MALICIOUS — c9ee14bf4121f863c4d254c3fbdeec5a8af7518251727a27e17e95ff3090ccbc
MALICIOUS — c9ee14bf4121f863c4d254c3fbdeec5a8af7518251727a27e17e95ff3090ccbc is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the Guap family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
c9ee14bf4121f863c4d254c3fbdeec5a8af7518251727a27e17e95ff3090ccbc - SHA-1:
dd4cc1e76f816f4253a5c0924a30e77dc7d53b56 - MD5:
2604f1398e9588bb7da406901c84baa3 - imphash:
b6230692891661869cecd581561a21f4 - ssdeep:
12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioX0:zW6ncoyqOp6IsTl/mX0 - TLSH:
T1654CBED87AC7CD54E8E97B86E44554BDD68BD12F582D2E8F0392C2386F812F3A472112 - Submitted as: c9ee14bf4121f863c4d254c3fbdeec5a8af7518251727a27e17e95ff3090ccbc
- File type: pe · Size: 534719 bytes
- Verdict: malicious (94/100) · Family: Guap
Detections (6 of 52 engines)
- ClamAV (daily): Win.Worm.Guap-4
- YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
- YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
- Microsoft Defender: Trojan:Win32/Fsysna!pz
- Emsisoft (Emergency Kit): Gen:Heur.Spesr.VB.1
- Kaspersky (KVRT): Trojan.Win32.Fsysna.gevi
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Win.Worm.Guap-4 (rule
Win.Worm.Guap-4) - engine signal, weight 0.90, confidence 0.95 - YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule
DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70 - YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule
TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded domains
- server.com
- tsymantec.com
- tsecurityresponse.symantec.com
- tsarc.com
- twww.sarc.com
- twww.sophos.com
- tsophos.com
- twww.mcafee.com
- tmcafee.com
- tliveupdate.symantecliveupdate.com
- twww.viruslist.com
- tviruslist.com
- tf-secure.com
- twww.f-secure.com
- tf-prot.com
- twww.f-prot.com
- tkaspersky.com
- tkaspersky-labs.com
- twww.avp.com
- tavp.com
- twww.kaspersky.com
- twww.networkassociates.com
- tnetworkassociates.com
- twww.ca.com
- tca.com
Registry keys
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
File paths
- C:\Program
- C:\WINDOWS\system32\drivers\etc\hosts
More Guap samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report