MALICIOUS — d23f9cb490a9df16685c05b5516d05c1028d569ff667a28592b278e64a20e55c

MALICIOUS — d23f9cb490a9df16685c05b5516d05c1028d569ff667a28592b278e64a20e55c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Pidgeon family. 11 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: d23f9cb490a9df16685c05b5516d05c1028d569ff667a28592b278e64a20e55c
SHA-1: 0b53f79f7c42bb535e7589617e480c9eef5a71e7
MD5: 201a7ccecadb997a2722ffc0f4a73a5d
imphash: d50a56fe2fe20efe02049287d3cb46cc
ssdeep: 98304:i8ak7n8ak7o+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsq:i87n87JmAn
TLSH: T18B619DCD422A6741E7F1DA205C008D9C9052F5F8A07D6D8C0A87C17F26F6977AAB50EE
Submitted as: d23f9cb490a9df16685c05b5516d05c1028d569ff667a28592b278e64a20e55c
File type: pe · Size: 3838251 bytes
Verdict: malicious (100/100) · Family: Pidgeon

Detections (11 of 55 engines)

capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:
ClamAV (daily): Win.Packed.Pidgeon-9909600-0
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
YARA: Yara-Rules community: YR_AntiDebug_Checks
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Heur.Mint.Autorunner.1
Kaspersky (KVRT): Worm.Win32.AutoRun.vx

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Packed.Pidgeon-9909600-0 (rule Win.Packed.Pidgeon-9909600-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 21 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://nsis.sf.net/NSIS_Error - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 26 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

25506 behavior events · 1 ATT&CK techniques · 33 dropped files.

Dropped files

C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe - 3e27cc6407fc7d7b6e26495c6ff849c23cf3b6e9c8a885ea742ad7b3109af536
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - 51e57fdf672acec905dc11fb467293a6c1251683cb92e769d451e46b9e0e92d6
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\klist.exe - 4b01e66224c739290869037fbe8d9d6fb2d121cb9fce803f13f18ee96e5a82e2
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jrunscript.exe - 3c6d62569a6dbad19d57ab33039ea0626a3eaf4386fa8b207c136957b26005ab
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - c4c65264e0d3b9b31c5262259ec4b8af6ec62a1fff918a98910aabf17f015959
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccessinspector.exe - 201217a294d0c50872de9f0fb17d89a17d2b90bbd3e60bcdba62d9392fb7d3bb
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe - 8c435a45123e88410f42259fcb3b303b5f60ce00e01d8d4a9c5bd342bf51e184
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - 599e533da3261e2fc678ccc3393bb90cafa7ce620196168b9c5cb41a4e48099b
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccessinspector.exe - a7487ee88d94f322148489c818cc861ee1e77ec31ce5b5e7b5e999c0d5acf6f6
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaw.exe - 00293b1fc4c093b570c7a9433fb5b16b188e938061cacf6f7a35721a6f346acb
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaw.exe - 4e0cfa88df31f158ea5b391ea532ad7729d1261c94510d6b5975b2084390d0cf
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jrunscript.exe - 411c4251fdcbe7fe7c3388f2be47dceda63a6e62f1e213f853768b84af3627fd
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe - 256f7923959ffd01a282d0c3620acce8911a15755c6dff161b63aac4952557f1
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - 18f26881948524747f3fd17802ed9cdee4d3d378284d9d96973d709cf31d3228

Embedded URLs

http://schemas.microsoft.com/appx/2010/manifest
http://schemas.microsoft.com/appv/2010/manifest
http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
http://crl3.digicert.com/assured-cs-g1.crl00
http://crl4.digicert.com/assured-cs-g1.crl0L
https://www.digicert.com/CPS0
http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
http://www.digicert.com/ssl-cps-repository.htm0
http://crl3.digicert.com/sha2-assured-cs-g1.crl05
http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://crl.thawte.com/ThawteTimestampingCA.crl0
http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
https://www.verisign.com/rpa
http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
https://www.verisign.com/rpa0

Embedded domains

schemas.microsoft.com
www.digicert.com
crl3.digicert.com
crl4.digicert.com
cacerts.digicert.com
crl.microsoft.com
www.microsoft.com
office.microsoft.com
crl.thawte.com
ts-aia.ws.symantec.com
ts-crl.ws.symantec.com
www.verisign.com
csc3-2010-crl.verisign.com
csc3-2010-aia.verisign.com
logo.verisign.com
crl.verisign.com
nsis.sf.net
mozilla.org
support.mozilla.org
www.mozilla.org

Embedded IP addresses

203.26.79.13
20.42.73.30
57.154.63.210
4.230.171.124
4.144.132.114
135.232.92.137
20.184.175.22
74.178.240.51
20.184.175.10
20.236.44.162
52.123.129.14
52.123.128.14
74.178.232.29
135.234.160.244
52.148.114.188
72.153.5.131
40.74.98.198
51.11.192.50
135.233.95.80
52.110.12.32
52.110.12.28

File paths

F:\Office\Target\x86\ship\postc2r\x-none\orgchart.pdb
L:\:o:z:
V:\:r:x:
N:\:i:f;~;
V:\:b:h:n:t:z:
C:\re\jdk7u45\229\build\windows-amd64\tmp\sun\launcher\tnameserv\obj64\tnameserv.pdb
C:\Users\jim\Desktop\metro
T:\:d:l:t:
C:\Program

More Pidgeon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report