CLEAN — help.py

CLEAN — help.py is a script sample analyzed by MalwareAnalyzer by Cyble with a clean verdict (0/100). 0 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 073dcb7233505e4cf80aefffa4be0267cea8e3e1cd2d98f535959d949863baed
SHA-1: 2003987e8b500e47fea9cd84ecc2b142a5ee2ead
MD5: 9577d47288a8e1de8476f651719068a7
ssdeep: 24:1/Mt5jdySvXDgBISHpOL5smkQf2FtLGmde8LLj5kh3ANX2M3y:oySMBxHpOFWQ028L35khw3y
TLSH: T1AD12924A31A6391F1407CA452CF5467F1E1126CD20698C50EC6C37E07436E27921A67A
Submitted as: help.py
File type: script · Size: 1108 bytes
Verdict: clean (0/100)

Detections (0 of 53 engines)

No engine flagged this sample.

MITRE ATT&CK

T1112

Dynamic analysis (windows)

1131 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
250.255.255.239.in-addr.arpa
desktop-hsgcbep._dosvc._tcp.local
_dosvc._tcp.local
ntp.ubuntu.com
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787595867&P2=404&P3=2&P4=gxWTRsmIIgAPOfmPtwj66Kyk6Qj6x0ZbVoYmgBpAanttIBpu8PTvv16B%2fLgOBUtTnSvCz7Kv9fvSeHqVtQ%2fehA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787595950&P2=404&P3=2&P4=W5KW1Or8gRkS7kSSoscTd7hMO3cixIx7oFXKeVdUrc9sNuv6SoQnd1EXgd6gwKks01m1TmzCjBmPmZF9o7aKUQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded IP addresses

52.110.12.16
52.253.84.76
4.230.171.124
74.179.77.204
20.184.175.8
20.112.250.133
52.123.129.14
20.165.94.46
72.153.5.136
203.26.79.13
135.233.45.222
135.233.95.80
142.250.207.3
142.250.195.227

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report