MALICIOUS — dd55a62e39211fb456cacb3b3d52ae6bb00b0ebab8645710e0ea282f819275dd
MALICIOUS — dd55a62e39211fb456cacb3b3d52ae6bb00b0ebab8645710e0ea282f819275dd is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the NabucurObfs family. 5 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
dd55a62e39211fb456cacb3b3d52ae6bb00b0ebab8645710e0ea282f819275dd - SHA-1:
07a5ce543558b06e3b617ad5c6620ce69db328b7 - MD5:
bae66633af1dafd70ae327edee684f2e - imphash:
d41d8cd98f00b204e9800998ecf8427e - ssdeep:
24576:DpCWxRu+lGG8B2wKLeX5MlQV485VBUomwsoLmtO:DpCau+YZB2keQm8e8somw - TLSH:
T14A58FD93AC01BE69D31C92C9225C575E5717E6CD9414A1C18BBE3CB490CBCE2F0EB296 - Submitted as: dd55a62e39211fb456cacb3b3d52ae6bb00b0ebab8645710e0ea282f819275dd
- File type: pe · Size: 1765376 bytes
- Verdict: malicious (99/100) · Family: NabucurObfs
Detections (5 of 25 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
- Microsoft Defender: Trojan:Win32/NabucurObfs
- Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
- Trellix Stinger (McAfee): W32/VirRansom
- Kaspersky (KVRT): Virus.Win32.PolyRansom.a
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 10 weighted signals:
- Dropped a malicious payload: bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - dynamic signal, weight 0.80, confidence 0.90
- Microsoft Defender flagged Trojan:Win32/NabucurObfs (rule
Trojan:Win32/NabucurObfs) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.5 (rule
Win32.Virlock.Gen.5) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged W32/VirRansom (rule
W32/VirRansom) - engine signal, weight 0.55, confidence 0.85 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 36 external host(s) at runtime (15 HTTP) - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
- Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
45161 behavior events · 2 ATT&CK techniques · 38 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- google.com
- ctldl.windowsupdate.com
- login.live.com
- settings-win.data.microsoft.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- msedge.api.cdp.microsoft.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- geo.prod.do.dsp.mp.microsoft.com
- assets.msn.com
- kv801.prod.do.dsp.mp.microsoft.com
- cp801.prod.do.dsp.mp.microsoft.com
- msedge.b.tlu.dl.delivery.mp.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/8900/files/144a2edcdb969fe06ca2c760083e5fd6321d5278c82ccfe17aa199ac27b70105 -
144a2edcdb969fe06ca2c760083e5fd6321d5278c82ccfe17aa199ac27b70105 - /opt/CAPEv2/storage/analyses/8900/files/e7ffcf05adaa39bfb361b018b8ff4989f53e4c4e945db92b4d8c675c3807f4b2 -
7e3b016217087ddc508e8d1ee7e878a561213c0ba51ddf55e6f8da3eb0ea3437 - /opt/CAPEv2/storage/analyses/8900/files/e5208a4a6b0a524b1b15e44a0ab8d2783ef6ccf0cad244c289151a173c30dd26 -
e5208a4a6b0a524b1b15e44a0ab8d2783ef6ccf0cad244c289151a173c30dd26 - /opt/CAPEv2/storage/analyses/8900/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 -
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - /opt/CAPEv2/storage/analyses/8900/files/81e71575a1c3b05e2c22022366aadb03608ddc070e59d3a84172e7bbb250ee21 -
81e71575a1c3b05e2c22022366aadb03608ddc070e59d3a84172e7bbb250ee21 - /opt/CAPEv2/storage/analyses/8900/files/656030769e3f91b5e89eb6d25838012986285c26e71f346c1954693d3c76a0cc -
656030769e3f91b5e89eb6d25838012986285c26e71f346c1954693d3c76a0cc - /opt/CAPEv2/storage/analyses/8900/files/187870286be52edb532288743499a6a4a1c793833e7163f1090ac4298c4f1f26 -
187870286be52edb532288743499a6a4a1c793833e7163f1090ac4298c4f1f26 - /opt/CAPEv2/storage/analyses/8900/files/77d820e958b75de7be6cd97dd68b9b46b755226779bd2f5bb61cd662f615e543 -
77d820e958b75de7be6cd97dd68b9b46b755226779bd2f5bb61cd662f615e543 - /opt/CAPEv2/storage/analyses/8900/files/0dd7aa88dd841538a4d046110095908965bae3b785918dedabc334711cb04dd2 -
0dd7aa88dd841538a4d046110095908965bae3b785918dedabc334711cb04dd2 - /opt/CAPEv2/storage/analyses/8900/files/13015975f8f926a89b650164fc7817c418e825d8aaef5a56986f16e327290f8d -
13015975f8f926a89b650164fc7817c418e825d8aaef5a56986f16e327290f8d - /opt/CAPEv2/storage/analyses/8900/files/dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d -
dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d - /opt/CAPEv2/storage/analyses/8900/files/bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620 -
bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620 - /opt/CAPEv2/storage/analyses/8900/files/a8ae4d80a94eea90ede4a84fb155bd8148bdcf980d616a2010b1fea5ddd9754d -
a8ae4d80a94eea90ede4a84fb155bd8148bdcf980d616a2010b1fea5ddd9754d - /opt/CAPEv2/storage/analyses/8900/files/66987423f1b6eca24bc98ea6deff847fbca75ff2ce8839dc32e61a404cf81ba9 -
66987423f1b6eca24bc98ea6deff847fbca75ff2ce8839dc32e61a404cf81ba9 - /opt/CAPEv2/storage/analyses/8900/files/d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698 -
d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786367473&P2=404&P3=2&P4=Y7WLMI4oBWTBbAUd9tMxxt5FqY%2f5BwczxnUA6GOk2knA1dXV62cv2hz75FHWRNNKABlk5qqHe6IUUp1AHwVHzw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://google.com/
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786367535&P2=404&P3=2&P4=Tjf38QGmt74AaeAJieP%2baqz16REgs9kLuvdfAweME9FHnkIwVclGXPLyJyKAPp2uX9qLi0tDEflclVenNUihMg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 48.211.4.16
- 20.42.65.90
- 52.123.252.229
- 20.247.184.197
- 4.230.171.124
- 20.42.179.204
- 135.232.92.137
- 135.232.92.97
- 20.42.65.94
- 20.165.94.63
- 74.178.232.29
- 203.26.79.13
- 135.233.45.222
- 92.223.78.30
- 200.87.164.69
- 4.247.188.224
- 200.119.204.12
- 190.186.45.170
- 72.153.5.139
- 52.148.114.188
- 142.250.195.174
- 142.250.207.14
- 52.110.12.37
- 52.110.12.11
File paths
- H:\v~@
More NabucurObfs samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report