MALICIOUS — f65fa71e8ffe11bb6e7c6c84c3d365f4fe729e1e9c38cb4f073d2b65058465fa
MALICIOUS — f65fa71e8ffe11bb6e7c6c84c3d365f4fe729e1e9c38cb4f073d2b65058465fa is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Caphaw family. 6 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
f65fa71e8ffe11bb6e7c6c84c3d365f4fe729e1e9c38cb4f073d2b65058465fa - SHA-1:
f8da98763e345f42c62db02e51bf5d80342cd4d2 - MD5:
ca0403ea24fe2a7771b99cea55826c9b - imphash:
cc50c5d7bc74c5389450a5d946fe0b7b - ssdeep:
3072:IQf2nP4clkIOJ5NpJ70/94IU3sJGnlCv1vp9IPFpW5:IQeNl4NHw/94IU8JGivp9EFY5 - TLSH:
T15C45BF1BCA8A3C76F302057A6D8EA4CDFC1DA5CCB39500667AD11E3AD9E8E2770D1851 - Submitted as: f65fa71e8ffe11bb6e7c6c84c3d365f4fe729e1e9c38cb4f073d2b65058465fa
- File type: pe · Size: 278528 bytes
- Verdict: malicious (99/100) · Family: Caphaw
Detections (6 of 51 engines)
- MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
- ClamAV (daily): Win.Dropper.Daws-2
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Detect It Easy (packer/type): DIE:Microsoft Linker
- Microsoft Defender: Backdoor:Win32/Caphaw.R
- Emsisoft (Emergency Kit): Gen:Heur.FKP.21
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 8 weighted signals:
- ClamAV (daily) flagged Win.Dropper.Daws-2 (rule
Win.Dropper.Daws-2) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Backdoor:Win32/Caphaw.R (rule
Backdoor:Win32/Caphaw.R) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Heur.FKP.21 (rule
Gen:Heur.FKP.21) - engine signal, weight 0.55, confidence 0.85 - Contacted 13 external host(s) at runtime (2 HTTP) - network signal, weight 0.40, confidence 0.80
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule
DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
67 behavior events · 1 ATT&CK techniques · 2 dropped files.
Runtime network
- www.msftconnecttest.com
- www.bing.com
- config.edge.skype.com
- v20.events.data.microsoft.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- licensing.mp.microsoft.com
- dns.msftncsi.com
- login.live.com
- desktop-hsgcbep
- watson.events.data.microsoft.com
- g.live.com
- oneclient.sfx.ms
- self.events.data.microsoft.com
- http://www.msftconnecttest.com/connecttest.txt
- www.msftconnecttest.com/connecttest.txt
- 23.33.238.115
- 20.184.175.15
- 52.253.84.76
- 23.40.52.85
Dropped files
- 789771b9c4c6da81d4475c1d4d7769093bfb28a8edd059e83baa85d4007860dd -
789771b9c4c6da81d4475c1d4d7769093bfb28a8edd059e83baa85d4007860dd - 6c245eb4b97a046bbd3dc3f83297a64045e30bfd21aae8667283223171b96b0c -
6c245eb4b97a046bbd3dc3f83297a64045e30bfd21aae8667283223171b96b0c
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
Embedded domains
- oneclient.sfx.ms
Embedded IP addresses
- 23.33.238.117
- 23.33.238.115
- 20.184.175.15
- 52.253.84.76
- 23.40.52.85
- 150.171.109.25
- 20.190.142.165
- 23.33.238.116
- 20.184.175.7
- 23.40.52.211
- 52.110.12.53
- 172.178.240.162
- 52.110.12.50
More Caphaw samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report