MALICIOUS — f85fb511f4c7535d8776199ab689aa8ac7881e2fc1c698c6fd4b8a09152dfc50
MALICIOUS — f85fb511f4c7535d8776199ab689aa8ac7881e2fc1c698c6fd4b8a09152dfc50 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Vindor family. 9 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.
Identification
- SHA-256:
f85fb511f4c7535d8776199ab689aa8ac7881e2fc1c698c6fd4b8a09152dfc50 - SHA-1:
bd830e098163b8365b226fc7acbadf3b07980de9 - MD5:
c90ca51c9b021a7bd536dd655b1f03f5 - imphash:
01392ca861cf87b8d28ad9ea90016bb4 - ssdeep:
12288:clXmEy1GxgsHyMqLHFZlxlYqgNEIrEkoNk7L6zSZpP8vUap:clXmt1GxFHDUTmrRoNk7BZpP8Map - TLSH:
T1DF538C88910D1212D9F29B042A585E8FB08173DC71BDE6BD6783F4FE21E2B63B925075 - Submitted as: f85fb511f4c7535d8776199ab689aa8ac7881e2fc1c698c6fd4b8a09152dfc50
- File type: pe · Size: 1006119 bytes
- Verdict: malicious (100/100) · Family: Vindor
Detections (9 of 56 engines)
- capa (capabilities): capability:collection/keylog
- MalwareAnalyser heuristics (entropy/packer): ASPack
- ClamAV (daily): Win.Worm.Vindor-9886047-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
- Detect It Easy (packer/type): DIE:Microsoft Linker
- Microsoft Defender: Worm:Win32/AutoRun!pz
- Emsisoft (Emergency Kit): Trojan.Runner.BP
- Kaspersky (KVRT): Worm.Win32.AutoRun.vx
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 17 weighted signals:
- ClamAV (daily) flagged Win.Worm.Vindor-9886047-0 (rule
Win.Worm.Vindor-9886047-0) - engine signal, weight 0.90, confidence 0.95 - 2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule
tl-run-key) - dynamic signal, weight 0.63, confidence 0.90 - Microsoft Defender flagged Worm:Win32/AutoRun!pz (rule
Worm:Win32/AutoRun!pz) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Runner.BP (rule
Trojan.Runner.BP) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Worm.Win32.AutoRun.vx (rule
Worm.Win32.AutoRun.vx) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Observed at runtime: Registry Run Key Persistence (T1547.001) (rule
Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - Contacted 21 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule
DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70 - capa (capabilities) flagged capability:collection/keylog (rule
capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged ASPack (rule
ASPack) - engine signal, weight 0.35, confidence 0.70 - YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule
YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70 - Embedded network infrastructure: http://www.symauth.com/cps0, http://www.symauth.com/rpa04, http://www.symauth.com/cps09 - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: ASPack, high-entropy-sections:.text, Microsoft Linker - static signal, weight 0.25, confidence 0.55
- enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Dropped 22 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Dynamic analysis (windows)
25551 behavior events · 1 ATT&CK techniques · 23 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- desktop-hsgcbep
- login.live.com
- v20.events.data.microsoft.com
- config.edge.skype.com
- settings-win.data.microsoft.com
- windows.msn.com
- officeclient.microsoft.com
- www.msn.com
- odc.officeapps.live.com
- assets.msn.com
Dropped files
- C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe -
b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68 - C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe -
377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 -
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - C:\Program Files\7-Zip\7zG.exe -
524181ad55341e8de42c7722fd485a34e8a32de0e5c253a660e2afcd5dbef6df - C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe -
866aa40ef693c287ca9e687dd123df16c004bb9f0d80ee2e01d7c3764462f378 - C:\Program Files\7-Zip\7zFM.exe -
c37241b74688dfcc11e5efb987f0aa1610e4767bd8fb3aa6428f25523da7f5b2 - C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe -
a7c019cc84be538057968cca7fd424414b72ca591ae10d9ae9bc65b55d3ae7c4 - C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe -
6a78dba30ca10f3addef5b1683bd7bc97e98ce03c9e6ae7056845ee1b70b7d10 - C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\MenuCoreApp\AcroShareTarget.exe -
ff0bcb749441f408144902e5b5a38e5450567cd2cf7ac2abc520580e19f325b6 - C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe -
63156ae4b122e6f9584581782b64327bfbf60d31ae39de283fd5beeea5aa6746 - C:\Program Files\Adobe\Acrobat DC\Acrobat\OSSLLibs\AdobeFips.exe -
8ee3ee9d5933f5204476b9ddf9c99398f4fb74b61233751fdfbb0f37a389e7c8 - C:\Program Files\7-Zip\7z.exe -
634d38c0c414178e2f35de5cc0fb29aa082eec227e630c4481e1af7694980ac9 - C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe -
bd9b908986274a2572f06db7cb766a1f6cd7968a913b444023b681435466a874 - C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe -
7f65f5ae08cc5a15df0c7d70e3fc3ba5b4f083dcbdc02170423867257ffaf076 - C:\Program Files\7-Zip\7z.exe -
03dd6a3949dc3c51771b7f41a39df5b222f92e834df42f2d579ca5985eff8be6
Embedded URLs
- https://www.digicert.com/CPS0
- http://crl3.digicert.com/sha2-assured-cs-g1.crl05
- http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
- http://crl3.digicert.com/sha2-assured-ts.crl02
- http://crl4.digicert.com/sha2-assured-ts.crl0
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
- http://www.microsoft.com/windows0
- http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
- http://crl.thawte.com/ThawtePremiumServerCA.crl0
- http://crl.verisign.com/tss-ca.crl0
- http://crl.thawte.com/ThawteCodeSigningCA.crl02
- https://armmf.adobe.com/arm-manifests/win/
- http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows
- http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows
- http://crl.thawte.com/ThawteTimestampingCA.crl0
- http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
- http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
- http://crl.verisign.com/pca3.crl0
- https://www.verisign.com/cps0
- http://logo.verisign.com/vslogo.gif04
- http://www.symauth.com/cps0
- http://www.symauth.com/rpa04
- http://crl.verisign.com/pca3-g5.crl0
- http://www.symauth.com/cps09
- http://evcs-crl.ws.symantec.com/evcs.crl0
Embedded domains
- cacerts.digicert.com
- crl4.digicert.com
- crl3.digicert.com
- www.digicert.com
- www.microsoft.com
- crl.microsoft.com
- bzip.org
- crl.thawte.com
- crl.verisign.com
- armmf.adobe.com
- www.adobe.com
- ts-aia.ws.symantec.com
- ts-crl.ws.symantec.com
- www.verisign.com
- logo.verisign.com
- www.symauth.com
- evcs-crl.ws.symantec.com
- evcs-aia.ws.symantec.com
- office.microsoft.com
- www.w3.org
- shim.app
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 1.7.2.0
- 0.10.5.0
- 4.150.223.108
- 4.230.171.124
- 4.144.132.114
- 135.232.92.97
- 85.210.193.152
- 20.165.94.63
- 20.42.65.89
- 57.155.101.212
- 104.18.33.89
- 92.223.78.30
- 52.148.114.188
- 4.150.223.113
- 20.42.73.26
- 72.153.5.133
- 52.110.12.51
- 52.110.12.3
Registry keys
- HKEY_CLASSES_ROOT\Software\Adobe\Acrobat\Exe
- HKLM\SOFTWARE\RegisteredApplications
File paths
- c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\jdk\objs\java-rmi_objs\java-rmi.pdb
- e:\fx19rel\WINNT_5.2_Depend\mozilla\obj-fx-trunk\toolkit\mozapps\update\src\updater\updater.pdb
- f:\CB\ARM_Sustaining\BuildResults\bin\Win32\Release\AdobeARMHelper.pdb
- X:\:`:
- X:\:`:d:h:l:p:@;D;H;L;P;T;X;\;`;
- X:\:`:d:h:p:t:x:
- X:\:`:d:h:l:p:t:x:
- T:\:h:
- f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
- f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
- f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
- f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl
- f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
More Vindor samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report