MALICIOUS — 3DEXP_Mkt_SW_6.34.4034.exe
MALICIOUS — 3DEXP_Mkt_SW_6.34.4034.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (85/100), attributed to the HUILoader family. 3 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
f87265e7da07c2f67db3a5c31d47ef1d04887bf6c7214f4a380e66ca6294da96 - SHA-1:
5a9ea8759bc8cdfbed96d1f2444063b46a39965e - MD5:
3a287da2869dd11defe156ef05a900af - imphash:
23c22ba8cc2a21a5dc13e55d6ed68008 - ssdeep:
49152:rfB9rOUpUnPKriqvAenSJTNGoQlRUl9wxudnm1HUYkxsgpq4H9DXflajTVjgZ0l:78Pmiqv2NG5rUb0mmxXkxsg44HpXIjTj - TLSH:
T1A85E33CC425D7B47E3BBCE7859916E0F1183A495723C50894683D26F2EF3A47E93046A - Submitted as: 3DEXP_Mkt_SW_6.34.4034.exe
- File type: pe · Size: 3004504 bytes
- Verdict: malicious (85/100) · Family: HUILoader
Detections (3 of 56 engines)
- capa (capabilities): capability:collection/keylog
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:_winzip_
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
MITRE ATT&CK
Why this verdict
The malicious score of 85/100 is the fusion of 6 weighted signals:
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - capa (capabilities) flagged capability:collection/keylog (rule
capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:_winzip_ (rule
high-entropy-sections:_winzip_) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://www.winzip.com - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: high-entropy-sections:_winzip_ - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
- http://www.digicert.com/CPS0
- http://www.winzip.com
Embedded domains
- schemas.microsoft.com
- cacerts.digicert.com
- crl3.digicert.com
- www.digicert.com
- crl4.digicert.com
- www.winzip.com
- winzip.com
File paths
- E:\NMC\WZSE\Build12218msinbr\Common\fileid.c
- E:\NMC\WZSE\Build12218msinbr\Common\dostime.c
- E:\NMC\WZSE\Build12218msinbr\Common\datetime.c
- E:\NMC\WZSE\Build12218msinbr\Common\fileinfo.c
- E:\NMC\WZSE\Build12218msinbr\Common\Wzextra.c
- r:\ywY
- R:\ey
- f:\7O
- z:\;:
More HUILoader samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report