MALICIOUS — 1217b7b48b21d322037e4f2b9a54b8f45e8e3674b094a97a2aa042fce3fe2004.msi
MALICIOUS — 1217b7b48b21d322037e4f2b9a54b8f45e8e3674b094a97a2aa042fce3fe2004.msi is a office-ole sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Malgent family. 3 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
1217b7b48b21d322037e4f2b9a54b8f45e8e3674b094a97a2aa042fce3fe2004 - SHA-1:
765b3b082e6b4e88a0a97aa5a85e53f4be9f1fd9 - MD5:
307954de49a162f46f2a3f66deeccee4 - ssdeep:
196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZshM:rBjf4vFYmROxLb - TLSH:
T1BC693328731A2916CC4AFE126C0A996C0EA7FC77507B758DB281B19756C942B53B30F3 - Submitted as: 1217b7b48b21d322037e4f2b9a54b8f45e8e3674b094a97a2aa042fce3fe2004.msi
- File type: office-ole · Size: 8990720 bytes
- Verdict: malicious (99/100) · Family: Malgent
Source: MalwareBazaar · first seen 2026-07-31T00:00:00.000Z · SHA-256 verified
Detections (3 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: Trojan:Win64/Malgent!MSR
- Kaspersky (KVRT): Trojan-Banker.Win32.Emotet.gqgq
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 12 weighted signals:
- Microsoft Defender flagged Trojan:Win64/Malgent!MSR (rule
Trojan:Win64/Malgent!MSR) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Trojan-Banker.Win32.Emotet.gqgq (rule
Trojan-Banker.Win32.Emotet.gqgq) - engine signal, weight 0.55, confidence 0.85 - Obfuscated powershell script: dynamic-exec, defense-evasion (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 29 external host(s) at runtime (5 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded executable payload carved at offset 20480 - static signal, weight 0.40, confidence 0.70
- Document contains macros/active content: vba - static signal, weight 0.35, confidence 0.75
- Embedded network infrastructure: 4.0.5.0 - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
4057 behavior events · 2 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- bnqyz8.oss-cn-beijing.aliyuncs.com
- 2026mn.oss-cn-hongkong.aliyuncs.com
- qcpcui.net
- desktop-hsgcbep
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786293813&P2=404&P3=2&P4=GwXN2nQ8wJLnpzYvfpRjR3B7JjGFbTnunRnMDx%2bYPolLg3CZw41zQCpBcXaDaVGzYjOBBIu0U1SpQHgUOlNnng%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786293832&P2=404&P3=2&P4=MNCVnvhk5Z2%2bESDYiu6Gjrjo6WO0cTkEYoJun2dO4IA4%2f4a5WHa3mGr%2bCFWbubOS0lPJdUsKXfR34rA00nXJrQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- 23.40.52.85
- 20.190.142.165
- 23.198.40.44
- 52.110.12.14 AU · Sydney · AS8075 Microsoft Corporation
Dropped files
- tmp_tmp.o8V38ArCj3 -
ddb61e7e3c17cd9238e82033cf074aed257895024b7e7a6d7cc88f9dfa4a13bb
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786293813&P2=404&P3=2&P4=GwXN2nQ8wJLnpzYvfpRjR3B7JjGFbTnunRnMDx%2bYPolLg3CZw41zQCpBcXaDaVGzYjOBBIu0U1SpQHgUOlNnng%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786293832&P2=404&P3=2&P4=MNCVnvhk5Z2%2bESDYiu6Gjrjo6WO0cTkEYoJun2dO4IA4%2f4a5WHa3mGr%2bCFWbubOS0lPJdUsKXfR34rA00nXJrQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- wa.ml
- tt.no
- tk.eu
- u.fr
- table.name
- hash.name
- bnqyz8.oss-cn-beijing.aliyuncs.com
- 2026mn.oss-cn-hongkong.aliyuncs.com
- qcpcui.net
Embedded IP addresses
- 4.0.5.0
- 4.247.188.224
- 172.172.255.218
- 20.42.72.131
- 51.116.253.170
- 172.178.240.161
- 52.110.12.14
- 4.230.171.124
- 72.145.35.104
- 203.26.79.13
- 85.210.193.152
- 52.230.59.222
- 20.247.184.142
- 74.178.76.54
- 4.150.223.108
- 20.184.175.5
- 39.103.20.137
- 47.79.64.254
File paths
- O:\+GN
- v:\\
- w:\Mt
- A:\!
- I:\%&
- P:\L]{
More Malgent samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report