MALICIOUS — 45c917fff6e6fe19debb1cb8f25a766c732051223deb8b71ed039165f52a40a1

MALICIOUS — 45c917fff6e6fe19debb1cb8f25a766c732051223deb8b71ed039165f52a40a1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 8 of 56 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: 45c917fff6e6fe19debb1cb8f25a766c732051223deb8b71ed039165f52a40a1
SHA-1: 19789f635e55fcb98351fe36c071a6704b47d60f
MD5: 9de7811b5bd46619d1701ebf52b502ce
imphash: 5144a995e58e9a1dec8b8e0e5ed55aec
ssdeep: 196608:jxBmzFFCmfwAtlCgCvEVWJ8CBk2yfVoxwKGF87:jvmpFCmfBtYgCcVW6VsA8
TLSH: T1A76C8CDE51127B01E723C6133D24EA0DB452B265317A26FD2372F36F29B266B317502A
Submitted as: 45c917fff6e6fe19debb1cb8f25a766c732051223deb8b71ed039165f52a40a1
File type: pe · Size: 11112448 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (8 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Generic-9907165-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Virus:Win32/Pidgeon.A
Emsisoft (Emergency Kit): Win32.Prepender.Gen.1
Trellix Stinger (McAfee): Flyagent.d
Kaspersky (KVRT): Virus.Win32.Agent.ev

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 18 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9907165-0 (rule Win.Trojan.Generic-9907165-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Pidgeon.A (rule Virus:Win32/Pidgeon.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Prepender.Gen.1 (rule Win32.Prepender.Gen.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Flyagent.d (rule Flyagent.d) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Agent.ev (rule Virus.Win32.Agent.ev) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
2 behavioral detection(s) across 2 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.43, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.eyuyan.com, https://wordps.officeapps.partner.office365.cn/wrdps/wordprint.svc/wrdprint, https://wordcs.officeapps.partner.office365.cn/wordauto/wordautomation.svc/WordAutomation - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 18 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60

Dynamic analysis (windows)

65664 behavior events · 2 ATT&CK techniques · 25 dropped files.

Dropped files

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe.exe - dc37c15e3b415343bfce0b6c9d3a947f52f7ad97691567ae9c34af6a7b826b34
C:\Program Files\7-Zip\7zG.exe.ico - 8cad493433ec34a34ca6f4fd49655aaf7cbb4337752743804db83ea6c050d1fe
C:\Program Files\7-Zip\Uninstall.exe.ico - ea0420b60b078a22fdcfd40d86d589793baa2e0327b37dcdcc5399aac4037d4e
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe - 2c46d8b7d1670e1303995b5a627c1d353acb6381817d343f8ea4723ef313420f
C:\Program Files\7-Zip\7z.exe - 9dd4cbb42236d863ea0beeceb8ae1f4dbfd006a1f357dc572fb3384fcb5bfc06
19ae4dc6481f738d164b59daa58659ddc4419911089464415840e7ab31e4bf4b - 19ae4dc6481f738d164b59daa58659ddc4419911089464415840e7ab31e4bf4b
C:\Program Files\7-Zip\7zFM.exe - 976e99479af2fc95d0de4aa27ad5f87ea25b06a3f0ed74706f8899725c0d0fb3
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe - 9ae7288d17700a2648c23ea61eea10254ba6b35b894a3d59f12064b5f275e8a0
C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe.exe - 54d3d2c95869b13d8947a0687a3e48335758759d77724e1360775fc8498a3c2d
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe - 917f370a6c9f8b0d0cc4ee41ee4359ac8a2c6098be910b57ed78a462139e6a53
C:\Program Files\7-Zip\7zG.exe.exe - 92ed31495924e6b976a6db5daaade88d4c06e3a17e28c39b6b37f970b0d60ff0
C:\Users\analyst\AppData\Local\Temp\tsk_b7af52345b3e45c7.exe.exe - c9cabfc5ec83a0cf53112d958da6828890f2bfe7cca3c60f42e247abde3f94e9
16bb9d11a76fa85f1edc7e2175f34bdd6ba06b3a03ee6c2b322b76dde6dd6e1a - 16bb9d11a76fa85f1edc7e2175f34bdd6ba06b3a03ee6c2b322b76dde6dd6e1a
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe.ico - 14b347748c4d208fa5294f7bdd53ae4147d40e27cf810dd60423af0d8b0c989c
C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe - 3e862fbb8dc542109b93ef0d432ba874a2e78d2636efa8bf1a952bbfce692211

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.eyuyan.com
https://wordps.officeapps.live.com/wrdps/wordprint.svc/wrdprint
https://wordps.officeapps.partner.office365.cn/wrdps/wordprint.svc/wrdprint
https://wordcs.officeapps.live.com/wordauto/wordautomation.svc/WordAutomation
http://schemas.microsoft.com/schemaLibrary/2003/solutionMappings
https://wordcs.officeapps.partner.office365.cn/wordauto/wordautomation.svc/WordAutomation
http://schemas.openxmlformats.org/wordprocessingml/2006/main
http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing
http://schemas.openxmlformats.org/markup-compatibility/2006
http://schemas.openxmlformats.org/officeDocument/2006/relationships
http://schemas.openxmlformats.org/drawingml/2006/main
http://schemas.openxmlformats.org/drawingml/2006/picture
http://schemas.microsoft.com/office/word/2010/wordml
http://schemas.microsoft.com/office/word/2012/wordml
http://schemas.microsoft.com/office/word
http://schemas.openxmlformats.org/package/2006/metadata/core-properties
http://www.w3.org/2001/XMLSchema-instance
http://purl.org/dc/dcmitype/
http://purl.org/dc/terms/

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com
www.eyuyan.com
wordps.officeapps.live.com
wordps.officeapps.partner.office365.cn
wordcs.officeapps.live.com
schemas.microsoft.com
wordcs.officeapps.partner.office365.cn
schemas.openxmlformats.org
www.w3.org
purl.org
wtqq.net

Embedded IP addresses

20.42.65.89
20.247.185.124
4.230.171.124
172.64.154.167
85.210.193.152
52.110.12.32
52.110.12.8
172.178.240.162
40.84.85.40
52.148.114.188
72.145.35.102
52.110.12.26
52.110.12.21

File paths

F:\Office\Target\x86\ship\postc2r\x-none\pdfreflow.pdb
W:\:a:f:k:p:u:z:
T:\:t:
F:\:q:
X:\:`:d:h:l:p:t:x:
T:\:`:h:l:x:
X:\:h:p:x:
P:\:
P:\:d:p:
X:\:x:
T:\:`:h:p:x:
T:\:d:l:
T:\:
T:\:d:l:p:x:
T:\:d:
X:\:l:p:t:
L:\:`:p:t:x:
D:\:l:p:
X:\:t:
X:\:`:h:
D:\:`:x:
X:\:d:
T:\:d:l:x:
T:\:d:l:t:
D:\:d:l:t:

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report