MALICIOUS — dce761d88beeed33c55495196a4345d10bd3fc7be027a71d8c83d6040c868e66

MALICIOUS — dce761d88beeed33c55495196a4345d10bd3fc7be027a71d8c83d6040c868e66 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the HUILoader family. 5 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: dce761d88beeed33c55495196a4345d10bd3fc7be027a71d8c83d6040c868e66
• SHA-1: 32a07edc7edb09e431a5e8b7fa6e9f0d97b2abef
• MD5: 4b7dc8f09b5e1417bedd66db9673f9b8
• imphash: 102b65f369bdd7b0e020c5deadca0ce1
• ssdeep: 786432:0jV34LWH24V1xKO6+ZjMyi0KozM9cADamxznVgvPXRx9IWJi6VpML:+SyH24V1x7ZjMyi0Koo97D
• TLSH: T115768CC945A6FB41E5F4CB40DF208F6DA063A4ECB0B8198C0683B07E67FB567A4511E9
• Submitted as: dce761d88beeed33c55495196a4345d10bd3fc7be027a71d8c83d6040c868e66
• File type: pe · Size: 29962240 bytes
• Verdict: malicious (97/100) · Family: HUILoader

Detections (5 of 54 engines)

• capa (capabilities): capability:collection/keylog
• ClamAV (daily): Win.Trojan.Generic-9950561-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

• T1071.001
• T1056.001

Why this verdict

The malicious score of 97/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Generic-9950561-0 (rule Win.Trojan.Generic-9950561-0) - engine signal, weight 0.90, confidence 0.95
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://purl.oclc.org/ooxml/drawingml/chart, http://purl.oclc.org/ooxml/drawingml/diagram, http://purl.oclc.org/ooxml/drawingml/spreadsheetDrawing - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://schemas.microsoft.com/xps/2005/06
• http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
• http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
• http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
• http://office.microsoft.com
• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
• http://schemas.microsoft.com/office/drawing/2010/compatibility
• http://schemas.microsoft.com/office/drawing/2010/slicer
• http://schemas.openxmlformats.org/drawingml/2006/diagram
• http://schemas.microsoft.com/office/webextensions/webextension/2010/11
• http://purl.oclc.org/ooxml/drawingml/chart
• http://purl.oclc.org/ooxml/drawingml/diagram
• http://schemas.openxmlformats.org/drawingml/2006/spreadsheetDrawing
• http://purl.oclc.org/ooxml/drawingml/spreadsheetDrawing
• http://schemas.microsoft.com/office/drawing/2012/timeslicer
• http://schemas.openxmlformats.org/drawingml/2006/chart
• http://schemas.microsoft.com/office/drawing/2014/chartex
• http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac
• http://purl.org/dc/elements/1.1/
• http://www.w3.org/1999/xlink
• http://schemas.microsoft.com/office/spreadsheetml/2010/11/ac
• http://schemas.microsoft.com/office/spreadsheetml/2011/1/ac
• http://schemas.microsoft.com/office/spreadsheetml/2016/revision4
• http://schemas.microsoft.com/office/spreadsheetml/2016/revision5

Embedded domains

• y.sh
• schemas.microsoft.com
• window.name
• c.style.top
• crl.microsoft.com
• www.microsoft.com
• office.microsoft.com
• schemas.openxmlformats.org
• purl.oclc.org
• purl.org
• www.w3.org
• www.msn.com

Embedded IP addresses

• 6.0.1.0

File paths

• F:\Office\Target\x86\ship\postc2r\x-none\excel.pdb
• H:\:c:w:~:
• Q:\:
• W:\:c:h:o:t:{:
• S:\:c:
• R:\:f:p:
• U:\:}:
• X:\:`:d:h:l:p:t:x:
• X:\:`:
• X:\:`:d:h:l:
• P:\:h:
• W:\:r:
• U:\:
• X:\:`:d:h:o:
• O:\:l:
• D:\:g:q:{:
• U:\:o:
• T:\:
• U:\:c:j:q:
• U:\:c:j:q:x:
• X:\:d:h:
• X:\:d:h:p:t:
• X:\:h:l:x:
• X:\:`:d:h:l:p:x:
• X:\:`:d:h:l:p:t:

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report