MALICIOUS — e1f7de94bbd622cde8a1dfa5531cd6f85815f9c29d2bc453fbdd3690e52d8c23

MALICIOUS — e1f7de94bbd622cde8a1dfa5531cd6f85815f9c29d2bc453fbdd3690e52d8c23 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 5 of 56 detection engines flagged it.

Identification

SHA-256: e1f7de94bbd622cde8a1dfa5531cd6f85815f9c29d2bc453fbdd3690e52d8c23
SHA-1: 28e9519a6115bffef05e780a01417e1fd7ccd25e
MD5: 4a4e414af382b74a24e312cc09f10cea
imphash: 1453e4cc355841ff97c2c6f1a86c9c06
ssdeep: 3072:COkRo26spYblVQ12HySabJzTnz9h1iG4RxxN2hfmxlH1p8g:COyogOlVpHRabJVVM/xlH1p8
TLSH: T1FD418F6F309389BFC30A27847FD018CC13A257DA21975CA6E049D2D9D9A53FBAE90075
Submitted as: e1f7de94bbd622cde8a1dfa5531cd6f85815f9c29d2bc453fbdd3690e52d8c23
File type: pe · Size: 192776 bytes
Verdict: malicious (99/100)

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Malware.Generickdz-10004857-0
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Gen:Variant.Worm.VB.112
Kaspersky (KVRT): Trojan.Win32.VB.dosp

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Generickdz-10004857-0 (rule Win.Malware.Generickdz-10004857-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Worm.VB.112 (rule Gen:Variant.Worm.VB.112) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.VB.dosp (rule Trojan.Win32.VB.dosp) - engine signal, weight 0.55, confidence 0.85
Contacted 1 external host(s) and 14 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.iec.ch - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/photoshop/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
http://ns.adobe.com/xap/1.0/sType/ResourceRef#
http://www.iec.ch
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787951777&P2=404&P3=2&P4=J9eQ2VOb%2b8GwA3gu%2fj5HxDWoWx7rZMNw4ahwDdqeRM5gXVjY8aSDGcO8Ee4UfjldEKUD0iLXWGjHJgH7Q%2bmd3A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ns.adobe.com
www.w3.org
url.org
www.iec.ch

Embedded IP addresses

4.150.223.109
4.230.171.124
20.165.94.63
85.210.193.152
20.247.184.197
4.150.223.110
74.178.76.54
57.154.63.210
40.99.133.226
52.123.128.14
20.231.239.246
40.104.4.2
52.123.129.14
20.184.175.22
203.26.79.13
172.215.188.225
74.178.232.29
135.234.160.246
72.145.35.103
52.148.114.188
52.110.12.51
52.110.12.15
172.66.2.5

File paths

C:\Program

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report