MALICIOUS — dcda4ee416c86bb0ebcf713701b66bdeac9c83db467cb174a817b27ec519e3ce

MALICIOUS — dcda4ee416c86bb0ebcf713701b66bdeac9c83db467cb174a817b27ec519e3ce is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100). 5 of 55 detection engines flagged it.

Identification

SHA-256: dcda4ee416c86bb0ebcf713701b66bdeac9c83db467cb174a817b27ec519e3ce
SHA-1: 449fca5df6fec6b9297361d66828f5c75dfc812a
MD5: 0496ac6a1faa494536f26aef5e4f2fa4
imphash: fdcd00eeda1f152f445a098686d4f9b5
ssdeep: 3072:nS4iQo63gcBJowQ0Z6G+UTJRtQxOMugRaxnUIbk/UYl1/L8:nSlQgImw369UTJdYiTYl1/L
TLSH: T15341806F309389BFC30A27847FD028CC13A217DA21575CA6E049D2D9D9A53FBAE90475
Submitted as: dcda4ee416c86bb0ebcf713701b66bdeac9c83db467cb174a817b27ec519e3ce
File type: pe · Size: 192783 bytes
Verdict: malicious (97/100)

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Malware.Generickdz-10004857-0
Microsoft Defender: Trojan:Win32/Fareit!pz
Emsisoft (Emergency Kit): Gen:Variant.Worm.VB.112
Kaspersky (KVRT): Trojan.Win32.VB.dosp

Why this verdict

The malicious score of 97/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Malware.Generickdz-10004857-0 (rule Win.Malware.Generickdz-10004857-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 4 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Contacted 20 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://www.iec.ch - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/photoshop/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
http://ns.adobe.com/xap/1.0/sType/ResourceRef#
http://www.iec.ch
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787907051&P2=404&P3=2&P4=ZocJqulcydR044QSacMNYzo46UxRc5P%2bMSlCknDb8s5xckyxUbGAQCa7t40QQPPsO4o0nho0f2JFtLJM71fNjw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787907074&P2=404&P3=2&P4=U6pM1YxOF%2bI83d4dGtm0XNSkfBd90GRO3WIWmw%2fP2cTy%2b1f1ai%2f1FzqkDPkQnAn3I4GKmR3QOfOmwN4Zu0WfrA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ns.adobe.com
www.w3.org
url.org
www.iec.ch

Embedded IP addresses

40.79.150.120
4.230.171.124
4.144.132.223
40.84.97.4
48.211.4.16
135.232.92.137
104.46.162.229
74.178.240.51
203.26.79.13
20.184.175.9
74.178.232.29
52.123.129.14
20.76.201.171
40.103.64.226
135.233.45.221
52.148.114.188
72.145.35.110
52.110.12.4
57.154.63.210
52.110.12.30

File paths

C:\Program

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report