SUSPICIOUS — 14df098e20f5952c45fafe2c40487b32916fefee9fafb09430d4a213fbf7e13e

SUSPICIOUS — 14df098e20f5952c45fafe2c40487b32916fefee9fafb09430d4a213fbf7e13e is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (49/100), attributed to the Maldoc family. 1 of 54 detection engines flagged it.

Identification

• SHA-256: 14df098e20f5952c45fafe2c40487b32916fefee9fafb09430d4a213fbf7e13e
• SHA-1: 6f50fab11d26a512233df45745184b71515cd156
• MD5: fd27db92e7a0edf5360f709fa5bd5278
• ssdeep: 48:lWyAJOIHbXis0OWD64ziEDQ3hh54tcBTiXyuv4dpOeH/wmB8f9Vj1pH:lnAj7XiJfD64ziEDqGcB8fv4vWzH
• TLSH: T13D16BD72527A1D1A074FFF8264AE880D6BC5F5812748390F0F96D342241798E9B4B7BE
• Submitted as: 14df098e20f5952c45fafe2c40487b32916fefee9fafb09430d4a213fbf7e13e
• File type: script · Size: 3116 bytes
• Verdict: suspicious (49/100) · Family: Maldoc

Detections (1 of 54 engines)

• YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec

Why this verdict

The suspicious score of 49/100 is the fusion of 1 weighted signal:

• YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.70, confidence 0.70

Dynamic analysis (windows)

1141 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• desktop-hsgcbep._dosvc._tcp.local
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• 23.40.52.209
• 23.11.37.157
• 20.190.167.20
• 52.230.59.222 SG · Singapore · AS8075 Microsoft Corporation
• 150.171.22.17
• 23.33.238.188
• 52.110.12.3 AU · Sydney · AS8075 Microsoft Corporation
• 4.230.171.124 KR · Seoul · AS8075 Microsoft Corporation
• 23.33.238.114
• 23.33.238.199

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded IP addresses

• 20.184.175.15
• 52.230.59.222
• 52.110.12.3
• 4.230.171.124
• 40.79.150.123
• 4.150.223.96

More Maldoc samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report