MALICIOUS — db2690b836c93a9d2b3a43b6b2dc598316197f214d37661d9596657a2fbb302d

MALICIOUS — db2690b836c93a9d2b3a43b6b2dc598316197f214d37661d9596657a2fbb302d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Vindor family. 9 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: db2690b836c93a9d2b3a43b6b2dc598316197f214d37661d9596657a2fbb302d
SHA-1: 321995ebb55013d5e3ed9b76bcfc594ac887a840
MD5: 7352fa07ee5d7d5d326ed7f994f6a2b0
imphash: 01392ca861cf87b8d28ad9ea90016bb4
ssdeep: 24576:yQN+BNRTUPmx9UXVrQN+BNRTUPmx9UXVU:5+DAmx9GG+DAmx9G
TLSH: T1BF508CCD4228274FC677DD309950CEAE509374EAA17D295C5A03C33B35A693BAC3219B
Submitted as: db2690b836c93a9d2b3a43b6b2dc598316197f214d37661d9596657a2fbb302d
File type: pe · Size: 800935 bytes
Verdict: malicious (100/100) · Family: Vindor

Detections (9 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): ASPack
ClamAV (daily): Win.Worm.Vindor-9886047-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Worm:Win32/AutoRun!pz
Emsisoft (Emergency Kit): Gen:Heur.Mint.Autorunner.1
Trellix Stinger (McAfee): W32/Worm-GBW!7352FA07EE5D
Kaspersky (KVRT): Worm.Win32.AutoRun.vx

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Worm.Vindor-9886047-0 (rule Win.Worm.Vindor-9886047-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Worm:Win32/AutoRun!pz (rule Worm:Win32/AutoRun!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Mint.Autorunner.1 (rule Gen:Heur.Mint.Autorunner.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/Worm-GBW!7352FA07EE5D (rule W32/Worm-GBW!7352FA07EE5D) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.AutoRun.vx (rule Worm.Win32.AutoRun.vx) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 15 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged ASPack (rule ASPack) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
Packing/obfuscation: ASPack, high-entropy-sections:.text, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 22 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

25343 behavior events · 1 ATT&CK techniques · 24 dropped files.

Dropped files

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe - 6ae6f38cf6f21e778ffe8cd74edb8732be7dc98524f4461e506e0a554424f8c2
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - 377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe - c2a0ab592fcb22b2a3a18e3f89e37a62e10ddb99dc11364c9840036852e8be5d
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe - 6a78dba30ca10f3addef5b1683bd7bc97e98ce03c9e6ae7056845ee1b70b7d10
C:\Program Files\7-Zip\7zFM.exe - 91d4935a350660e0375f114899fc38a17ea415ef375361f393a65281912a8501
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe - 63156ae4b122e6f9584581782b64327bfbf60d31ae39de283fd5beeea5aa6746
C:\Program Files\7-Zip\7z.exe - 634d38c0c414178e2f35de5cc0fb29aa082eec227e630c4481e1af7694980ac9
a61a0e5870d1095f19981c29fd5173b789bd3e705e68176eb53bd65c75e94222 - a61a0e5870d1095f19981c29fd5173b789bd3e705e68176eb53bd65c75e94222
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe - 7f65f5ae08cc5a15df0c7d70e3fc3ba5b4f083dcbdc02170423867257ffaf076
C:\Program Files\7-Zip\7zG.exe - 7b5eda73c21960c451ea3148900b28cdbac7180e43047fbc944028096e497c08
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe - da6d0544ee3a6b75f3c5c545213b10ec93a15d5213e5232e7e224a29ecb91d6b
C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\MenuCoreApp\AcroShareTarget.exe - b0c316f5ab49f02f587d2e5c4734a34a0db071b47f14ba6b71648cbd7c4c8625
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - 441992bf31133460400cf396a2b73431dd7df2354f98b72f8e6ba71d2e5e0d83

Embedded URLs

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/windows0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
http://crl3.digicert.com/assured-cs-g1.crl00
http://crl4.digicert.com/assured-cs-g1.crl0L
https://www.digicert.com/CPS0
http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
http://www.digicert.com/ssl-cps-repository.htm0
http://crl3.digicert.com/sha2-assured-cs-g1.crl05
http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
http://schemas.microsoft.com/SMI/2016/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.microsoft.com
crl.microsoft.com
schemas.microsoft.com
www.digicert.com
crl3.digicert.com
crl4.digicert.com
cacerts.digicert.com
aefd.nelreports.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.2
52.253.84.76
4.230.171.124
4.150.223.113
52.168.112.66
162.159.142.9
4.247.188.233
52.148.114.188
52.110.12.31
52.110.12.20
72.145.35.105
52.110.12.46

File paths

T:\:d:l:t:
C:\Loggers\MyLogger.dll;OutputAsHTML
C:\My.dll
C:\Logger.dll
f:\dd\tools\devdiv\FinalPublicKey.snk
f:\dd\vsproject\xmake\XMakeCommandLine\objr\i386\MSBuild.pdb
C:\A\34\b\bin\amd64\pythonw.pdb
c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\jdk\objs\orbd_objs\orbd.pdb
c:\\path\to\somefile.exe

More Vindor samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report