MALICIOUS — f04b2b548cb9969e05ae032cf880efacc67f6a0ac797698b54352928ef75119d

MALICIOUS — f04b2b548cb9969e05ae032cf880efacc67f6a0ac797698b54352928ef75119d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 9 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: f04b2b548cb9969e05ae032cf880efacc67f6a0ac797698b54352928ef75119d
SHA-1: a0bcf96622accf371bf8c749cc5b343079fa163b
MD5: bc605d286446db915f6fdfe0d703aec9
imphash: 45fd9b63a881719b9b56f34ef23b9c19
ssdeep: 49152:ciYV9zOe4gwiYV9zOe4g7G93iItboeisbPj:89yfR9yfz
TLSH: T12B5B18C50146DB81C0F45F9D7C3886AD60D2B06473359E089A87F42E8EEA2E39DB4D9D
Submitted as: f04b2b548cb9969e05ae032cf880efacc67f6a0ac797698b54352928ef75119d
File type: pe · Size: 2176794 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (9 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): ASPack
ClamAV (daily): Win.Malware.Genpack-9877676-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
YARA: Yara-Rules community: YR_AntiDebug_Checks
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Vindor.B
Emsisoft (Emergency Kit): Gen:Heur.Mint.Autorunner.1
Kaspersky (KVRT): Worm.Win32.AutoRun.vx

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Malware.Genpack-9877676-0 (rule Win.Malware.Genpack-9877676-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Vindor.B (rule Trojan:Win32/Vindor.B) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Mint.Autorunner.1 (rule Gen:Heur.Mint.Autorunner.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.AutoRun.vx (rule Worm.Win32.AutoRun.vx) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70
Contacted 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged ASPack (rule ASPack) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: 4.6.0.111 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: ASPack, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 22 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

25494 behavior events · 1 ATT&CK techniques · 23 dropped files.

Dropped files

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - 377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - 91b20f2d540a94a860cd232421af91b84f41665ae86a19223c3f43c9da6a861d
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe - 6a78dba30ca10f3addef5b1683bd7bc97e98ce03c9e6ae7056845ee1b70b7d10
C:\Program Files\7-Zip\7zFM.exe - ae99161b44ba39e71185546cae51b34768d5217d7d5a7f22647a37737ecbfe58
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe - 63156ae4b122e6f9584581782b64327bfbf60d31ae39de283fd5beeea5aa6746
C:\Program Files\7-Zip\7zG.exe - 894f3241a36a4cb175ce47760b11ba7972d326e1fc613e592f1c2edb30ac1cfb
C:\Program Files\7-Zip\7z.exe - 634d38c0c414178e2f35de5cc0fb29aa082eec227e630c4481e1af7694980ac9
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe - 545f4b1ba2125dbcaa7d148b74eccacb63a568fc93bb1d86c4b954975c7a256a
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe - 7f65f5ae08cc5a15df0c7d70e3fc3ba5b4f083dcbdc02170423867257ffaf076
C:\Program Files\7-Zip\7zG.exe - 7b5eda73c21960c451ea3148900b28cdbac7180e43047fbc944028096e497c08
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe - da6d0544ee3a6b75f3c5c545213b10ec93a15d5213e5232e7e224a29ecb91d6b
C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\MenuCoreApp\AcroShareTarget.exe - f8e5f96f5d1a4af50ee6a35ecf9d629e1694d8397d681a7d1eb7683c2a3a653c
C:\Program Files\7-Zip\7zFM.exe - 2e030aa5cdf7c562c0acc516e43265d031ec41f448f972d2c3882e9208aa3eb8

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
http://crl3.digicert.com/assured-cs-g1.crl00
http://crl4.digicert.com/assured-cs-g1.crl0L
https://www.digicert.com/CPS0
http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
http://www.digicert.com/ssl-cps-repository.htm0
http://crl3.digicert.com/sha2-assured-cs-g1.crl05
http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
http://schemas.microsoft.com/appx/2010/manifest
http://schemas.microsoft.com/appv/2010/manifest
http://www.w3.org/2000/09/xmldsig#
http://www.w3.org/2001/XMLSchema-instance
http://www.w3.org/2000/09/xmldsig#sha1
http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com/0
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://schemas.microsoft.com/appv/2010/deploymentconfiguration
http://schemas.microsoft.com/appv/2010/userconfiguration
http://schemas.microsoft.com/appv/2010/streammap

Embedded domains

schemas.microsoft.com
www.digicert.com
crl3.digicert.com
crl4.digicert.com
cacerts.digicert.com
www.w3.org
crl.microsoft.com
www.microsoft.com
office.microsoft.com

Embedded IP addresses

4.6.0.111
20.42.179.204
4.150.223.104
52.123.252.197
4.144.132.114
57.155.101.212
4.230.171.124
74.178.76.54
74.178.240.61
4.150.223.96
104.18.33.89
162.159.142.9
92.223.78.30
52.148.114.188
20.42.179.192
72.153.5.134
52.110.12.31
52.110.12.1

Registry keys

HKEY_LOCAL_MACHINE\Software\Classes\{0}.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinFirewall

File paths

C:\Program
f:\dd\Tools\devdiv\FinalPublicKey.snk
p:\Target\x86\ship\setuptools\x-none\Flattener.pdb
c:\vbvirus\ownerprotect.ptt
C:\905c0769f9a06c95a24ddf945\
C:\905c0769f9a06c95a24ddf945\patcher.exe

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report