MALICIOUS — e3eb01c5af15751843eb4ab05bf2109aa10fd90889f1f3e3509e5529924d9f8d
MALICIOUS — e3eb01c5af15751843eb4ab05bf2109aa10fd90889f1f3e3509e5529924d9f8d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Viking family. 6 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.
Identification
- SHA-256:
e3eb01c5af15751843eb4ab05bf2109aa10fd90889f1f3e3509e5529924d9f8d - SHA-1:
641d0ebd6242e2ed7d4a2fef26bae7292af498f7 - MD5:
28a86e63aa7ad66e0591acd95fa9f9b1 - imphash:
31d1c48ee7d8e07a5706e963146db875 - ssdeep:
1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmitDMsyqfA8Uf:qKtfDwsjPThTYszDH2fusySA - TLSH:
T19A389D295B9B3B83E772D7221851BB4D44A2F9B96075048C6323827FB7F9C237974218 - Submitted as: e3eb01c5af15751843eb4ab05bf2109aa10fd90889f1f3e3509e5529924d9f8d
- File type: pe · Size: 80552 bytes
- Verdict: malicious (100/100) · Family: Viking
Detections (6 of 56 engines)
- YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
- ClamAV (daily): Win.Trojan.Delf-1564
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Virus:Win32/Viking.MS
- Emsisoft (Emergency Kit): Trojan.Agent.FPMF
- Kaspersky (KVRT): Virus.Win32.Lamer.xe
MITRE ATT&CK
YARA
- Windows_Injection_Api_Combo
Why this verdict
The malicious score of 100/100 is the fusion of 15 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule
Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95 - Process injection API combination (rule
Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90 - Dropped a malicious payload (GameThief): virDll.dll - dynamic signal, weight 0.62, confidence 0.90
- Microsoft Defender flagged Virus:Win32/Viking.MS (rule
Virus:Win32/Viking.MS) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Agent.FPMF (rule
Trojan.Agent.FPMF) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Virus.Win32.Lamer.xe (rule
Virus.Win32.Lamer.xe) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497, T1082 - dynamic signal, weight 0.40, confidence 0.75
- YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule
Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70 - 1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule
tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
60879 behavior events · 2 ATT&CK techniques · 101 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- windows.msn.com
- odc.officeapps.live.com
- www.msn.com
- settings-win.data.microsoft.com
- licensing.mp.microsoft.com
Dropped files
- C:\Program Files\LibreOffice\program\update_service.exe -
b22991a466a2cb09d055d25a3bf87d4d4c5e0f3fa20170bfdfbd564b587115d8 - C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe -
3766240b203d160c20dc579868eda359f78ee2440d7c768dbef79167cafd075e - C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\gui-64.exe -
e01a9b2ae4408068a29800dce6c7495b0a80e94752fc1c0590647be025721d44 - C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\gui.exe -
cffcfddb8c06a2bb859ec95131e6d221c0716c39f9f763c077ff0aa4d2b4d83c - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe -
7b6f1a41e57c4a3c4ee2de2a6333281055e7c69c509701a588ef96aa54f1a73e - C:\Program Files\LibreOffice\program\minidump_upload.exe -
6cbe8a842da7d0de510c6813a96444eeeea8953751191fc94027fdb3c1ea73d6 - C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccesswalker.exe -
546eb553757a62734fbdecef653505ca5f2e95c644bf437184b10ef5677002e1 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 -
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - C:\Program Files\7-Zip\7zFM.exe -
7478c3104f73eeff67684aa46a04b36476a5a17b714248d3ea838d952a40a4ad - C:\Program Files\LibreOffice\program\soffice.exe -
929dc15ffeeae3cf9bad4c2a60b8e7c10c5a55798eb8231cfac43bd2a3be09bb - C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe -
cb729c721da4b481ca38ea07f6e2b5df7e5ae0f5e2a79a144a5e829026141428 - C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaw.exe -
3356ce1c5e303fe32faf4dfa8a7a57e6688e26dd8fb6a952f1ef9e1dba331b42 - C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe -
1cf42fb35624ba34490f0b6225774e528d7202e122ec3d7c73f664904ad2aea2 - C:\Program Files\LibreOffice\program\mar.exe -
f7b60804c2375cba547b1b7a0035d8fe9b6ed51507d8030fbffe2fccfc0f2237 - C:\Program Files\LibreOffice\program\simpress.exe -
895740266f74eeb790167ccb94e56a354693f88634a94b0f1e95819dbf4dd448
Embedded URLs
- https://www.digicert.com/CPS0
- http://crl3.digicert.com/sha2-assured-cs-g1.crl05
- http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
- http://crl3.digicert.com/sha2-assured-ts.crl02
- http://crl4.digicert.com/sha2-assured-ts.crl0
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
- http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
- http://yr.c.lencr.org/
Embedded domains
- cacerts.digicert.com
- crl4.digicert.com
- crl3.digicert.com
- www.digicert.com
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 192.168.0.30
- 192.168.8.1
- 4.150.223.97
- 4.230.171.124
- 52.230.60.54
- 85.210.196.11
- 135.232.92.97
- 4.150.223.107
- 135.232.92.137
- 20.42.73.31
- 104.18.33.89
- 172.178.240.161
- 4.150.223.100
- 20.42.65.93
- 48.211.4.16
- 52.110.12.3
- 52.110.12.45
- 52.148.114.188
- 72.145.35.109
File paths
- c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\jdk\objs\orbd_objs\orbd.pdb
More Viking samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report