SUSPICIOUS — FP_AX_CAB_INSTALLER64.exe
SUSPICIOUS — FP_AX_CAB_INSTALLER64.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (67/100), attributed to the AntiDebug family. 2 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.
Identification
- SHA-256:
c8c8cff5dc0a3f205e59f0bbfe30b6ade490c10b9ecc7043f264ec67ef9b6a11 - SHA-1:
8ec5c3294b3854a32636529d73a5f070d5bcf627 - MD5:
47f240e7f969bc507334f79b42b3b718 - imphash:
c331d334cc023b08510862f9923095de - ssdeep:
12288:7is1VxmuejWRd56dN/hDeNh6jUVyTkTcAAAAAAAAAAAAAAAXAbAAAAAAAAAAAAAm:7is1Vxmueq6eb6jPTkG9 - TLSH:
T1AB50B48F1BB85B48E919E4CD5EA0574CED26ABCE29B323B9CE0E543B117D20B4DE4150 - Submitted as: FP_AX_CAB_INSTALLER64.exe
- File type: pe · Size: 775224 bytes
- Verdict: suspicious (67/100) · Family: AntiDebug
Detections (2 of 55 engines)
- capa (capabilities): capability:collection/keylog
- YARA: Yara-Rules community: YR_AntiDebug_Checks
MITRE ATT&CK
Why this verdict
The suspicious score of 67/100 is the fusion of 6 weighted signals:
- capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: http://fpdownload2.macromedia.com/pub/flashplayer/update/current/aih/aih_sgn.z - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://www.digicert.com/CPS0
- http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
- http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
- http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
- http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
- http://www.digicert.com/ssl-cps-repository.htm0
- http://crl3.digicert.com/sha2-assured-ts.crl02
- http://crl4.digicert.com/sha2-assured-ts.crl0
- http://fpdownload2.macromedia.com/pub/flashplayer/update/current/aih/aih_sgn.z
- https://www.adobe.com/se/software/flash/about/
- https://www.adobe.com/tw/software/flash/about/
- https://www.adobe.com/cz/software/flash/about/
- https://www.adobe.com/de/software/flash/about/
- https://www.adobe.com/software/flash/about/
- https://www.adobe.com/fr/software/flash/about/
- https://www.adobe.com/it/software/flash/about/
- https://www.adobe.com/jp/software/flash/about/
- https://www.adobe.com/kr/software/flash/about/
- https://www.adobe.com/nl/software/flash/about/
- https://www.adobe.com/pl/software/flash/about/
- https://www.adobe.com/br/software/flash/about/
- https://www.adobe.com/ru/software/flash/about/
- https://www.adobe.com/tr/software/flash/about/
- https://www.adobe.com/cn/software/flash/about/
- https://www.adobe.com/es/software/flash/about/
Embedded domains
- macromedia.com
- crl3.digicert.com
- crl4.digicert.com
- www.digicert.com
- cacerts.digicert.com
- adobe.com
- fpdownload2.macromedia.com
- fpdownload.macromedia.com
- geo2.adobe.com
- get3.adobe.com
- www.adobe.com
File paths
- E:\r\ws\St_Make\code\build\win\int\Morphology.build\Release\Win32\Morpheme.pdb
- X:\:d:
More AntiDebug samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report