MALICIOUS — f40cd773d5f9bf9260f51cc0e7d5568c55e975e1a3373dec0fe623de5feed617

MALICIOUS — f40cd773d5f9bf9260f51cc0e7d5568c55e975e1a3373dec0fe623de5feed617 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the HUILoader family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: f40cd773d5f9bf9260f51cc0e7d5568c55e975e1a3373dec0fe623de5feed617
SHA-1: 3eee1b5a923622ef1056c5577d3c24aafc944f7b
MD5: 717f2e190098ad83372f094de328fe90
imphash: d3625585a343c287a7c5045effe7fab5
ssdeep: 24576:HqVYAveC3YuNTiwiUOb8pnAg/R3AN3Ckg3s/oVzzeB9Xs:HkYwekY+TiBXb8pnAg/R3ApM8/oVHY
TLSH: T17755AE5C4FAAD24BC12EABD17F3CD94D50E17AE9983EF50D1747812E31E366B2890086
Submitted as: f40cd773d5f9bf9260f51cc0e7d5568c55e975e1a3373dec0fe623de5feed617
File type: pe · Size: 1241088 bytes
Verdict: malicious (98/100) · Family: HUILoader

Detections (4 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Generic-9884775-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Generic-9884775-0 (rule Win.Malware.Generic-9884775-0) - engine signal, weight 0.90, confidence 0.95
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.eyuyan.com - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

28 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com/0
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.eyuyan.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com
www.eyuyan.com

Embedded IP addresses

51.11.192.50
52.123.252.229
57.154.63.210
4.144.132.114
74.178.240.61
20.165.94.54
51.116.246.104
4.150.223.112
4.230.171.124
52.110.12.14
92.223.78.30
52.110.12.46

Registry keys

HKCU\Software
HKCU\Software\Policies
HKLM\Software
HKLM\Software\Policies

File paths

P:\Target\x86\ship\dw\x-none\dwtrig20.pdb
R:\:u:
X:\:`:d:h:l:p:t:x:
X:\:l:p:t:
T:\:

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report