MALICIOUS — 1b8ce20074e2a7a3697f6ed919ae51edf1cb336654076ac18182490a9ff5d9fb.js

MALICIOUS — 1b8ce20074e2a7a3697f6ed919ae51edf1cb336654076ac18182490a9ff5d9fb.js is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the ObfLoader family. 3 of 50 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 1b8ce20074e2a7a3697f6ed919ae51edf1cb336654076ac18182490a9ff5d9fb
SHA-1: 161d4f18be0ebdd28d4099f109673c1aa1efd5c2
MD5: 50ef1d4e5f70fcd85551cba6307fb413
ssdeep: 98304:PE6TNuiJm5RK9c2sQzScu4fbUw0/+vRZ1fbE+NXdvXdUbdGiSrM9qTni9oYY:PE65uJ5gfPScu4fbUv/+pZhXdvX5iSuu
TLSH: T1715F08F2034B67EF01DA07424336A16B46FE97E47671AD908D8139A68DCDDC0ED2426E
Submitted as: 1b8ce20074e2a7a3697f6ed919ae51edf1cb336654076ac18182490a9ff5d9fb.js
File type: script · Size: 3408724 bytes
Verdict: malicious (100/100) · Family: ObfLoader

Detections (3 of 50 engines)

Hash: abuse.ch ThreatFox: known-malicious-hash
Emsisoft (Emergency Kit): GT:JS.ObfLoader.3.C03D7922
Kaspersky (KVRT): HEUR:Trojan-Downloader.Script.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. RWX/private injected region in svchost.exe (pid 924) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Emsisoft (Emergency Kit) flagged GT:JS.ObfLoader.3.C03D7922 (rule GT:JS.ObfLoader.3.C03D7922) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.Script.Generic (rule HEUR:Trojan-Downloader.Script.Generic) - engine signal, weight 0.55, confidence 0.85
Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 34 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

7932 behavior events · 2 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786462796&P2=404&P3=2&P4=HXrMyaUJ8EmMNR9P57HgSA9MeYrDbigzwbVhistz1qNBjWow0V6TlaKbaAe7rwaHZ4wB38LQF%2fX1yC6R2ja65A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786462833&P2=404&P3=2&P4=ANydAzJYGxOziqR5Udz49xKqq3D6KU0qP9jGa2Pdqf2U5NEgFMkA08osNnwBd2wMgxIhRyXeyubYvNYDg4hKpg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

51.105.71.136
52.123.252.198
4.230.171.124
172.215.188.232
57.155.104.224
20.247.184.197
40.79.163.155
74.178.240.61
74.178.76.54
20.42.65.85
172.178.240.163
40.84.85.40
135.233.45.222
20.50.201.201
203.26.79.13
20.165.94.46
72.145.35.116
52.148.114.188
52.110.12.22
52.110.12.15

More ObfLoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report