MALICIOUS — ba2bd59e89e57dc1d8e174091d944a291b078ce606d160703b202918f1ba715f

MALICIOUS — ba2bd59e89e57dc1d8e174091d944a291b078ce606d160703b202918f1ba715f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the FuBu family. 5 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: ba2bd59e89e57dc1d8e174091d944a291b078ce606d160703b202918f1ba715f
• SHA-1: 9fa2f3f5f186da773be0ce105b48815ec570c270
• MD5: e0d0fe803b24334a01186eb12b685a09
• imphash: d41d8cd98f00b204e9800998ecf8427e
• ssdeep: 6144:dwHWwnIfqrYtCqTBNo9qStwWrNczuHLlB8iN:dwrnIfqktCqTeHwjzurlB8y
• TLSH: T1BF4918644632B2C0E5F19D259C208D3C149EB4AB1179398B9ED7E1AFE1F783344B4267
• Submitted as: ba2bd59e89e57dc1d8e174091d944a291b078ce606d160703b202918f1ba715f
• File type: pe · Size: 424665 bytes
• Verdict: malicious (99/100) · Family: FuBu

Detections (5 of 56 engines)

• ClamAV (daily): Win.Trojan.FuBu-1
• YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Trojan:Win64/Shodi!rfn
• Kaspersky (KVRT): HEUR:Trojan.Win64.Kryptik.gen

MITRE ATT&CK

• T1071.001

Why this verdict

The malicious score of 99/100 is the fusion of 6 weighted signals:

• ClamAV (daily) flagged Win.Trojan.FuBu-1 (rule Win.Trojan.FuBu-1) - engine signal, weight 0.90, confidence 0.95
• YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.70, confidence 0.70
• Microsoft Defender flagged Trojan:Win64/Shodi!rfn (rule Trojan:Win64/Shodi!rfn) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Win64.Kryptik.gen (rule HEUR:Trojan.Win64.Kryptik.gen) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• licensing.mp.microsoft.com
• config.edge.skype.com
• officeclient.microsoft.com
• windows.msn.com
• odc.officeapps.live.com
• www.msn.com
• assets.msn.com
• www.bing.com
• settings-win.data.microsoft.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded URLs

• http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
• http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
• http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
• http://office.microsoft.com
• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• crl.microsoft.com
• www.microsoft.com
• office.microsoft.com

Embedded IP addresses

• 40.74.98.197
• 20.247.184.197
• 52.123.252.229
• 4.230.171.124
• 40.84.85.40
• 52.110.12.10
• 52.110.12.49

File paths

• F:\Office\Target\x86\ship\postc2r\x-none\msoxmled.pdb

More FuBu samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report