MALICIOUS — conficker

MALICIOUS — conficker is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Conficker family. 6 of 51 detection engines flagged it.

Identification

• SHA-256: c614daf86ff0893c7be3bcd79a9823d551ad76c5150aed9899abe838e8e067a8
• SHA-1: 99bff8904ac6e7249503865bdc44bb77aedea685
• MD5: 5e7446d5b1c7c7a0fcafd2e5be6c5b56
• imphash: 1586c9eec7f489bf890fb881c50e6517
• ssdeep: 1536:oUUmZ6gSi9/wx9+krA3XYVBAV/qNDuVb16yMNk7oPwhkLhD:o2gg8E53IHS2DsboyMNk7EwhihD
• TLSH: T1AC36027F98A0C7CCCAF355178B42322E5B958AC9C56DCA3239A6071A0033BB3D9DD945
• Submitted as: conficker
• File type: pe · Size: 63410 bytes
• Verdict: malicious (99/100) · Family: Conficker

Detections (6 of 51 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): Win.Worm.Conficker-246
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Detect It Easy (packer/type): DIE:UPX
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): Worm.Conficker.3

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Win.Worm.Conficker-246 (rule Win.Worm.Conficker-246) - engine signal, weight 0.90, confidence 0.95
• Memory forensics: 4 finding(s), e.g. RWX/private injected region in rundll32.exe (pid 6548) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Worm.Conficker.3 (rule Worm.Conficker.3) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

1 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• none

Dropped files

• /opt/CAPEv2/storage/analyses/5830/files/389b3ac24fa3abd907cf8a0ac083c642e80cfe44a3410ee203c00dd5eda93e24 - 389b3ac24fa3abd907cf8a0ac083c642e80cfe44a3410ee203c00dd5eda93e24

Embedded URLs

• http://www.w3.org/TR/1999/REC-html401-19991224/strict.dtd
• http://www.w3.org/TR/html4/strict.dtd

Embedded domains

• www.w3.org

More Conficker samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report