SUSPICIOUS — 1ee3d9202a04493627c5213908e8fde16334d13725b585517a6764bc38776b2f
SUSPICIOUS — 1ee3d9202a04493627c5213908e8fde16334d13725b585517a6764bc38776b2f is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (41/100). 1 of 53 detection engines flagged it.
Identification
- SHA-256:
1ee3d9202a04493627c5213908e8fde16334d13725b585517a6764bc38776b2f - SHA-1:
b1bfcc120135baa9b8f4d489b957595b2bcd43d8 - MD5:
c41f05cab36cd1d4b3ef52e7e243e81f - ssdeep:
24:OTcXpYGJsT/xAFPvky0bFrRm2W26SOc9e8ZgETia:O3e6A1sykFrQ2Ic9rB - TLSH:
T11012D120A85B1AAC774BDE4DF508D3BA34CE691304AF82199D2E347B50D45FDD8C8382 - Submitted as: 1ee3d9202a04493627c5213908e8fde16334d13725b585517a6764bc38776b2f
- File type: script · Size: 1112 bytes
- Verdict: suspicious (41/100)
Detections (1 of 53 engines)
- Microsoft Defender: Trojan:Script/Wacatac.B!ml
Why this verdict
The suspicious score of 41/100 is the fusion of 1 weighted signal:
- Obfuscated javascript script: dynamic-exec (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Dynamic analysis (windows)
1228 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- c.pki.goog
- ntp.ubuntu.com
- desktop-hsgcbep
- 250.255.255.239.in-addr.arpa
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787824835&P2=404&P3=2&P4=EZ0aiiUkC2uTH073mVezPHrczJjDccmSq6mnIQJ%2f1C68SeM5oMOpsNfoORPLCMAkKpqLI2fEpvOYLqYbmrrTkw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787824835&P2=404&P3=2&P4=EZ0aiiUkC2uTH073mVezPHrczJjDccmSq6mnIQJ%2f1C68SeM5oMOpsNfoORPLCMAkKpqLI2fEpvOYLqYbmrrTkw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787824897&P2=404&P3=2&P4=fEtyA8lEduWSscJBnp2DWPCZGbBzhcVEd%2fHeWk%2bdEi3CLhq2Um1RwqA%2bXQlHm%2bhM87mTCpECQ6oTpi05IX67Fg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://c.pki.goog/r/gsr1.crl
- http://c.pki.goog/r/r4.crl
- http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787221553&P2=404&P3=2&P4=cVmGPOcL3THmz1VAL%2fb%2bG3P4q7A3UDVmAtCVTPkiV1aVrksre04Gmgzb8OIdGjSDmF2uwFwwrLtF8OeIocKdIw%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787221169&P2=404&P3=2&P4=VC2rkIvSxr8ES1FhcgjfzLKXgZnI2rJXcm1G8Q9kiTgQ5kPx7tep3v0tmHXHB1Hh1RKVqkKxl5nryv1mZf4ftg%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 51.116.246.105
- 52.123.252.219
- 135.233.95.80
- 52.230.59.222
- 4.230.171.124
- 48.211.4.16
- 203.26.79.13
- 74.178.76.54
- 4.150.223.107
- 74.179.77.204
- 52.123.129.14
- 142.251.222.227
- 4.150.223.106
- 48.199.12.1
- 20.184.175.10
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report