MALICIOUS — df01bc399631e861542273b72b13a87e036a100ed84bc5f2578bc077bc7bb6b9

MALICIOUS — df01bc399631e861542273b72b13a87e036a100ed84bc5f2578bc077bc7bb6b9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AutoRun family. 11 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: df01bc399631e861542273b72b13a87e036a100ed84bc5f2578bc077bc7bb6b9
SHA-1: 3cf294100cc8896146a5e74348966003ee1a4d14
MD5: c85570e46ef1a9adc38df8bc7cabc94a
imphash: 01392ca861cf87b8d28ad9ea90016bb4
ssdeep: 49152:iggsQWbtL2tLvggsQWbtL2tLcHIYTcwTvVMh4/8b:nV2VKV2VcHIYTcXP
TLSH: T1965AA0885406B26BDAF39E102C680F6C6433B1DA34B92BCC6707D5AF90E3D37949546E
Submitted as: df01bc399631e861542273b72b13a87e036a100ed84bc5f2578bc077bc7bb6b9
File type: pe · Size: 2152723 bytes
Verdict: malicious (100/100) · Family: AutoRun

Detections (11 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): ASPack
ClamAV (daily): Win.Worm.Vindor-9886047-0
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
YARA: Yara-Rules community: YR_AntiDebug_Checks
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Worm:Win32/AutoRun!pz
Emsisoft (Emergency Kit): Gen:Heur.Mint.Autorunner.1
Trellix Stinger (McAfee): Vindor-FTWO!C85570E46EF1
Kaspersky (KVRT): Worm.Win32.AutoRun.vx

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 21 weighted signals:

ClamAV (daily) flagged Win.Worm.Vindor-9886047-0 (rule Win.Worm.Vindor-9886047-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Worm:Win32/AutoRun!pz (rule Worm:Win32/AutoRun!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Mint.Autorunner.1 (rule Gen:Heur.Mint.Autorunner.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Vindor-FTWO!C85570E46EF1 (rule Vindor-FTWO!C85570E46EF1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.AutoRun.vx (rule Worm.Win32.AutoRun.vx) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.55, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70
Contacted 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged ASPack (rule ASPack) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.tutorialspoint.com/javascript/array_map.htm, http://es5.github.io/#x15.4.4.21, http://stackoverflow.com/a/15123777 - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: ASPack, high-entropy-sections:.text, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 22 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

26166 behavior events · 1 ATT&CK techniques · 23 dropped files.

Dropped files

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - 377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe - 6a78dba30ca10f3addef5b1683bd7bc97e98ce03c9e6ae7056845ee1b70b7d10
C:\Program Files\7-Zip\7z.exe - 9a72009b72be1841dd53e0416a30b69efa2ed6f2b6596a21205de52b817d3ee1
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe - 64344604921ecaaa3cb9584784b8388e8a25da04b7b8fe0c12d5b32d2a876639
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe - 63156ae4b122e6f9584581782b64327bfbf60d31ae39de283fd5beeea5aa6746
C:\Program Files\7-Zip\7z.exe - 634d38c0c414178e2f35de5cc0fb29aa082eec227e630c4481e1af7694980ac9
C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\MenuCoreApp\AcroShareTarget.exe - a073010ba3d2e546b2f5f0a0ecbbf43af7dd2fd4be812b8c22a936f6392a7f4f
C:\Program Files\Adobe\Acrobat DC\Acrobat\OSSLLibs\AdobeFips.exe - 94d0018392f19283e268b046f3dccec551e82f0b2ad2c7a7b6799bcc4d1e1d97
C:\Program Files\7-Zip\7zG.exe - 6fb18fb705ca027a95c060cc2b109745c84ec5817001e59b25b417d02ed12733
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe - 7f65f5ae08cc5a15df0c7d70e3fc3ba5b4f083dcbdc02170423867257ffaf076
C:\Program Files\7-Zip\7zG.exe - 7b5eda73c21960c451ea3148900b28cdbac7180e43047fbc944028096e497c08
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe - da6d0544ee3a6b75f3c5c545213b10ec93a15d5213e5232e7e224a29ecb91d6b
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - 713548083352bb677789fcf409b855bcc8c0981bc78a2aed489e4e5d7a5ebab9

Embedded URLs

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/windows0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd
http://www.w3.org/1999/xhtml
https://java.com/moreinfo8/
https://java.com/data/
https://java.com/otnlicense/
http://www.tutorialspoint.com/javascript/array_map.htm
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/filter
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/indexOf
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/Reduce
http://es5.github.io/#x15.4.4.21
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/startsWith
https://developer.mozilla.org/en/docs/Web/JavaScript/Reference/Global_Objects/String/endsWith
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/Trim
http://stackoverflow.com/a/15123777
http://stackoverflow.com/questions/1026069/capitalize-the-first-letter-of-string-in-javascript
http://stackoverflow.com/questions/1068834/object-comparison-in-javascript
http://www.computerhope.com/forum/index.php?topic=76293.0
http://stackoverflow.com/a/1465386/4224163

Embedded domains

www.microsoft.com
crl.microsoft.com
schemas.microsoft.com
w.mx
javadl-esd-secure.oracle.com
oraclevcn.com
oracle.com
www.w3.org
www.tutorialspoint.com
developer.mozilla.org
es5.github.io
stackoverflow.com
e.name
www.computerhope.com
info.name
ns.adobe.com
cacerts.digicert.com
crl4.digicert.com
crl3.digicert.com
www.digicert.com
java.com
aefd.nelreports.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org

Embedded IP addresses

15.4.4.21
5.1.125.0
52.168.117.175
20.247.184.142
4.230.171.124
172.64.154.167
85.210.193.152
40.84.97.4
52.148.114.188
20.89.1.13
20.42.73.26
72.145.35.103
92.223.78.30
52.110.12.2
52.110.12.31

File paths

X:\:`:d:h:l:p:t:x:
X:\:l:p:
P:\:
c:\jenkins\workspace\8-2-build-windows-i586-cygwin\jdk8u281\880\install\src\common\share\Version.h
c:\jenkins\workspace\8-2-build-windows-i586-cygwin\jdk8u281\880\install\src\windows\wrappers\common\UpdateUtils.hpp
c:\jenkins\workspace\8-2-build-windows-i586-cygwin\jdk8u281\880\install\src\windows\common\Dll.h
c:\jenkins\workspace\8-2-build-windows-i586-cygwin\jdk8u281\880\install\src\windows\common\InstalledJavaTracker.h
C:\\jenkins\\workspace\\8-2-build-windows-i586-cygwin\\jdk8u281\\880\\install\\make\\smartmake\\scripting\\util.js
C:\\jenkins\\workspace\\8-2-build-windows-i586-cygwin\\jdk8u281\\880\\install\\make\\smartmake\\scripting\\Arrays.js
C:\\jenkins\\workspace\\8-2-build-windows-i586-cygwin\\jdk8u281\\880\\install\\make\\smartmake\\scripting\\log.js
C:\\jenkins\\workspace\\8-2-build-windows-i586-cygwin\\jdk8u281\\880\\install\\make\\smartmake\\scripting\\activex.js
C:\\jenkins\\workspace\\8-2-build-windows-i586-cygwin\\jdk8u281\\880\\install\\make\\smartmake\\scripting\\deepCompare.js
C:\\jenkins\\workspace\\8-2-build-windows-i586-cygwin\\jdk8u281\\880\\install\\make\\smartmake\\scripting\\Assert.js
C:\\jenkins\\workspace\\8-2-build-windows-i586-cygwin\\jdk8u281\\880\\install\\make\\smartmake\\scripting\\Filename.js
T:\:d:l:t:
X:\:p:
T:\:
T:\:h:t:

More AutoRun samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report