MALICIOUS — c90095c84c9241185cd088998119289a0fdf098a691e4587a4859470d8b24ca9
MALICIOUS — c90095c84c9241185cd088998119289a0fdf098a691e4587a4859470d8b24ca9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Maldoc family. 5 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
c90095c84c9241185cd088998119289a0fdf098a691e4587a4859470d8b24ca9 - SHA-1:
14412428b03614ea893e0e0aa04db5c9d70b3a59 - MD5:
50f84c738e61f21bc8578126646e3ff0 - imphash:
5e6955ab958f0427686406bc5d4d6248 - ssdeep:
49152:sEFMFnb0lKxAA5sd+WjK34Yq0P9v0qHYnkPEoa8KGRyw8:zA5sd3Qdn9v0qHYnSjRyx - TLSH:
T17F58AEC8431AB712EAB1C7681C549F8E5473F0E9B27D298C57C3806F35B7927A875228 - Submitted as: c90095c84c9241185cd088998119289a0fdf098a691e4587a4859470d8b24ca9
- File type: pe · Size: 1647848 bytes
- Verdict: malicious (96/100) · Family: Maldoc
Detections (5 of 52 engines)
- ClamAV (daily): Win.Malware.Genpack-9875426-0
- YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Microsoft Defender: Trojan:Win32/Wacatac.B!ml
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Win.Malware.Genpack-9875426-0 (rule
Win.Malware.Genpack-9875426-0) - engine signal, weight 0.90, confidence 0.95 - YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule
DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: http://www.gnu.org/licenses/, http://www.gnu.org/software/coreutils/, http://translationproject.org/team/ - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.gnu.org/licenses/
- http://www.gnu.org/software/coreutils/
- http://translationproject.org/team/
- http://gnu.org/licenses/gpl.html
- http://www.gnu.org/gethelp/
- http://schemas.microsoft.com/windows/2009/library
- http://crl.verisign.com/tss-ca.crl0
- http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0O
- http://office.microsoft.com
Embedded domains
- cwru.edu
- gnu.org
- www.gnu.org
- translationproject.org
- cygwin.com
- schemas.microsoft.com
- support.microsoft.com
- version.name
- empty.name
- crl.verisign.com
- crl.microsoft.com
- www.microsoft.com
- office.microsoft.com
- command.com
File paths
- C:\Users\a.monaldo\Desktop
- t:\msishared\x86\ship\0\CustomActions\AbortMsiCA.pdb
- O:\:b:g:
- F:\binaries.x86ret\bin\i386\bbt\opt\bin\i386\hxds.pdb
- U:\:
- M:\:b:i:
- T:\:p:x:
- T:\:l:
- O:\:j:u:
- F:\:w:
- d:\office\source\otools\inc\util\ocfx\oproductid.h
- d:\office\source\otools\inc\util\ocfx\ocomutility.h
- d:\office\source\util\ocfx\omsica.cpp
- d:\office\source\util\ocfx\ostring.cpp
- d:\office\source\otools\inc\util\ocfx\optr.h
- d:\office\source\util\ocfx\omsi.cpp
- d:\office\source\util\ocfx\olog.cpp
- d:\office\source\util\ocfx\oregistrykey.cpp
- d:\office\source\otools\inc\util\ocfx\oxmlelement.h
- d:\office\source\util\ocfx\oxmldocument.cpp
- d:\office\source\util\ocfx\ofile.cpp
- d:\office\source\util\ocfx\oblob.cpp
- d:\office\source\otools\inc\util\ocfx\ostacktrace.h
- d:\office\source\otools\inc\util\ocfx\othreadlocal.h
- d:\office\source\util\ocfx\oxmlnode.cpp
More Maldoc samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report