MALICIOUS — 1f08f9f32e11ab34fb2fc342cfdbc346a0c0e0e61c19275041e14d2fd776d4f1
MALICIOUS — 1f08f9f32e11ab34fb2fc342cfdbc346a0c0e0e61c19275041e14d2fd776d4f1 is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100). 2 of 54 detection engines flagged it.
Identification
- SHA-256:
1f08f9f32e11ab34fb2fc342cfdbc346a0c0e0e61c19275041e14d2fd776d4f1 - SHA-1:
bd30505c3e907804eafafc3fc23dfbd015825ef6 - MD5:
f2067f0b102b6c31de0beb75b008f81b - ssdeep:
768:e44yLMNvgnDwYB+IlnHB9/bNlJyI3G7OaXiQx9kpETpUwnOQdZMvUtVo0uKHp+nv:Ir6pyYG7OH2pHZMvUtzOnv - TLSH:
T1422DB7AF7C993D9DC80D41532D8CAA567B03BC49A85585E5C3FDE39CB0A0ED14C18CAA - Submitted as: 1f08f9f32e11ab34fb2fc342cfdbc346a0c0e0e61c19275041e14d2fd776d4f1
- File type: script · Size: 26983 bytes
- Verdict: malicious (87/100)
Detections (2 of 54 engines)
- Microsoft Defender: Trojan:JS/Agent.AG!MSR
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 87/100 is the fusion of 4 weighted signals:
- Microsoft Defender flagged Trojan:JS/Agent.AG!MSR (rule
Trojan:JS/Agent.AG!MSR) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: http://www.smartmenus.org/, http://vadikom.com - static signal, weight 0.35, confidence 0.60
Dynamic analysis (windows)
1209 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- 250.255.255.239.in-addr.arpa
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- 23.40.52.85
- 23.11.37.157
- 20.190.142.164
- 4.144.132.114 SG · Singapore · AS8075 Microsoft Corporation
- 150.171.22.17
- 23.33.238.178
- 52.110.12.1 US · AS8075 MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US
- 4.230.171.124 KR · Seoul · AS8075 Microsoft Corporation
- 23.33.238.173
- 20.42.179.192 US · Moses Lake · AS8075 Microsoft Corporation
- 23.33.238.102
Embedded URLs
- http://www.smartmenus.org/
- http://vadikom.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- www.smartmenus.org
- vadikom.com
- e.top
- s.bottom-s.top
- u.top
- i.top
- ebtihag.com
Embedded IP addresses
- 85.210.193.152
- 135.233.95.80
- 172.172.255.217
- 4.144.132.114
- 52.110.12.1
- 4.230.171.124
- 20.42.179.192
- 74.178.76.128
- 20.42.73.30
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report