MALICIOUS — c9fc3abd32bbd006de0136ba55c7c9b8abfdbf0773179c3347bab4bbe6ff423d

MALICIOUS — c9fc3abd32bbd006de0136ba55c7c9b8abfdbf0773179c3347bab4bbe6ff423d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (81/100), attributed to the coruscant family. 7 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: c9fc3abd32bbd006de0136ba55c7c9b8abfdbf0773179c3347bab4bbe6ff423d
• SHA-1: 19d9b70a4a83380dcc0824a8cabf28681e4f477c
• MD5: 7b8ef61396c623d8528d2abf184f5d20
• imphash: d516002c818cb6583f444c7719b03e5b
• ssdeep: 98304:8k8QY29Ltp5HRbkZXHO+2Ei4y5JmM2c8rpe9CKiRlQJqnfPcY:2QX9LZHuZXHO+2ENy5JmMnape9Cz4gf
• TLSH: T1E564120091363244C6F5DA509C82A42D327395EF097AE5BFD100E1A7E2FD93B787269B
• Submitted as: c9fc3abd32bbd006de0136ba55c7c9b8abfdbf0773179c3347bab4bbe6ff423d
• File type: pe · Size: 5113856 bytes
• Verdict: malicious (81/100) · Family: coruscant

Detections (7 of 55 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.xrt1
• YARA: ESET research: coruscant
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Detect It Easy (packer/type): DIE:Microsoft Linker
• Trellix Stinger (McAfee): Packed-GV!7B8EF61396C6
• Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

• T1057

Why this verdict

The malicious score of 81/100 is the fusion of 7 weighted signals:

• YARA: ESET research flagged coruscant (rule coruscant) - engine signal, weight 0.35, confidence 0.70
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://curl.haxx.se/docs/http-cookies.html, 1.101.3.4 - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: high-entropy-sections:.xrt1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://curl.haxx.se/docs/http-cookies.html
• http://crl.thawte.com/ThawteTimestampingCA.crl0
• http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
• http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
• https://www.verisign.com/rpa
• http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
• https://www.verisign.com/rpa0
• http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
• https://www.verisign.com/cps0*
• http://logo.verisign.com/vslogo.gif04
• http://crl.verisign.com/pca3-g5.crl04

Embedded domains

• curl.haxx.se
• example.com
• crl.thawte.com
• ts-aia.ws.symantec.com
• ts-crl.ws.symantec.com
• www.verisign.com
• csc3-2010-crl.verisign.com
• csc3-2010-aia.verisign.com
• crl.microsoft.com
• logo.verisign.com
• crl.verisign.com
• h.to
• pki-crl.symauth.com

Embedded IP addresses

• 1.101.3.4

File paths

• C:\Users\risku\Downloads\vcpkg-master\buildtrees\cryptopp\src\TOPP_8_2_0-66bcedf47f\sha_simd.cpp
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\cryptopp\src\TOPP_8_2_0-66bcedf47f\rijndael_simd.cpp
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\cryptopp\src\TOPP_8_2_0-66bcedf47f\sse_simd.cpp
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\easy.c
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\setopt.c
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\slist.c
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\multi.c
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\cookie.c
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\asyn-thread.c
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\hostip6.c
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\mime.c
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\conncache.c
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\vtls\vtls.c
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\url.c
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\getinfo.c
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\strdup.c
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\sendf.c
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\connect.c
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\http_digest.c
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\system_win32.c
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\mprintf.c
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\content_encoding.c
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\http_proxy.c
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\transfer.c
• C:\Users\risku\Downloads\vcpkg-master\buildtrees\curl\src\url-7_68_0-cd669cc759\lib\hash.c

More coruscant samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report