MALICIOUS — e69d86cd21bccc9d76d40a1270dae9eb150b7df2c9b0ba74419901d2953188e6
MALICIOUS — e69d86cd21bccc9d76d40a1270dae9eb150b7df2c9b0ba74419901d2953188e6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100), attributed to the HUILoader family. 3 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
e69d86cd21bccc9d76d40a1270dae9eb150b7df2c9b0ba74419901d2953188e6 - SHA-1:
75e47091f5a9ff0632982b77125dcda64b1a190b - MD5:
7e08bd8253748c3516b28b329b2e861f - ssdeep:
24576:L/8ufZCG9iLk/8ufZCG9iLpzEeM7WUtLpwbtLpw:vI2RI2izE/btL2tL - TLSH:
T189579ED8458A6191DAF28BAE7C308E5D4053F9AC607C1E886B87C06F15F3F37A4E514A - Submitted as: e69d86cd21bccc9d76d40a1270dae9eb150b7df2c9b0ba74419901d2953188e6
- File type: pe · Size: 1566493 bytes
- Verdict: malicious (95/100) · Family: HUILoader
Detections (3 of 55 engines)
- ClamAV (daily): Win.Packed.Generic-7602836-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Yara-Rules community: YR_AntiDebug_Checks
MITRE ATT&CK
Why this verdict
The malicious score of 95/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Win.Packed.Generic-7602836-0 (rule
Win.Packed.Generic-7602836-0) - engine signal, weight 0.90, confidence 0.95 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://www.videolan.org/, http://nsis.sf.net/NSIS_Error, https://www.autoitscript.com/autoit3/ - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- officeclient.microsoft.com
- www.msn.com
Embedded URLs
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
- http://crl.thawte.com/ThawteTimestampingCA.crl0
- http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
- http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
- https://www.verisign.com/rpa
- http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
- https://www.verisign.com/rpa0
- http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
- https://www.verisign.com/cps0*
- http://logo.verisign.com/vslogo.gif04
- http://crl.verisign.com/pca3-g5.crl04
- http://www.videolan.org/
- http://nsis.sf.net/NSIS_Error
- http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
- http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
- http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
- http://office.microsoft.com
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
- http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
- http://ocsp2.globalsign.com/rootr306
- http://crl.globalsign.com/root-r3.crl0c
- https://www.globalsign.com/repository/0
- http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
- http://ocsp2.globalsign.com/gscodesignsha2g30V
- http://crl.globalsign.com/gscodesignsha2g3.crl0
Embedded domains
- schemas.microsoft.com
- crl.thawte.com
- ts-aia.ws.symantec.com
- ts-crl.ws.symantec.com
- www.verisign.com
- csc3-2010-crl.verisign.com
- csc3-2010-aia.verisign.com
- logo.verisign.com
- crl.verisign.com
- www.videolan.org
- nsis.sf.net
- crl.microsoft.com
- www.microsoft.com
- office.microsoft.com
- ocsp2.globalsign.com
- crl.globalsign.com
- www.globalsign.com
- secure.globalsign.com
- www.autoitscript.com
- crl.globalsign.net
- w.mx
- crash.videolan.org
Embedded IP addresses
- 3.3.14.5
- 20.184.175.18
- 4.230.171.124
- 40.84.85.40
- 20.247.184.142
- 135.232.92.137
- 20.184.175.15
- 74.178.76.54
- 20.236.44.162
- 40.103.64.242
- 52.123.128.14
- 52.123.129.14
- 40.99.134.18
- 20.42.65.93
- 52.148.114.188
- 125.56.205.112
- 125.56.205.17
- 52.110.12.15
- 52.110.12.48
File paths
- C:\re\jdk7u45\229\build\windows-amd64\tmp\sun\launcher\policytool\obj64\policytool.pdb
- C:\re\jdk7u45\229\build\windows-amd64\tmp\sun\launcher\tnameserv\obj64\tnameserv.pdb
- F:\Office\Target\x86\ship\postc2r\x-none\onenotem.pdb
More HUILoader samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report