MALICIOUS — dd084865d5e20c1a8de4b3e23c1945a6bf1f554728589daf75967cb49f4d8382

MALICIOUS — dd084865d5e20c1a8de4b3e23c1945a6bf1f554728589daf75967cb49f4d8382 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fileinfector family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: dd084865d5e20c1a8de4b3e23c1945a6bf1f554728589daf75967cb49f4d8382
SHA-1: f69c93d147a3682368d70ed7f5e353af7641458b
MD5: e6c1883bf66600d38f42b667d8e752b1
imphash: 895fbb56c02c3d2bca3125cef5da8730
ssdeep: 384:GTe/OmxDMmkhdQhVGqpXL9vZZsW0Z080t0M0mIiNCTe/OruxZiTTLCy:ae2mxDMm+STZ5UW0Z080t0M0Cke2aDi
TLSH: T1813482D531967650EDF4F809AD08E81DF22288A222373BE81401D17F75B97F706E992E
Submitted as: dd084865d5e20c1a8de4b3e23c1945a6bf1f554728589daf75967cb49f4d8382
File type: pe · Size: 57344 bytes
Verdict: malicious (100/100) · Family: Fileinfector

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Fileinfector-9832954-0
Detect It Easy (packer/type): DIE:MinGW
Microsoft Defender: flagged
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Fileinfector-9832954-0 (rule Win.Malware.Fileinfector-9832954-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.ks (rule Virus.Win32.Lamer.ks) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1622, T1082 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MinGW (rule DIE:MinGW) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, MinGW - static signal, weight 0.25, confidence 0.55
Dropped 23 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

94800 behavior events · 2 ATT&CK techniques · 38 dropped files.

Dropped files

C:\Windows\System32\vccorlib140.dll - d965efc075935fae8485b214c7e69faae96bd519b7a1e3901e65f74bf9405fee
C:\Windows\WindowsUpdate.log - 2898e244f098d52d7200609fcfe31470b42fc6dc31d5e7500def4fd21086eec5
C:\Windows\System32\vcruntime140_threads.dll - a957d4f17de7fee80eb5b787e617c27872c070b526fd02aaee888861a6071dec
C:\Windows\setuperr.log - 0c0fdefb8c0be961ecc5d254521ebdb2b04ac7bd8058be0df48858bf9a35b622
C:\Windows\py.exe - a057f7a5d79e834e7f05326a715706e7c04890f9773b35b1829fefb0e8d49b5d
C:\Windows\system.ini - 3029d1567114da5b6441a9ed73badf0f7b9bb61ed8a3f19dc5fd0609e1377050
C:\Windows\System32\opencl.dll - 57c09c88d32a853803bff49ea51eca52d43025e50683ac1fe60033cafcfd41cd
C:\Windows\System32\vulkan-1.dll - dafed72aefe0b2ddbcff5e2e54c796fb50e325a91ebd564176a80d9ddcd63852
C:\Windows\System32\msvcp140_2.dll - 9ac32ba0a4fb1c66667f061eab7bfd9b37365ff687d0e2c3e2674962a57c56f6
C:\Windows\System32\vcruntime140.dll - 9447358e284ae58db43275eb0d2e9606aba91a85e41ee99071aed531dee1ad50
C:\Windows\System32\msvcp140.dll - 023ed698f64f18b7973d65d0d8e2d846768ed66f461abd59a87f7cb52dc7a6d7
C:\Windows\pyw.exe - 27327088f76119cf95c4291a91f4040ffb5773a87f172821c9eace18bcdc052a
C:\Windows\System32\NOISE.DAT - 6faa1143cdecbcfc1c8b9d8164895b287b2e250ff302a6153d21069bc512b24a
C:\exc.exe - cf17201308925cceb3cf0ec6cd7e11e168efd2b3f8d9d2b5c08df0e7cfe73261
C:\Windows\System32\mmc.exe.config - b17250b4626ae740df67a995084c6a4e4e1ea9a861d4ce2343b600947e6c7ded

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.117.174
52.123.252.245
4.144.132.223
4.230.171.124
104.18.33.89
135.233.45.221
20.42.179.204
57.154.63.210
135.234.160.245
52.148.114.188
40.79.141.154
20.184.175.22
52.110.12.54
72.153.5.129
52.110.12.40

More Fileinfector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report