SUSPICIOUS — 03d35b441b32a0acde26be40c33b708fe2d6a26290230b43aefab99191d3996d.msi

Verdict: suspicious (54/100) · Family: unknown

File type: office-ole · SHA-256: 03d35b441b32a0acde26be40c33b708fe2d6a26290230b43aefab99191d3996d

Source: MalwareBazaar · first seen 2026-07-29T00:00:00.000Z · SHA-256 verified

MITRE ATT&CK

• T1543.003
• T1112

YARA

Dynamic analysis (windows)

8835 behavior events · 2 ATT&CK techniques · 2 dropped files.

Runtime network

• www.msftconnecttest.com
• inference.location.live.net
• z6qz7d.oss-cn-beijing.aliyuncs.com
• 26nn.oss-cn-hangzhou.aliyuncs.com
• ietfgq.net
• upitem.oss-cn-hangzhou.aliyuncs.com
• ntp.ubuntu.com
• desktop-hsgcbep
• http://www.msftconnecttest.com/connecttest.txt
• 23.40.52.85
• 20.190.167.64
• 135.149.173.69
• 52.123.252.213
• 23.198.40.44
• 52.110.12.22
• 57.154.63.210
• 4.230.171.124
• 52.168.112.66
• 150.171.22.17
• 23.33.238.114

Analyzed on MalwareAnalyzer by Cyble · Open interactive report