MALICIOUS — c41e738472ec02f93af629810b3db493a9a251443963f93865862b7773e14fd3

MALICIOUS — c41e738472ec02f93af629810b3db493a9a251443963f93865862b7773e14fd3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the Kolab family. 4 of 52 detection engines flagged it.

Identification

• SHA-256: c41e738472ec02f93af629810b3db493a9a251443963f93865862b7773e14fd3
• SHA-1: d2b6c5a171b51948d18d69b6a8cc1bf2f8f18653
• MD5: b2ee1197f92629256122d63b88e34827
• imphash: 2246645e296d21731711390e29627ae3
• ssdeep: 6144:VEJ5rX6cD8tWzvKOYzUvqDRo+9EJ5rX6962s:ePrXDIK4UvcjWPrX06h
• TLSH: T1AE47AE5482065216F3F7C7669858DE6D787374FEA0F8295D3283C50FA2E6CF3A821264
• Submitted as: c41e738472ec02f93af629810b3db493a9a251443963f93865862b7773e14fd3
• File type: pe · Size: 333976 bytes
• Verdict: malicious (92/100) · Family: Kolab

Detections (4 of 52 engines)

• ClamAV (daily): Win.Malware.Kolab-9885903-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Microsoft Defender: Trojan:Win32/Tiggre!rfn

Why this verdict

The malicious score of 92/100 is the fusion of 3 weighted signals:

• ClamAV (daily) flagged Win.Malware.Kolab-9885903-0 (rule Win.Malware.Kolab-9885903-0) - engine signal, weight 0.90, confidence 0.95
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://schemas.microsoft.com/SMI/2005/WindowsSettings
• http://crl.thawte.com/ThawteTimestampingCA.crl0
• http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
• http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
• https://www.verisign.com/rpa
• http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
• https://www.verisign.com/rpa0
• http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
• https://www.verisign.com/cps0*
• http://logo.verisign.com/vslogo.gif04
• http://crl.verisign.com/pca3-g5.crl04
• http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
• http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
• http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
• http://office.microsoft.com
• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0

Embedded domains

• schemas.microsoft.com
• crl.thawte.com
• ts-aia.ws.symantec.com
• ts-crl.ws.symantec.com
• www.verisign.com
• csc3-2010-crl.verisign.com
• csc3-2010-aia.verisign.com
• logo.verisign.com
• crl.verisign.com
• crl.microsoft.com
• www.microsoft.com
• office.microsoft.com
• mozilla.org

File paths

• C:\re\jdk7u45\229\build\windows-amd64\tmp\javacplexec\obj64\javacpl.pdb
• F:\Office\Target\x86\ship\postc2r\x-none\wordconv.pdb
• C:\re\jdk7u45\229\build\windows-amd64\tmp\sun\launcher\rmiregistry\obj64\rmiregistry.pdb

More Kolab samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report