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
b8236efcfcdeb61c932b19488d58ba10c2033ca0b9a4bcf95d0dadc8620af196 - SHA-1:
4ba10e9acc18d2dd1d5acc72a681278c10145898 - MD5:
e973b260c4613c14d285536e398f82cb - imphash:
ed8b780a3ce7ca4aba78a21f6bc3d4e0 - ssdeep:
98304:YpdPeWti7fApX4Pjsoe2xJaew7nkpoExqREt:MkWi7YFoLxJ1+dE8y - TLSH:
T1BC6C6BA462573626D4F4CC08F431C0DC8877748A91B19ECD4387E56950EEEBFAAF10A9 - Submitted as: b8236efcfcdeb61c932b19488d58ba10c2033ca0b9a4bcf95d0dadc8620af196.exe
- File type: pe · Size: 11124736 bytes
- Verdict: malicious (97/100) · Family: Maldoc
Source: MalwareBazaar · first seen 2026-07-26T00:00:00.000Z · SHA-256 verified
Detections (7 of 53 engines)
- capa (capabilities): execute via PowerShell
- YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Trellix/McAfee ATR: ATR_REvil_Sodinokibi
- YARA: MalwareAnalyser community pack: TL_Suspicious_PowerShell_Download
- Emsisoft (Emergency Kit): Trojan.GenericKD.80945416
- Kaspersky (KVRT): not-a-virus:UDS:NetTool.Win64.CloudTunnel.a
MITRE ATT&CK
Why this verdict
The malicious score of 97/100 is the fusion of 13 weighted signals:
- Memory forensics: 7 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 8140) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.GenericKD.80945416 (rule
Trojan.GenericKD.80945416) - engine signal, weight 0.55, confidence 0.85 - execute via PowerShell (rule
execute via PowerShell) - capa signal, weight 0.40, confidence 0.80 - YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule
DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - YARA: Trellix/McAfee ATR flagged ATR_REvil_Sodinokibi (rule
ATR_REvil_Sodinokibi) - engine signal, weight 0.35, confidence 0.70 - YARA: MalwareAnalyser community pack flagged TL_Suspicious_PowerShell_Download (rule
TL_Suspicious_PowerShell_Download) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://go.dev/issue/66821, https://go.dev/pkg/crypto/rsa#hdr-Minimum_key_size, https://bugs.chromium.org/p/chromium/issues/detail?id=600120 - static signal, weight 0.35, confidence 0.60
- enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (10 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Extracted generic config (10 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
279 behavior events · 1 ATT&CK techniques · 0 dropped files.
Runtime network
- searchapp.bundleassets.example
- www.msftconnecttest.com
- desktop-hsgcbep
- www.bing.com
- config.edge.skype.com
- dns.msftncsi.com
- edge.microsoft.com
- aps.prod.windows.com
- ecs.office.com
- watson.events.data.microsoft.com
- g.live.com
- www.msftncsi.com
- fs.microsoft.com
- self.events.data.microsoft.com
- msedge.api.cdp.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
- geover.prod.do.dsp.mp.microsoft.com
- 224.0.0.252
- 192.168.122.255
- 169.254.59.211
Embedded URLs
- https://go.dev/issue/66821
- https://go.dev/pkg/crypto/rsa#hdr-Minimum_key_size
- https://bugs.chromium.org/p/chromium/issues/detail?id=600120
- https://bugzilla.mozilla.org/show_bug.cgi?id=888319
- https://adminlte.io
- https://colorlib.com
- https://github.com/ColorlibHQ/AdminLTE/blob/master/LICENSE
- https://www.openstreetmap.org/copyright
- https://icons.getbootstrap.com/
- https://github.com/twbs/icons/blob/main/LICENSE
- https://leafletjs.com
- http://www.w3.org/2000/svg
- https://opensource.org/licenses/MIT
Embedded domains
- big.int
- abi.name
- pkix.name
- main.store
- godebugs.info
- golang.org
- github.com
- json.name
- www.virustotal.com
- tile.openstreetmap.org
- go.dev
- a.cc
- joomla.org
- bugs.chromium.org
- bugzilla.mozilla.org
- adminlte.io
- colorlib.com
- this.name
- e.name
- www.openstreetmap.org
- icons.getbootstrap.com
- leafletjs.com
- www.w3.org
- t.style.top
- t.name
Embedded IP addresses
- 5.4.62.5
- 4.32.5.4
- 52.5.4.72
- 5.4.82.5
- 5.4.112.5
- 1.1.1.1
- 2.2.1.1
More Maldoc samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report