MALICIOUS — d40b7935c1d4aafadaac8489ec94a1c8ba156d6255e926d65d9158ce7d504f12

MALICIOUS — d40b7935c1d4aafadaac8489ec94a1c8ba156d6255e926d65d9158ce7d504f12 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Gencbl family. 10 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: d40b7935c1d4aafadaac8489ec94a1c8ba156d6255e926d65d9158ce7d504f12
SHA-1: e2ab4c86bcdc1baf9c73c26cda55270c0e9092e7
MD5: a23fb6c874c1f7d62f7c0d5ea349ce46
imphash: a5f1bdf09fcdcc3bc3ae97974a05c0cc
ssdeep: 196608:mJQaPHrQqXs140qMhu8369sV+HLz9SKUeNdDhHidVI1SM52n3iWuUZ/rkFJjzutw:mJQaPHrQqXs140qMhu8369sV+HLz9SK9
TLSH: T16F6B01A02117B121E1F7E404DC31C8ED943B766ED0B0AB889647DF6A41EAE37D5D02DA
Submitted as: d40b7935c1d4aafadaac8489ec94a1c8ba156d6255e926d65d9158ce7d504f12
File type: pe · Size: 10001704 bytes
Verdict: malicious (100/100) · Family: Gencbl

Detections (10 of 55 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
ClamAV (daily): Win.Malware.Ursu-9627966-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
YARA: Yara-Rules community: YR_Packer_VMProtect
Detect It Easy (packer/type): DIE:Microsoft Visual C/C++
Microsoft Defender: Trojan:Win32/Gencbl!mclg
Emsisoft (Emergency Kit): Gen:Variant.Jatif.10711
Kaspersky (KVRT): HEUR:Trojan.Win64.Generic

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Ursu-9627966-0 (rule Win.Malware.Ursu-9627966-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Contacted 18 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_VMProtect (rule YR_Packer_VMProtect) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Visual C/C++ (rule DIE:Microsoft Visual C/C++) - engine signal, weight 0.35, confidence 0.70
query domain / anti-analysis (rule query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://boxedapp.com/boxedappsdk/order.html - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: Themida/VMProtect, high-entropy-sections:.vmp0, Microsoft Visual C/C++ - static signal, weight 0.25, confidence 0.55
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis (windows)

553 behavior events · 0 ATT&CK techniques · 5 dropped files.

Dropped files

0e070dea7790d87d3ca5c67c54e89764a641f144ed39084971d8c7341ad95a02 - 0e070dea7790d87d3ca5c67c54e89764a641f144ed39084971d8c7341ad95a02
9072ca32a0543d5df0ea9bf4540fa766adc379e8126bcdbaffadf250f59c5809 - 9072ca32a0543d5df0ea9bf4540fa766adc379e8126bcdbaffadf250f59c5809
b7f9647ed0102ceb2d5100c7e601e8aa5b34e32d7d422a4d8d2ab2d9e6758b0b - b7f9647ed0102ceb2d5100c7e601e8aa5b34e32d7d422a4d8d2ab2d9e6758b0b
a2c87b38f1626a956266cbe3388f3ae503a6bbf24d0d8fe7a6fbb34f67acefd8 - a2c87b38f1626a956266cbe3388f3ae503a6bbf24d0d8fe7a6fbb34f67acefd8
cad378d4b7b34d0704f0fb2514d06def051c5cfe3769911aea848e2ace4d1d7e - cad378d4b7b34d0704f0fb2514d06def051c5cfe3769911aea848e2ace4d1d7e

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
https://sectigo.com/CPS0
https://sectigo.com/CPS0D
http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v
http://boxedapp.com/boxedappsdk/order.html
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787831185&P2=404&P3=2&P4=KunxtK78tpticDYM8gwZulYoptxbtcx2piyEbnE%2f8fvrm4grWQ5wljHECjNckWy%2fA1O2co%2ff9WuduuQup9ILdQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

1.to
u.it
oy.tv
schemas.microsoft.com
crl.comodoca.com
crl.sectigo.com
crt.sectigo.com
sectigo.com
crl.usertrust.com
crt.usertrust.com
boxedapp.com

Embedded IP addresses

20.184.175.13
52.230.59.222
40.84.85.40
4.230.171.124
135.232.92.137
4.150.223.103
74.178.240.51
52.123.129.14
20.231.239.246
52.123.128.14
203.26.79.13
135.234.160.244
172.178.240.161
74.178.232.29
52.148.114.188
72.154.7.112
52.110.12.44
52.110.12.53

File paths

v:\builds\BoxedApp\files\A762B510\src\BoxedApp\bxsdk\bin\release_full\bxsdk64.pdb
V:\builds\BoxedApp\files\A762B510\src\BoxedApp\bxsdk\obj\x64\Release_Full\BoxedAppSDK_AppDomainManager.pdb
v:\builds\boxedapp\files\a762b510\src\boxedapp\bxsdk\obj\x64\release_full\boxedappsdkthunk\BoxedAppSDKThunk.pdb
v:\builds\boxedapp\files\a762b510\src\boxedapp\bxsdk\obj\x64\release_full\tlssupport\TLSSupport.pdb
V:\oN]
g:\gVz
V:\~7
o:\[%Hv

More Gencbl samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report