MALICIOUS — f37ce67d88d899e6385d77dd2ef1ddc0c0b3ae2b389ab4d40c73489d25fcfdd8

MALICIOUS — f37ce67d88d899e6385d77dd2ef1ddc0c0b3ae2b389ab4d40c73489d25fcfdd8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Autorun family. 7 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: f37ce67d88d899e6385d77dd2ef1ddc0c0b3ae2b389ab4d40c73489d25fcfdd8
• SHA-1: c778f90e95bed5c1c74013e0a6c6342f8102d77d
• MD5: f8af34f4ed51a6ff0e77915436565c3a
• imphash: ba57cff438d021f24d6f677ef19046de
• ssdeep: 12288:VbKsisV5KV5izrqFkbDEy11aTCsX6aTC1V5KV5izrqFkbH:hKsiQIifqFuDt11aTCm6aTCxIifqFuH
• TLSH: T1FD496CA9025A3123E2B7DD54A40D8E9EC013F46870351B6D920BD01DA3F96F7EAF6C94
• Submitted as: f37ce67d88d899e6385d77dd2ef1ddc0c0b3ae2b389ab4d40c73489d25fcfdd8
• File type: pe · Size: 409226 bytes
• Verdict: malicious (98/100) · Family: Autorun

Detections (7 of 55 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• ClamAV (daily): Win.Worm.Autorun-1250
• YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
• YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
• Microsoft Defender: Trojan:Win32/Ausiv!pz
• Emsisoft (Emergency Kit): Backdoor.Hupigon.AAEA
• Kaspersky (KVRT): Worm.Win32.AutoRun.nf

MITRE ATT&CK

• T1055
• T1547.001
• T1071.001
• T1057

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 98/100 is the fusion of 9 weighted signals:

• ClamAV (daily) flagged Win.Worm.Autorun-1250 (rule Win.Worm.Autorun-1250) - engine signal, weight 0.90, confidence 0.95
• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: http://www.2651china.cn/2651/1.txt, http://www.2651china.cn/2651/wm.htm, http://www.gnu.org/software/coreutils/ - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
• inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.2651china.cn/2651/1.txt
• http://www.2651china.cn/2651/wm.htm
• http://www.gnu.org/software/coreutils/
• http://translationproject.org/team/
• http://gnu.org/licenses/gpl.html
• http://www.gnu.org/gethelp/

Embedded domains

• www.2651china.cn
• debian.org
• www.gnu.org
• translationproject.org
• gnu.org
• cygwin.com

Embedded IP addresses

• 2.7.6.1

File paths

• T:\:p:~:

More Autorun samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report