MALICIOUS — e5bf0d4902347deb70941eafc9d139bcbbf7fca741c20f7968a406b118bff540
MALICIOUS — e5bf0d4902347deb70941eafc9d139bcbbf7fca741c20f7968a406b118bff540 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100), attributed to the AntiDebug family. 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
e5bf0d4902347deb70941eafc9d139bcbbf7fca741c20f7968a406b118bff540 - SHA-1:
e71aa4fa1c5dbaab4cbb6984f65c67c250ad4f79 - MD5:
74f27b55698f46e48bf5a7a2caa21afa - imphash:
4c1b26412d43bfd4f4c665bdc7a2ef4e - ssdeep:
3072:iX9CwZaMwsSGdjFgF63LT8IJlEPygLBfu+DX9Og71/YC9fX57I8WLrwJuxgD/:ifwsSGdW63EEgLBlXx/V9BKLrwagz - TLSH:
T10E428EDE661C6B25E233CD215C003E5E90B6F0DD517A366C068BC63F69A38D7AE710A4 - Submitted as: e5bf0d4902347deb70941eafc9d139bcbbf7fca741c20f7968a406b118bff540
- File type: pe · Size: 212992 bytes
- Verdict: malicious (95/100) · Family: AntiDebug
Detections (4 of 56 engines)
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Microsoft Defender: Virus:Win32/Sality.AT
- Emsisoft (Emergency Kit): Win32.Sality.3
- Kaspersky (KVRT): Virus.Win32.Sality.sil
MITRE ATT&CK
Why this verdict
The malicious score of 95/100 is the fusion of 7 weighted signals:
- Microsoft Defender flagged Virus:Win32/Sality.AT (rule
Virus:Win32/Sality.AT) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Win32.Sality.3 (rule
Win32.Sality.3) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Virus.Win32.Sality.sil (rule
Virus.Win32.Sality.sil) - engine signal, weight 0.55, confidence 0.85 - Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://s.symcb.com/pca3-g5.crl0, https://d.symcb.com/rpa0, https://d.symcb.com/rpa0+ - static signal, weight 0.35, confidence 0.60
- enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- officeclient.microsoft.com
- www.msn.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
- www.bing.com
- licensing.mp.microsoft.com
- th.bing.com
- tas02.sls.update.microsoft.com
Embedded URLs
- http://s.symcb.com/pca3-g5.crl0
- https://d.symcb.com/rpa0
- https://d.symcb.com/rpa0+
- http://sw.symcb.com/sw.crl0
- http://sw1.symcb.com/sw.crt0
- http://s.symcb.com/universal-root.crl0
- https://d.symcb.com/rpa0@
- http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
- http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
- https://clients2.google.com/service/update2/crx
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- s.symcb.com
- d.symcb.com
- sw.symcb.com
- sw1.symcb.com
- ts-crl.ws.symantec.com
- ts-aia.ws.symantec.com
- clients2.google.com
Embedded IP addresses
- 4.150.223.115
- 4.230.171.124
- 57.154.63.210
- 52.230.59.222
- 4.247.188.224
- 20.165.94.63
- 40.84.97.4
- 135.232.92.97
- 4.150.223.105
- 74.179.77.204
- 104.46.162.231
- 104.18.33.89
- 52.110.12.44
- 52.110.12.37
Registry keys
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
- HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe
- HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat
- HKEY_CLASSES_ROOT\.pdf
- HKEY_CLASSES_ROOT\SOFTWARE\Adobe\Acrobat\Exe
- HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.adobe.acrobat.chrome_webcapture
- HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\efaidnbmnnnibpcajpcglclefindmkaj
- HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.adobe.acrobat.chrome_webcapture:
- HKEY_CLASSES_ROOT\CLSID\{D38406DA-E8AA-484b-B80D-3D3DBDCC2FB2}\LocalServer32
- HKEY_CLASSES_ROOT\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\InprocServer32
- HKEY_CLASSES_ROOT\TypeLib\{0F6D3808-7974-4B1A-94C2-3200767EACE8}\1.0\HELPDIR
- HKEY_CLASSES_ROOT\CLSID\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\InProcServer32
- HKEY_CLASSES_ROOT\TypeLib\{41738EEA-442F-477F-92CF-2889BD6CD7E7}\1.0\0\win32
- HKEY_CLASSES_ROOT\MIME\Database\Content
- HKEY_CLASSES_ROOT\.pdf:
- HKEY_CLASSES_ROOT\CLSID\{D38406DA-E8AA-484b-B80D-3D3DBDCC2FB2}\LocalServer32:
- HKEY_CLASSES_ROOT\CLSID\{98D9A6F1-4696-4B5E-A2E8-36B3F9C1E12C}\LocalServer32
- HKEY_CLASSES_ROOT\CLSID\{98D9A6F1-4696-4B5E-A2E8-36B3F9C1E12C}\LocalServer32:
- HKEY_CLASSES_ROOT\SOFTWARE\Adobe\Acrobat\Exe:
- HKEY_CLASSES_ROOT\acrobat\shell\open\command
- HKEY_CLASSES_ROOT\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}
- HKEY_CLASSES_ROOT\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\[DisplayName]:
- HKEY_CLASSES_ROOT\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\InprocServer32:
- HKEY_CLASSES_ROOT\TypeLib\{41738EEA-442F-477F-92CF-2889BD6CD7E7}\1.0\0\win32:
- HKEY_CLASSES_ROOT\CLSID\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\LocalServer32
File paths
- d:\cb\acrobat\imports\open\rapidjson\include\rapidjson\internal\pow10.h
- d:\cb\acrobat\imports\open\rapidjson\include\rapidjson\document.h
- d:\cb\acrobat\imports\open\rapidjson\include\rapidjson\internal\stack.h
- d:\cb\acrobat\imports\open\rapidjson\include\rapidjson\reader.h
- C:\Windows\explorer.exe
- c:\windows\System32\msi.dll
More AntiDebug samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report