MALICIOUS — ce72284661e74832738f06c8e0e16c772e5e3563a09fb3d129473f2ff1a23149

MALICIOUS — ce72284661e74832738f06c8e0e16c772e5e3563a09fb3d129473f2ff1a23149 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 3 of 56 detection engines flagged it.

Identification

• SHA-256: ce72284661e74832738f06c8e0e16c772e5e3563a09fb3d129473f2ff1a23149
• SHA-1: d15b98ae8bbfff6a2341228750012bf336dc1556
• MD5: 8d5b2e35a5be3d56bac0cc9f5ea88dd3
• imphash: f34d5f2d4577ed6d9ceec516c1f5a744
• ssdeep: 96:L1k3uWD0eL/SgoiMM2WUp02cFcE2QYlnlYJnLLPL0KffLTlPv1VRXmm5F6TPXf7:L1k3iu0bECVpnlYJLLLTTzPGj+uD
• TLSH: T1BC1FE8CE043C6746D676FD372042D97E9592F4D668B60A0E025084B34DB9A37A93F38B
• Submitted as: ce72284661e74832738f06c8e0e16c772e5e3563a09fb3d129473f2ff1a23149
• File type: pe · Size: 7680 bytes
• Verdict: malicious (93/100)

Detections (3 of 56 engines)

• Microsoft Defender: Trojan:MSIL/Starter.EA!MTB
• Emsisoft (Emergency Kit): Gen:Trojan.Mardom.IN.9
• Kaspersky (KVRT): Trojan.MSIL.Starter.dq

Why this verdict

The malicious score of 93/100 is the fusion of 5 weighted signals:

• Microsoft Defender flagged Trojan:MSIL/Starter.EA!MTB (rule Trojan:MSIL/Starter.EA!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Trojan.Mardom.IN.9 (rule Gen:Trojan.Mardom.IN.9) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Trojan.MSIL.Starter.dq (rule Trojan.MSIL.Starter.dq) - engine signal, weight 0.55, confidence 0.85
• Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75

Dynamic analysis (windows)

2000 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• licensing.mp.microsoft.com
• config.edge.skype.com
• windows.msn.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• assets.msn.com
• www.bing.com
• settings-win.data.microsoft.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Dropped files

• f9fe8db901a96061b7766dbc6c711b374a65a1d736fa9d625540bc2eca78746e - f9fe8db901a96061b7766dbc6c711b374a65a1d736fa9d625540bc2eca78746e

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded IP addresses

• 20.42.65.93
• 20.247.185.124
• 4.230.171.124
• 40.84.85.40
• 52.110.12.30
• 52.110.12.48

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report