MALICIOUS — 0d00fcfb25f7d5b26aeb4b47711fe158fc5f7d40081dd361386b806733a3d00e

MALICIOUS — 0d00fcfb25f7d5b26aeb4b47711fe158fc5f7d40081dd361386b806733a3d00e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sivis family. 9 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 0d00fcfb25f7d5b26aeb4b47711fe158fc5f7d40081dd361386b806733a3d00e
• SHA-1: 9ce73226023566b7ca2968e7e8deaa62daed3141
• MD5: db9234aeeb38903b0b4985aaab96bfca
• imphash: 38aa7c2ff6ef0e48a9520d6702d08df4
• File type: pe · Size: 410900 bytes
• Verdict: malicious (100/100) · Family: Sivis

Detections (9 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): Win.Trojan.Agent-6943819-1
• YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Detect It Easy (packer/type): DIE:UPX 3.91
• Microsoft Defender: Virus:Win32/Sivis.A
• Emsisoft (Emergency Kit): Win32.Sivis.A
• Trellix Stinger (McAfee): PolyPatch-UPX
• Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

• T1112

Dynamic analysis (windows)

25475 behavior events · 1 ATT&CK techniques · 97 dropped files.

Runtime network

• www.msftconnecttest.com
• inference.location.live.net
• ctldl.windowsupdate.com
• login.live.com
• ocsp.digicert.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• licensing.mp.microsoft.com
• windows.msn.com
• oneocsp.microsoft.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• settings-win.data.microsoft.com
• assets.msn.com
• www.bing.com
• tas02.sls.update.microsoft.com
• v10.events.data.microsoft.com
• fe3cr.delivery.mp.microsoft.com

Dropped files

• /opt/CAPEv2/storage/analyses/12539/files/1ffef85f22c50f2bc9785a0c18f395b6a6ed53c284eaac0d8f6b05591b5815cc — 1ffef85f22c50f2bc9785a0c18f395b6a6ed53c284eaac0d8f6b05591b5815cc
• /opt/CAPEv2/storage/analyses/12539/files/e3077c9dd7da378ee1e285437f83ee04675556736a1ca0d504bac9e92d1d81c0 — e3077c9dd7da378ee1e285437f83ee04675556736a1ca0d504bac9e92d1d81c0
• /opt/CAPEv2/storage/analyses/12539/files/ad84d725c1af87402a4c4131a81e0496a793b40b527ac65c4d493396a0a2f97f — ad84d725c1af87402a4c4131a81e0496a793b40b527ac65c4d493396a0a2f97f
• /opt/CAPEv2/storage/analyses/12539/files/0d780a5235f06773efa93def4a78c3be97565c1a18bd6bebfcb26967f4d9d096 — 0d780a5235f06773efa93def4a78c3be97565c1a18bd6bebfcb26967f4d9d096
• /opt/CAPEv2/storage/analyses/12539/files/219da638b31efe662ad1ff527b63cfdee955c34c9460bb3a2b2e0b506a466946 — 219da638b31efe662ad1ff527b63cfdee955c34c9460bb3a2b2e0b506a466946
• /opt/CAPEv2/storage/analyses/12539/files/1b05f4d587269045cd90fdc00e98b1575c3206ae3ff72d435641c7ce4812fe05 — 1b05f4d587269045cd90fdc00e98b1575c3206ae3ff72d435641c7ce4812fe05
• /opt/CAPEv2/storage/analyses/12539/files/a18a46b3393dda720d744fbe3c8218bb958efcbe255ff3fac5150a7dac10c02c — a18a46b3393dda720d744fbe3c8218bb958efcbe255ff3fac5150a7dac10c02c
• /opt/CAPEv2/storage/analyses/12539/files/b50e4b48e4c7ee13b482294ecf67ef1a85ef68a410da0114147cf620974e66e9 — b50e4b48e4c7ee13b482294ecf67ef1a85ef68a410da0114147cf620974e66e9
• /opt/CAPEv2/storage/analyses/12539/files/e47665e646055100d44d8259ea223f200cf330adc2c7fc986746e966cea00e74 — e47665e646055100d44d8259ea223f200cf330adc2c7fc986746e966cea00e74
• /opt/CAPEv2/storage/analyses/12539/files/5b661121303386b3fa3f3afa893ef284cce9675a28e6c7aae648c17ab657c0e6 — 5b661121303386b3fa3f3afa893ef284cce9675a28e6c7aae648c17ab657c0e6
• /opt/CAPEv2/storage/analyses/12539/files/396a45b6d3cbe9a8d9de807af7e7faeac2a1d84ab93084d4e7861b75658d7686 — 396a45b6d3cbe9a8d9de807af7e7faeac2a1d84ab93084d4e7861b75658d7686
• /opt/CAPEv2/storage/analyses/12539/files/66b9ce117478cd7b1baaa58dd476c83f9578e50df169978e99ae12fe3363e2bb — 66b9ce117478cd7b1baaa58dd476c83f9578e50df169978e99ae12fe3363e2bb
• /opt/CAPEv2/storage/analyses/12539/files/65f0cf06480314fad0a4a05bec1378fb94a3f05f6f8bbd702f4550f119a62a98 — 65f0cf06480314fad0a4a05bec1378fb94a3f05f6f8bbd702f4550f119a62a98
• /opt/CAPEv2/storage/analyses/12539/files/30c99abbd2e765e4d9822b2aa9bbca26a94a712b8e7845ad5a73c583cb38e0d6 — 30c99abbd2e765e4d9822b2aa9bbca26a94a712b8e7845ad5a73c583cb38e0d6
• /opt/CAPEv2/storage/analyses/12539/files/19eabfabdac9fbdacdf7035034612a6fbea3bacb6ef311340df4d5e6d755b2b0 — 19eabfabdac9fbdacdf7035034612a6fbea3bacb6ef311340df4d5e6d755b2b0

Embedded URLs

• http://creativecommons.org/publicdomain/zero/1.0/
• http://www.adobe.com/go/reader_system_reqs_it.UnmoveFilesRimozione
• http://www.adobe.com/go/reader_system_reqs_it
• https://www.digicert.com/CPS0
• http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
• http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
• http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
• http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
• http://www.digicert.com/ssl-cps-repository.htm0
• https://d.symcb.com/rpa0
• http://s.symcb.com/universal-root.crl0
• https://d.symcb.com/rpa0@
• http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
• http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
• http://www.msftconnecttest.com/connecttest.txt
• http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786525136&P2=404&P3=2&P4=WSFlie5fO%2fuR%2bsOuaAmx41E090PQd7IDu7tIPt7QTWzL%2bwSrGncICQGBHIaEvwOBQBAdIWCZbGVGbqbRdlZqDA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

• creativecommons.org
• geocities.com
• www.adobe.com
• helpx.adobe.com
• www.microsoft.com
• crl3.digicert.com
• crl4.digicert.com
• www.digicert.com
• cacerts.digicert.com
• d.symcb.com
• s.symcb.com
• ts-crl.ws.symantec.com
• ts-aia.ws.symantec.com

Embedded IP addresses

• 135.233.95.80
• 40.79.163.154
• 52.230.60.54
• 172.215.188.232
• 4.230.171.124
• 74.178.76.128
• 135.233.95.135
• 20.42.72.131
• 135.233.45.221
• 142.250.195.142
• 135.232.92.34
• 203.26.79.13
• 172.178.240.162
• 72.154.7.17
• 20.42.73.26
• 52.148.114.188
• 52.110.12.51
• 52.110.12.18

More Sivis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report