MALICIOUS — Vcffipzmnipbxzdl.exe
MALICIOUS — Vcffipzmnipbxzdl.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Cryptolocker family. 7 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
fc8d9845cc19220d3e902f2ff94fd6a5aa0de59bec94876cdad434e3245d3afd - SHA-1:
f33c553b63cfda54d3046f760b5c442360d1f9e7 - MD5:
f42a89828eb64e3e31caffc4e5e82f64 - imphash:
185adc003fc86c6dcacec19419592432 - ssdeep:
12288:06NINoPgXqvRyq5E3R18y0kQzX3EL1TdB0JUsoSfsJuRqQy5d5tD:06iWP9JAR18ycD3ErB2rs8MQy5p - TLSH:
T18E518B0D4F9B0A5FF1F456795C110A5D7C9A25CA19ADAA0CDB0B807DE6E34B30A808F7 - Submitted as: Vcffipzmnipbxzdl.exe
- File type: pe · Size: 846867 bytes
- Verdict: malicious (100/100) · Family: Cryptolocker
Detections (7 of 51 engines)
- capa (capabilities): capability:collection/keylog
- ClamAV (daily): Win.Trojan.Cryptolocker-3
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Ransom:Win32/Crilock.B
- Emsisoft (Emergency Kit): Gen:Variant.Trojan.Ransomware.390
- Trellix Stinger (McAfee): PWSZbot-FBTG!F42A89828EB6
- Kaspersky (KVRT): HEUR:Trojan.Win32.Bayrob.gen
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 9 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Cryptolocker-3 (rule
Win.Trojan.Cryptolocker-3) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Ransom:Win32/Crilock.B (rule
Ransom:Win32/Crilock.B) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.Trojan.Ransomware.390 (rule
Gen:Variant.Trojan.Ransomware.390) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged PWSZbot-FBTG!F42A89828EB6 (rule
PWSZbot-FBTG!F42A89828EB6) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Bayrob.gen (rule
HEUR:Trojan.Win32.Bayrob.gen) - engine signal, weight 0.55, confidence 0.85 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Dynamic analysis (windows)
29 behavior events · 1 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- searchapp.bundleassets.example
- desktop-hsgcbep
- v10.events.data.microsoft.com
- settings-win.data.microsoft.com
- login.live.com
- config.edge.skype.com
- fd.api.iris.microsoft.com
- www.bing.com
- msedge.api.cdp.microsoft.com
- windows.msn.com
- officeclient.microsoft.com
- licensing.mp.microsoft.com
- tas02.sls.update.microsoft.com
- dns.msftncsi.com
- g.live.com
- ecs.office.com
- assets.msn.com
- fe3cr.delivery.mp.microsoft.com
Embedded domains
- ki.tk
- inference.location.live.net
- aefd.nelreports.net
Embedded IP addresses
- 162.159.36.2
File paths
- f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
- f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
- f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl
More Cryptolocker samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report