MALICIOUS — f685a4612a23fe0ba70e9965f5d26b15bc49c933c3d88a00df9c1202aada1403

MALICIOUS — f685a4612a23fe0ba70e9965f5d26b15bc49c933c3d88a00df9c1202aada1403 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Maldoc family. 10 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: f685a4612a23fe0ba70e9965f5d26b15bc49c933c3d88a00df9c1202aada1403
SHA-1: bad507ecbf786635de6ac2f0d3291078f1e98825
MD5: 05b188a2c96b0e9119d8f7730f432697
imphash: 3f92177474a00f02451a855b96e05f57
ssdeep: 3072:vHjk+0oLnWFnzBHv/xWFsg8WatFBGFVWPE5ac0pG/1z+QVMbg1jm0+J:Po/BHng5HaVG4G/1z+QVMbg1jv+
TLSH: T197439D8B3A29EE42E2E7D9076D04FDFC208F4897263AF5692AD9D55E44C327B043112D
Submitted as: f685a4612a23fe0ba70e9965f5d26b15bc49c933c3d88a00df9c1202aada1403
File type: pe · Size: 233472 bytes
Verdict: malicious (100/100) · Family: Maldoc

Detections (10 of 55 engines)

capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Worm.Vobfus-7513439-0
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Worm:Win32/Cambot.A
Emsisoft (Emergency Kit): Trojan.GenericKD.40203996
Trellix Stinger (McAfee): Trojan-FUFN!05B188A2C96B
Kaspersky (KVRT): Trojan.Win32.Llac.llzl

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 18 weighted signals:

ClamAV (daily) flagged Win.Worm.Vobfus-7513439-0 (rule Win.Worm.Vobfus-7513439-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 23 external host(s) at runtime (25 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
Extracted BlackshadesRAT config (0 C2) - engine signal, weight 0.45, confidence 0.60
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.facebook.com/?ref=home, http://www.facebook.com - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, Microsoft Linker - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

6620 behavior events · 3 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\ag58fpqon.exe.jpg - 22a8770dfff83829350926bb57fe8310fe784880492046fa298f0bcb260d66de

Embedded URLs

http://www.facebook.com/?ref=home
http://www.facebook.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://migsel.com/system/classes/alive.php?key=Blackshades%5FKey&pcuser=analyst&pcname=DESKTOP%2DHSGCBEP&hwid=800E9CC0&country=United+States
http://migsel.com/system/classes/fg.php?key=Blackshades%5FKey
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787848586&P2=404&P3=2&P4=VolIKKnztYvl9WZevHQUnz7keNVF%2bWg1kS6pruIPbvztrRMAtxC%2fNQDiSAn1Pre7%2f5x%2b82v4kZpnK0PV0s7W7w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787848630&P2=404&P3=2&P4=jclxTSpuy5%2b0bpnXiflJSKvxSsVIbJeg3l3MuqvTlWhIAECkBV0KnKTcZ35VGjcMg6HP490s7SMtqeSpfzVCvQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.facebook.com
bankofamerica.com
migsel.com

Embedded IP addresses

20.184.175.8
52.123.252.236
40.84.85.40
52.230.60.54
4.230.171.124
20.165.94.63
74.178.76.54
20.42.65.93
135.233.95.144
20.236.44.162
52.123.128.14
52.123.129.14
4.150.223.109
135.234.160.244
95.128.128.129
135.232.92.34
203.26.79.13
52.148.114.188
52.110.12.55
92.223.78.30
72.153.5.97
52.110.12.4
52.110.12.45

Registry keys

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows

File paths

C:\Program
C:\Windows\SysWOW64\ieframe.dll

More Maldoc samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report