MALICIOUS — fc87df3e54fd0c9591f8b768d3bc9527128a4b4ddb9533db87c13a38e50e1dc9

MALICIOUS — fc87df3e54fd0c9591f8b768d3bc9527128a4b4ddb9533db87c13a38e50e1dc9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Vindor family. 9 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: fc87df3e54fd0c9591f8b768d3bc9527128a4b4ddb9533db87c13a38e50e1dc9
SHA-1: bb013852f260b28d335ae6d5498fd3212189c238
MD5: a015c3cd60b34150af34a392748895e9
imphash: 01392ca861cf87b8d28ad9ea90016bb4
ssdeep: 6144:YGEDED2yz11avu1P3V17Y0I4CiFBypZiYz1MpA5ns/hCvYlTpvrlA1r81/93:YLEy+avuZ3VdKN0BlI1z5nECDwF
TLSH: T14F4F7C88491322AFE0B7E464BCD4C9AC802FB9ECB076D20D574BD86D90D91F7D9E2650
Submitted as: fc87df3e54fd0c9591f8b768d3bc9527128a4b4ddb9533db87c13a38e50e1dc9
File type: pe · Size: 698850 bytes
Verdict: malicious (100/100) · Family: Vindor

Detections (9 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): ASPack
ClamAV (daily): Win.Worm.Vindor-9886047-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Worm:Win32/AutoRun!pz
Emsisoft (Emergency Kit): Gen:Heur.Mint.Autorunner.1
Trellix Stinger (McAfee): Vindor-FTWO!A015C3CD60B3
Kaspersky (KVRT): Worm.Win32.AutoRun.vx

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Worm.Vindor-9886047-0 (rule Win.Worm.Vindor-9886047-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Worm:Win32/AutoRun!pz (rule Worm:Win32/AutoRun!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Mint.Autorunner.1 (rule Gen:Heur.Mint.Autorunner.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Vindor-FTWO!A015C3CD60B3 (rule Vindor-FTWO!A015C3CD60B3) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.AutoRun.vx (rule Worm.Win32.AutoRun.vx) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged ASPack (rule ASPack) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 1.1.5.131, 5.1.5.131 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: ASPack, high-entropy-sections:.text, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 22 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

25457 behavior events · 1 ATT&CK techniques · 24 dropped files.

Dropped files

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - 377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Adobe\Acrobat DC\Acrobat\OSSLLibs\AdobeFips.exe - f6efe028edb7bb138f40106d6fe2a3e0ea31871adfd36a55142d24e23e53315e
C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\MenuCoreApp\AcroShareTarget.exe - dc9a3715de0886b7d2f9faa020a6f87b4304ee1b9b11f3bdf2459193d16d1919
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe - c360718a2013e17400eedd7b20fbed5ebb1276fb666fb2a0cc8b7a12a6aa4e15
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe - 6a78dba30ca10f3addef5b1683bd7bc97e98ce03c9e6ae7056845ee1b70b7d10
c2000534712989979ccd1400f70a77715f0a0c15e3721a871d3d7890b3380062 - c2000534712989979ccd1400f70a77715f0a0c15e3721a871d3d7890b3380062
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe - fbb045cee6c02a00fd52441c08d17280117551c35675b572be76955202ba9de2
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe - da595d4c0e855766e4e0112c6fe4c2822b47e916b797186b5fbf53d73b721b30
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe - 63156ae4b122e6f9584581782b64327bfbf60d31ae39de283fd5beeea5aa6746
C:\Program Files\7-Zip\7z.exe - 634d38c0c414178e2f35de5cc0fb29aa082eec227e630c4481e1af7694980ac9
C:\Program Files\7-Zip\7zG.exe - c9efc01a4758d90a7d90f341f55af8cc66994184320e18fee16a434b55e2f293
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe - 7f65f5ae08cc5a15df0c7d70e3fc3ba5b4f083dcbdc02170423867257ffaf076
C:\Program Files\7-Zip\7zG.exe - 7b5eda73c21960c451ea3148900b28cdbac7180e43047fbc944028096e497c08

Embedded URLs

https://github.com/dotnet/corefx/tree/8136b3dd606b08acc749645401fdf719b7c5e05c
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/windows0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://schemas.microsoft.com/SMI/2016/WindowsSettings
https://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-cs-g1.crl05
http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
http://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

github.com
www.microsoft.com
crl.microsoft.com
schemas.microsoft.com
cacerts.digicert.com
crl4.digicert.com
crl3.digicert.com
www.digicert.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

1.1.5.131
5.1.5.131
52.168.112.66
4.230.171.124
85.210.193.152
52.230.60.54
135.232.92.97
135.233.95.144
51.116.253.168
4.150.223.103
172.215.188.225
52.148.114.188
4.150.223.114
20.50.201.195
72.145.35.107
52.110.12.28
52.110.12.15

File paths

C:\A\34\b\bin\amd64\venvlauncher.pdb

More Vindor samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report