MALICIOUS — 700_W32.MyDoom.A.bin

MALICIOUS — 700_W32.MyDoom.A.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Mydoom family. 7 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: fff0ccf5feaf5d46b295f770ad398b6d572909b00e2b8bcd1b1c286c70cd9151
• SHA-1: f91a4d7ac276b8e8b7ae41c22587c89a39ddcea5
• MD5: 53df39092394741514bc050f3d6a06a9
• imphash: 8151f5fd80a502f9e839d522c289f90d
• ssdeep: 384:96ZQHXcE7hUHwT56cC9Kg65JdwGADkHw/Rjxtuu7VIGGwQWEqpD6:CavuHAUcW/ojwG6kHw/lxqbW
• TLSH: T1B62BD089CDF06110D9F96860DC08A42CE4E43DE2C8EF4BD16367E1C6405DAEB66D32D9
• Submitted as: 700_W32.MyDoom.A.bin
• File type: pe · Size: 22528 bytes
• Verdict: malicious (100/100) · Family: Mydoom

Detections (7 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): {HEX}bin.worm.sco.135.UNOFFICIAL
• Cyble Vision: Cyble Vision: Mydoom
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): Trojan.GenericKD.77633966
• Trellix Stinger (McAfee): W32/Mydoom.a@MM
• Kaspersky (KVRT): Email-Worm.Win32.Mydoom.a

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

• ClamAV (daily) flagged {HEX}bin.worm.sco.135.UNOFFICIAL (rule {HEX}bin.worm.sco.135.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Cyble Vision flagged Cyble Vision: Mydoom (rule Cyble Vision: Mydoom) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.GenericKD.77633966 (rule Trojan.GenericKD.77633966) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged W32/Mydoom.a@MM (rule W32/Mydoom.a@MM) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Email-Worm.Win32.Mydoom.a (rule Email-Worm.Win32.Mydoom.a) - engine signal, weight 0.55, confidence 0.85
• Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (windows)

34 behavior events · 1 ATT&CK techniques · 2 dropped files.

Runtime network

• www.msftconnecttest.com
• searchapp.bundleassets.example
• inference.location.live.net
• desktop-hsgcbep
• v10.events.data.microsoft.com
• config.edge.skype.com
• settings-win.data.microsoft.com
• login.live.com
• www.bing.com
• fd.api.iris.microsoft.com
• licensing.mp.microsoft.com
• windows.msn.com
• officeclient.microsoft.com
• sdx.microsoft.com
• nav.smartscreen.microsoft.com
• dns.msftncsi.com
• watson.events.data.microsoft.com
• fe3cr.delivery.mp.microsoft.com
• assets.msn.com
• oloobe.officeapps.live.com

Dropped files

• /opt/CAPEv2/storage/analyses/6125/files/af78f29a294c63a8fb572025f7607d67c8421831d14ce27ae3c0dcef0cae3e18 - af78f29a294c63a8fb572025f7607d67c8421831d14ce27ae3c0dcef0cae3e18
• /opt/CAPEv2/storage/analyses/6125/files/fa3f934083746a702de18b927284f0145d4b82a92f2111693e93a4f762b50c00 - fa3f934083746a702de18b927284f0145d4b82a92f2111693e93a4f762b50c00

Embedded domains

• inference.location.live.net

Embedded IP addresses

• 162.159.36.2

More Mydoom samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report