MALICIOUS — d5be9a3ec2d7d9caa54a2b147b0b44a650d3038afa1b99f2d8ed9c835930e038

MALICIOUS — d5be9a3ec2d7d9caa54a2b147b0b44a650d3038afa1b99f2d8ed9c835930e038 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the CryptInject family. 5 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: d5be9a3ec2d7d9caa54a2b147b0b44a650d3038afa1b99f2d8ed9c835930e038
SHA-1: b04e5bf334f843560f7002beb18b9b70f6c0aaad
MD5: a737a81f8aea1e283ba8e80bca9e4fbc
imphash: 698d5b29719521ffedfb16ac17c5cc8c
ssdeep: 24576:0lGjQmSB4MvfIeNI9hIJIDfJ7R1polGjQmSB4MvfIeNI9hIJIDfJ7R1popolGjQ:0YUmSB4MYLkSV7XpoYUmSB4MYLkSV7X
TLSH: T1A3567D9723AB7528EDE1EA30B9541C1D73F2F49A72BE1A8C15A3D01F33E58A70435162
Submitted as: d5be9a3ec2d7d9caa54a2b147b0b44a650d3038afa1b99f2d8ed9c835930e038
File type: pe · Size: 1447056 bytes
Verdict: malicious (99/100) · Family: CryptInject

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Agent-448770
Microsoft Defender: Trojan:Win32/CryptInject!pz
Emsisoft (Emergency Kit): Trojan.GenericKD.39862403
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

T1547.001

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-448770 (rule Win.Trojan.Agent-448770) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/CryptInject!pz (rule Trojan:Win32/CryptInject!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKD.39862403 (rule Trojan.GenericKD.39862403) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.ks (rule Virus.Win32.Lamer.ks) - engine signal, weight 0.55, confidence 0.85
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.pinkworld.com, http://www.youporn.com, http://www.redtube.com - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 5984) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

16 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.pinkworld.com
http://www.youporn.com
http://www.redtube.com
http://www.assparade.com/
http://www.freeav.com/
http://www.antispyware.com/
http://www.antivirus.com/
http://www.microsoft.com/pki/certs/CSPCA.crt0
http://www.microsoft.com/pki/certs/tspca.crt0
http://www.microsoft.com/directx0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.pinkworld.com
www.youporn.com
www.redtube.com
www.assparade.com
www.freeav.com
www.antispyware.com
www.antivirus.com
crl.microsoft.com
www.microsoft.com

Embedded IP addresses

20.42.65.94
4.230.171.124
57.155.101.212
52.230.59.222
20.165.94.54
20.42.73.30
135.232.92.137
104.18.33.89
135.233.45.222
92.223.78.30
52.110.12.32
52.110.12.11

File paths

H:\:p:
C:\Windows\system32\d3dx10_36.dll
C:\Program
C:\Progr

More CryptInject samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report