MALICIOUS — dd3b958d34001c1e3eb9314fdd2f72a011af54e9647b44902c21a7041c4d9920

MALICIOUS — dd3b958d34001c1e3eb9314fdd2f72a011af54e9647b44902c21a7041c4d9920 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the LODEINFO family. 2 of 55 detection engines flagged it.

Identification

SHA-256: dd3b958d34001c1e3eb9314fdd2f72a011af54e9647b44902c21a7041c4d9920
SHA-1: f5abdc410d684985dc3a264469e197319b65141b
MD5: 31d2bb68963ae3ea06b47a2e088b8c86
imphash: 7561708a4d76393e3992ac2ea91e3cf6
ssdeep: 49152:hdbdMSvXBCr+31WcI88NlDmOTAIhnMR66x5WN+Q6zICkQKq:rJnR34cGlKdIdMnf3ZR
TLSH: T1035EBED3519FCD0AC8536BD31AD4439CA529E648E3B04BA60148AEBDC87D17FBF25122
Submitted as: dd3b958d34001c1e3eb9314fdd2f72a011af54e9647b44902c21a7041c4d9920
File type: pe · Size: 2898552 bytes
Verdict: malicious (97/100) · Family: LODEINFO

Detections (2 of 55 engines)

ClamAV (daily): Win.Malware.Genpack-9875154-0
YARA: JPCERT/CC: JPCERT_LODEINFO

Why this verdict

The malicious score of 97/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Malware.Genpack-9875154-0 (rule Win.Malware.Genpack-9875154-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Contacted 21 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_LODEINFO (rule JPCERT_LODEINFO) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, https://www.gnu.org/software/automake/manual/automake.html, http://fsmsh.com/2753 - static signal, weight 0.35, confidence 0.60
Extracted generic config (5 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://creativecommons.org/publicdomain/zero/1.0/
https://www.gnu.org/software/automake/manual/automake.html
http://fsmsh.com/2753
https://autotools.io/index.html
http://miller.emu.id.au/pmiller/books/rmch/
https://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-cs-g1.crl05
http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
http://www.digicert.com/ssl-cps-repository.htm0
https://github.com/mpc-hc/mpc-hc/blob/master/docs/Changelog_old.txt
http://rfb.gov.br/
http://www.java.com/pt_BR/download/manual.jsp
http://www.java.com/pt_BR/download/windows_manual.jsp
http://go.microsoft.com/fwlink/?linkid=131534
http://go.microsoft.com/fwlink/?linkid=131531
http://go.microsoft.com/fwlink/?LinkId=130274
http://go.microsoft.com/fwlink/?LinkId=63443
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787742630&P2=404&P3=2&P4=KpZNgZk4%2bTy0tV6C0VYqCT4xxo7FjtM0trjsmkiuuXdf13egWVpFqkWpqLZWD9XsVeh%2fXOEaVo8QxTEEnjMzqg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

creativecommons.org
geocities.com
www.gnu.org
fsmsh.com
autotools.io
miller.emu.id.au
cacerts.digicert.com
crl4.digicert.com
crl3.digicert.com
www.digicert.com
github.com
f.ml
rfb.gov.br
www.java.com
go.microsoft.com

Embedded IP addresses

20.42.65.88
52.123.252.247
20.247.185.124
40.84.85.40
4.230.171.124
135.232.92.137
20.42.73.24
74.178.76.54
20.42.73.30
203.26.79.13
20.112.250.133
40.99.134.18
52.123.129.14
52.123.128.14
52.123.252.230
20.165.94.46
52.148.114.188
135.233.45.221
72.154.7.108
52.110.12.44
52.110.12.40

More LODEINFO samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report