MALICIOUS — d13e2bcbb9d5cb03d015890f4a92561bec62265da69bddd3a667bd983bba0f9b

MALICIOUS — d13e2bcbb9d5cb03d015890f4a92561bec62265da69bddd3a667bd983bba0f9b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Dqan family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: d13e2bcbb9d5cb03d015890f4a92561bec62265da69bddd3a667bd983bba0f9b
SHA-1: cc58daee1430fa706e44abf0ab1e3f26ba66cc77
MD5: bf97ccbfc3de35848f5df85297cc1202
imphash: 1cbf379b9b890e14b7cc9db6f1e28ccb
ssdeep: 24576:3z1ay0rUJU4TayesvzcHKuaRROwflmr7:DKCi0zc1ADfQ
TLSH: T125539EC51916B302F6BBABD01F358A8DA001E956826934198B57C07E1BFF833276D49F
Submitted as: d13e2bcbb9d5cb03d015890f4a92561bec62265da69bddd3a667bd983bba0f9b
File type: pe · Size: 1085440 bytes
Verdict: malicious (99/100) · Family: Dqan

Detections (5 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Dqan-9886400-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: flagged

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Dqan-9886400-0 (rule Win.Malware.Dqan-9886400-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.eyuyan.com - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/CheckMachineStatusRequest
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/CheckMachineStatusResponse
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetEntitlementsForOlsIdentityRequest
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetEntitlementsForOlsIdentityResponse
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetEntitlementForMachineKeyRequest
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetEntitlementForMachineKeyResponse
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetKeyRequest
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetKeyResponse
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetLicenseRequest
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetLicenseResponse
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetOlsLicenseRequest
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetOlsLicenseResponse
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetSessionTokenRequest
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetSessionTokenResponse
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetTokenRequest
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetTokenResponse
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetWpkBindingRequest
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/GetWpkBindingResponse
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/ReportActivationRequest
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi/IOlsClient/ReportActivationResponse
http://schemas.microsoft.com/office/licensingservice/API/2012/01/Api/ServerFault
http://schemas.microsoft.com/office/licensingservice/API/2012/01/ClientApi
http://schemas.microsoft.com/2003/10/Serialization/Arrays
http://schemas.datacontract.org/2004/07/Microsoft.Office.LicensingService
http://schemas.datacontract.org/2004/07/Microsoft.Office.LicensingService.Common

Embedded domains

schemas.microsoft.com
schemas.datacontract.org
crl.microsoft.com
www.microsoft.com
office.microsoft.com
ols.officeapps.live.com
www.eyuyan.com

Embedded IP addresses

20.42.65.90
52.123.252.232
4.144.132.223
4.230.171.124
48.211.4.16
135.232.92.137
74.178.240.51
20.42.65.84
74.178.76.128
104.18.33.89
125.56.205.42
52.110.12.38
52.110.12.28
125.56.205.51

File paths

F:\Office\Target\x86\ship\postc2r\x-none\olicenseheartbeat.pdb
R:\:{:
X:\:h:l:x:

More Dqan samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report