Advice Request Malware sample that leads to a weird site

[Nagisa]

I was wandering through the Abuse.ch and uploading undetected samples to the Hybrid Analysis. There were one sample that got rated suspicious, I saw it and looked it a bit more about it. Only detection were from APEX. Falcon Sandbox result were not reliable as the file had Anti-VM. When I visited the URL it found, this screen came up.

Intezer didn't show much thing either. Thousands of unique genes...

I would like to know what this file is about.

Free Automated Malware Analysis Service - powered by Falcon Sandbox

Submit malware for free analysis with Falcon Sandbox and Hybrid Analysis technology. Hybrid Analysis develops and licenses analysis tools to fight malware.

www.hybrid-analysis.com

Analysis http://context.cc Suspicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

Intezer Analyze

analyze.intezer.com

 

[TairikuOkami]

https version is funny though

 

[ForgottenSeer 89360]

I am unable to execute the file with SHA2 4ae55e809e9e0827b30086ab18a6110ff2feb6098f35eab2106ead850fe521e7.
Looks like it is damaged.

 

[struppigel]

I agree with @McMcbrad here. The file is truncated. The directory entries for import table and IAT point outside of the file.

Edit: The strings point to something Bittorrent related.
.cc is an extension for C source code. I wouldn't be too sure that context.cc was meant as URL. You will find similar strings in the file like main.cc and BtRejectMessage.cc.

 

[ForgottenSeer 89360]

.cc is an extension for C source code. I wouldn't be too sure that context.cc was meant as URL.

There is some malicious/potentially unwanted software that has communicated with this URL:

Some of it looks like cracked MS Office installations. But it really may not be meant as a URL.

VirusTotal

VirusTotal

www.virustotal.com

 

[struppigel]

VT only extracted the string "context.cc" from the body and put it under referring files. That does not mean these files actually communicated with this URL or even meant this as a URL.

It's more likely vice versa: Someone realised it is a common string in C applications and you can register this as valid URL to generate traffic.
But even that is only speculation and I don't like speculating too much.