MALICIOUS — c7dc721388ac80482a576e64c395a6fa29bac77964742782452030ad3e73f587

MALICIOUS — c7dc721388ac80482a576e64c395a6fa29bac77964742782452030ad3e73f587 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Maldoc family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: c7dc721388ac80482a576e64c395a6fa29bac77964742782452030ad3e73f587
SHA-1: 74feed737c91170cb11514a8218169682d815b23
MD5: 8c86d22226f66b09f6e351384fbe8e4b
imphash: 83f4e8aeb8b7edfb2049e94b73a56875
ssdeep: 12288:GIjUlry8gf82ZzSmeFaqGLuNVfrNXfcqh9HnxwUiw5id0sMu26aj:f7NfcbFaRYl/h9HSUPD/
TLSH: T1A752ADD00F12141CE9DA6E650DD706DCCEEE2B51ACE421F9C6C3BA3502D683B4A16DD9
Submitted as: c7dc721388ac80482a576e64c395a6fa29bac77964742782452030ad3e73f587
File type: pe · Size: 978944 bytes
Verdict: malicious (99/100) · Family: Maldoc

Detections (6 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Generic-9907165-0
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9907165-0 (rule Win.Trojan.Generic-9907165-0) - engine signal, weight 0.90, confidence 0.95
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 19 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.eyuyan.com - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

38 behavior events · 1 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://crl.verisign.com/tss-ca.crl0
http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0O
http://office.microsoft.com
http://www.eyuyan.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787485551&P2=404&P3=2&P4=Ay%2b9Zmi0iwrHzbGaB345q2Ckbvv7y9mhMFu%2fBetn20BBWwkIgyr6%2foThwQFpsVa33Ueq92rqwKJ%2fYbDwHeu2JQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.verisign.com
crl.microsoft.com
www.microsoft.com
office.microsoft.com
www.eyuyan.com

Embedded IP addresses

40.84.97.4
40.79.167.9
52.123.252.236
4.230.171.124
85.210.193.152
52.230.59.222
74.178.76.128
20.184.175.20
135.233.95.135
72.154.7.16
4.150.223.110
20.236.44.162
52.123.128.14
52.123.129.14
172.178.240.162
203.26.79.13
52.148.114.188
20.165.94.46
52.110.12.55

File paths

t:\XDOCS\X64\ship\0\msoxmled.pdb

More Maldoc samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report