MALICIOUS — dc0f46cb2bd9c0d29f40bc2a6da2b8f2a077b32b2c181b9cd7fcd099668714a8
MALICIOUS — dc0f46cb2bd9c0d29f40bc2a6da2b8f2a077b32b2c181b9cd7fcd099668714a8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100). 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
dc0f46cb2bd9c0d29f40bc2a6da2b8f2a077b32b2c181b9cd7fcd099668714a8 - SHA-1:
d4c49edbcaee46d33841994df6ee421882c39ebf - MD5:
6653c079f8143b3e0e3535a8f8498b82 - imphash:
f34d5f2d4577ed6d9ceec516c1f5a744 - ssdeep:
98304:Wccdt6RgWP6ug5s57+UhWxy+6eX4y13DjaiFn/kE:Wccdt6t6T5sdhTfeT13PaiL - TLSH:
T1846202A9650D6831E47E87D6B8B10E4DB193B8A3357325887372C79B23EBC63509C09D - Submitted as: dc0f46cb2bd9c0d29f40bc2a6da2b8f2a077b32b2c181b9cd7fcd099668714a8
- File type: pe · Size: 4527616 bytes
- Verdict: malicious (95/100)
Detections (4 of 55 engines)
- capa (capabilities): capability:execution/powershell
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
- Emsisoft (Emergency Kit): Gen:Variant.Razy.121964
- Kaspersky (KVRT): UDS:Trojan.MSIL.Vimditator.gen
MITRE ATT&CK
Why this verdict
The malicious score of 95/100 is the fusion of 9 weighted signals:
- Emsisoft (Emergency Kit) flagged Gen:Variant.Razy.121964 (rule
Gen:Variant.Razy.121964) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged UDS:Trojan.MSIL.Vimditator.gen (rule
UDS:Trojan.MSIL.Vimditator.gen) - engine signal, weight 0.55, confidence 0.85 - execute via PowerShell (rule
execute via PowerShell) - capa signal, weight 0.40, confidence 0.80 - Contacted 1 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- capa (capabilities) flagged capability:execution/powershell (rule
capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule
high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://www.google-analytics.com/collect, https://anonymousvpn.org/, https://anonymousvpn.org/#pricing - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
- Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
5725 behavior events · 0 ATT&CK techniques · 5 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- desktop-hsgcbep
- login.live.com
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- settings-win.data.microsoft.com
- fe3cr.delivery.mp.microsoft.com
- licensing.mp.microsoft.com
- v10.events.data.microsoft.com
- slscr.update.microsoft.com
Dropped files
- 168156c46cc3160e01a8a8fa084fc31d3b4fc8e9c302b23687f0d182ef1b971f -
168156c46cc3160e01a8a8fa084fc31d3b4fc8e9c302b23687f0d182ef1b971f - 42226b7d4dac512ed0f2ab0b9b5baa0a246641759539f4b09922e4ee433d10a3 -
42226b7d4dac512ed0f2ab0b9b5baa0a246641759539f4b09922e4ee433d10a3 - b57347a70851d6515198e039c60d48420c285bd2b3d0de11da5f2cc9d2edcb34 -
b57347a70851d6515198e039c60d48420c285bd2b3d0de11da5f2cc9d2edcb34 - d674e30ba31a9080fdef1d1553d6e00294c3ed54b93ef28a3912a3709c2ae445 -
d674e30ba31a9080fdef1d1553d6e00294c3ed54b93ef28a3912a3709c2ae445 - aa4f1ed5b0ea9bc626e6bf79db622b4192177432b40eda5a05729c557688ff91 -
aa4f1ed5b0ea9bc626e6bf79db622b4192177432b40eda5a05729c557688ff91
Embedded URLs
- http://www.google-analytics.com/collect
- https://anonymousvpn.org/
- https://anonymousvpn.org/#pricing
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#
- http://www.winimage.com/zLibDll
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- time4videostream.xyz
- video4time.net
- time-popcorn.info
- time-popcorn.com
- thepopcorntime.net
- the-pop-corn-time.net
- popcorn-time.to
- time-popcorn.net
- time4videostream.com
- www.google-analytics.com
- anonymousvpn.org
- s.jp
- 99.fi
- d.sg
- www.w3.org
- ns.adobe.com
- www.winimage.com
Embedded IP addresses
- 52.168.112.66
- 4.230.171.124
- 4.247.188.224
- 135.232.92.97
- 20.247.185.124
- 135.232.92.137
- 20.42.65.88
- 172.64.154.167
- 52.110.12.47
- 52.110.12.37
- 52.110.12.40
Registry keys
- HKEY_CURRENT_USER\Software\Classes
- HKEY_CURRENT_USER\Software\Classes\
File paths
- c:\sw-post
- q:\vT
- C:\Dev\pt\pt-desktop\gui\releaseW\PopcornTimeDesktop.pdb
- B:\:m:z:
- S:\:e:n:
- B:\:m:{:
- M:\:i:v:
- X:\:`:d:h:l:p:t:x:
- X:\:`:d:h:l:t:
- T:\:d:l:t:
- T:\:d:p:
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report