MALICIOUS — e06abdc0104845361a19f0ab2019f70bfe792a11d94c70810c62591ac29f3a07

MALICIOUS — e06abdc0104845361a19f0ab2019f70bfe792a11d94c70810c62591ac29f3a07 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Viking family. 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: e06abdc0104845361a19f0ab2019f70bfe792a11d94c70810c62591ac29f3a07
SHA-1: 97bc0d2b63b03436e9d624b8ba262067621cd936
MD5: c4b7b3e5e88f844818c6027243c96581
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmitTFxszadCi:qKtfDwsjPThTYszDH2f5s2p
TLSH: T1F8379E295B2B2B83EFB6C7320850B70D4061F97960BA14885363D17FB7FAC235A6424C
Submitted as: e06abdc0104845361a19f0ab2019f70bfe792a11d94c70810c62591ac29f3a07
File type: pe · Size: 74632 bytes
Verdict: malicious (100/100) · Family: Viking

Detections (6 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Delf-1564
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Viking.MS
Emsisoft (Emergency Kit): Trojan.Agent.FPMF
Kaspersky (KVRT): Virus.Win32.Lamer.xe

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Dropped a malicious payload (GameThief): virDll.dll - dynamic signal, weight 0.62, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.MS (rule Virus:Win32/Viking.MS) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.FPMF (rule Trojan.Agent.FPMF) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.xe (rule Virus.Win32.Lamer.xe) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

13217 behavior events · 0 ATT&CK techniques · 101 dropped files.

Dropped files

C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\w64-arm.exe - fc7f8311df1c6de973e3a65895eae1d07f6d44518093a7c72a413c2490d1caed
C:\Program Files\Google\Chrome\Application\152.0.7977.64\notification_helper.exe - 60581ba7d6d8c9c648c22b0a2b0215ea922ff82e971ae9fe7df081b71f7ce737
C:\Program Files\LibreOffice\program\sbase.exe - adb34717a939f825fede695763310ffb45e96f0d2693e44ea0154c7a4d623b2e
C:\Program Files\LibreOffice\program\scalc.exe - 37fd3455ddb612f43e3a3fed0c1b727cbd25a5eacc567f5d7f2c344eaf18cebe
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe - 198074bee12d691137e02a8e305eb05f263c948675c80469097e89ea1f76ee1f
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe - 8a59c2b58a5a5d828c1aecdc9961bd71c42cb4cdeb6bc5335f3c00789c475141
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe - 2f72f7be6f53d750a734bd51c68f5f0dde357f1b269625a5238c9b1ef8575d94
C:\Program Files\LibreOffice\program\gpgme-w32spawn.exe - 480507489844c8b71025c2e04cca58dbaaa32d3f206eb469f4fb79a080ec92fb
C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe - 271dfde2aa858525cf0e85c44abd17083a4f620dfe6cd2841f8e329bbac3ea32
C:\Program Files\LibreOffice\program\soffice_safe.exe - 51ae3e138da089b3776e99dbb3009ea0499e1b0642f3eb738438d198909943e3
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Adobe\Acrobat DC\Acrobat\CPInstCU.exe - f3dfc83427871809f7e2ef3ed514b2210d4d3a6e4196ff042f18e7c705ea9e7d
C:\Program Files\LibreOffice\program\regview.exe - 32b68a2a059bf66482e2a49d205a3b2bbede75e3b98fdaf466e2bc67193564a3
C:\Program Files\LibreOffice\program\soffice.exe - 8cef10a1542e44308e268627d883594a8d0280c996cefa81f4380f42c372d971
C:\Program Files\LibreOffice\program\opencltest.exe - d0f76cba71662a3fcd63731a490d41b0e9b71484172ff55d27f5e9e8fd0f69b5

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://crl.verisign.com/tss-ca.crl0
https://www.verisign.com/rpa
https://www.verisign.com/cps0*
https://www.verisign.com/rpa0
http://logo.verisign.com/vslogo.gif0
http://crl.verisign.com/pca3.crl0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

schemas.microsoft.com
crl.verisign.com
www.verisign.com
logo.verisign.com
csc3-2009-2-crl.verisign.com
csc3-2009-2-aia.verisign.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

192.168.0.30
192.168.8.1
4.150.223.114
52.123.252.198
4.230.171.124
172.215.188.225
20.247.185.124
74.178.240.51
74.179.77.204
4.150.223.115
51.11.192.49
20.247.184.197
40.79.167.9
20.50.73.15
135.232.92.137
34.104.35.123
48.200.63.27
4.150.223.106
4.207.44.70
203.26.79.13
52.148.114.188
72.145.35.100
52.110.12.49
52.110.12.55

File paths

C:\jdk7_32P\jdk7\build\windows-i586\tmp\sun\launcher\kinit\obj\kinit.pdb

More Viking samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report