MALICIOUS — f4327e86cd60f8f6733ce3d7e42cfc875c02f4d9c988a649554a35508a86c0a2

MALICIOUS — f4327e86cd60f8f6733ce3d7e42cfc875c02f4d9c988a649554a35508a86c0a2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the DCOM family. 7 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: f4327e86cd60f8f6733ce3d7e42cfc875c02f4d9c988a649554a35508a86c0a2
• SHA-1: 36c040000e2684e478f199f7c13471d1a63b5fbc
• MD5: 07b426fc292fd0a219cd0a2aa715bb6d
• imphash: c4998075f1324ce0f644f12a548d76b1
• ssdeep: 6144:ppMMVVbsmzFn4ltn9zHMUxwPtZPFvNtCbEV1cxNmkBVF8bNiT0KyrWdTDHD0DU:Utmh6t9zMlPtZJnguczzBV007rAw
• TLSH: T1424B9E001106E34BD5F6CD645D8CFDACA073F8E6327E068D6396C1AEE2DB86394990B5
• Submitted as: f4327e86cd60f8f6733ce3d7e42cfc875c02f4d9c988a649554a35508a86c0a2
• File type: pe · Size: 475737 bytes
• Verdict: malicious (100/100) · Family: DCOM

Detections (7 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:ÒuۊëÔ
• ClamAV (daily): Win.Exploit.DCOM-5
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Exploit:Win32/RpcDcom!pz
• Emsisoft (Emergency Kit): Trojan.Agent.FRPG
• Trellix Stinger (McAfee): Agent-FQX!07B426FC292F
• Kaspersky (KVRT): Virus.Win32.Lamer.kp

MITRE ATT&CK

• T1547.001

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

• ClamAV (daily) flagged Win.Exploit.DCOM-5 (rule Win.Exploit.DCOM-5) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Exploit:Win32/RpcDcom!pz (rule Exploit:Win32/RpcDcom!pz) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Agent.FRPG (rule Trojan.Agent.FRPG) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Agent-FQX!07B426FC292F (rule Agent-FQX!07B426FC292F) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Virus.Win32.Lamer.kp (rule Virus.Win32.Lamer.kp) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:ÒuۊëÔ (rule high-entropy-sections:ÒuۊëÔ) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: http://www.gnu.org/software/coreutils/, http://translationproject.org/team/, http://gnu.org/licenses/gpl.html - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: high-entropy-sections:ÒuۊëÔ - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• http://www.gnu.org/software/coreutils/
• http://translationproject.org/team/
• http://gnu.org/licenses/gpl.html
• http://www.gnu.org/gethelp/
• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• http://www.microsoft.com/windows0
• http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0

Embedded domains

• www.gnu.org
• translationproject.org
• gnu.org
• cygwin.com
• www.microsoft.com
• crl.microsoft.com

Embedded IP addresses

• 212.33.237.86

File paths

• C:\Program
• C:\\Program
• C:\\cygwin64\bin\hostid.exe
• C:\\cygwin64\bin\toe.exe
• C:\\DLLS\7z.exe
• C:\\$SysReset\Scratch\csrss.exe

More DCOM samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report