MALICIOUS — c86c98570c6ac2dc5fa459d05e43a449b732edf40bf9fe76b36ede0e13094f8c

MALICIOUS — c86c98570c6ac2dc5fa459d05e43a449b732edf40bf9fe76b36ede0e13094f8c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Pidgeon family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: c86c98570c6ac2dc5fa459d05e43a449b732edf40bf9fe76b36ede0e13094f8c
SHA-1: 098009c745175f629e68d7eb3f9a67e2a89a6c63
MD5: 095fa765d90a35cfb4f6fd505024dac2
imphash: a6e200b94518b2d5a3a72cffd5a4b402
ssdeep: 24576:j0mbpjWVP7YlZa9lq4BVNdWgvwmJqJHQ6Mjs9ymTNYqZ+G4wUbMQ:wpR8Pa9lq2dWw6MjEbZ+G43MQ
TLSH: T14C5849890682E745C1E0D75DBCB0AA5EE4A3F08536765E4C6B82B07A5AF337374D842C
Submitted as: c86c98570c6ac2dc5fa459d05e43a449b732edf40bf9fe76b36ede0e13094f8c
File type: pe · Size: 1691648 bytes
Verdict: malicious (97/100) · Family: Pidgeon

Detections (4 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Packed.Pidgeon-9909600-0
YARA: Yara-Rules community: YR_AntiDebug_Checks
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

T1056.001

Why this verdict

The malicious score of 97/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Packed.Pidgeon-9909600-0 (rule Win.Packed.Pidgeon-9909600-0) - engine signal, weight 0.90, confidence 0.95
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 24 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 6.0.1.0 - static signal, weight 0.35, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://office.microsoft.com/en-us/onenote-help/
https://go.microsoft.com/fwlink/?LinkID=619267
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787644873&P2=404&P3=2&P4=IaHWEkG%2fcw6uMtK8RJs5%2f5R7t8jz6g7Xc%2fpUZ2W1GqyTR58Z0rGTdvnewq1Pswc8vqC21jojjLNBLyds1iUcUg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
crl.microsoft.com
www.microsoft.com
office.microsoft.com
go.microsoft.com

Embedded IP addresses

6.0.1.0
72.153.5.129
172.215.188.232
51.116.246.105
4.230.171.124
40.84.85.40
52.230.59.222
52.123.252.232
74.178.76.128
20.42.65.85
74.178.76.54
20.236.44.162
52.123.129.14
40.99.133.226
52.123.128.14
4.150.223.100
203.26.79.13
52.123.252.227
20.165.94.46
172.178.240.163
52.110.12.3
52.110.12.26
72.145.35.111
162.159.142.9
52.148.114.188

File paths

F:\Office\Target\x86\ship\postc2r\x-none\onenote.pdb
X:\:`:d:p:t:
X:\:`:d:h:l:p:t:x:
X:\:
T:\:d:l:t:
P:\:
P:\:d:
H:\:p:

More Pidgeon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report