MALICIOUS — 2697aaf4ccb37a6e5ce112138914f23de5faa5324ad0610d5e544d53267858cc

MALICIOUS — 2697aaf4ccb37a6e5ce112138914f23de5faa5324ad0610d5e544d53267858cc is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Maldoc family. 6 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 2697aaf4ccb37a6e5ce112138914f23de5faa5324ad0610d5e544d53267858cc
• SHA-1: d7f040e1f54cfd22b2d6c16894ed270977b566fa
• MD5: 0e2168efe8ca7414291f9f3fd699c478
• ssdeep: 96:l/NhnGUHVgnurENMNzN1NdNBNSNQNMNBNZNNNBNDNjN12FbkZE/oh/4Fbkojc/06:lFBmuwNMNzN1NdNBNSNQNMNBNZNNNBNh
• TLSH: T1621ADE7DBD142D2FE7862C402274D45CBD83B4CA3A4471EB56A98281281BF85FD4E273
• Submitted as: 2697aaf4ccb37a6e5ce112138914f23de5faa5324ad0610d5e544d53267858cc
• File type: script · Size: 4633 bytes
• Verdict: malicious (99/100) · Family: Maldoc

Detections (6 of 54 engines)

• YARA: MalwareAnalyser built-in: Suspicious_PowerShell_Download_Exec
• capa (capabilities): capability:execution/powershell
• YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
• YARA: MalwareAnalyser community pack: TL_Suspicious_PowerShell_Download
• YARA: Yara-Rules community: YR_AntiVM_Sandbox
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

• T1059.001
• T1497

YARA

• Suspicious_PowerShell_Download_Exec

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

• Encoded/hidden PowerShell download-and-exec (rule Suspicious_PowerShell_Download_Exec) - yara signal, weight 0.70, confidence 0.90
• YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.70, confidence 0.70
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• Obfuscated vbscript script: download, dynamic-exec (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• YARA: MalwareAnalyser community pack flagged TL_Suspicious_PowerShell_Download (rule TL_Suspicious_PowerShell_Download) - engine signal, weight 0.50, confidence 0.70
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• YARA: Yara-Rules community flagged YR_AntiVM_Sandbox (rule YR_AntiVM_Sandbox) - engine signal, weight 0.40, confidence 0.70
• YARA: MalwareAnalyser built-in flagged Suspicious_PowerShell_Download_Exec (rule Suspicious_PowerShell_Download_Exec) - engine signal, weight 0.35, confidence 0.70
• capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
• query domain / anti-analysis (rule query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: http://192.168.2.120/reverse_shell_120_4444.ps1 - static signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

1127 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• desktop-hsgcbep._dosvc._tcp.local
• desktop-hsgcbep(1)._dosvc._tcp.local
• desktop-hsgcbep(2)._dosvc._tcp.local
• desktop-hsgcbep(3)._dosvc._tcp.local
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788019564&P2=404&P3=2&P4=EgyKxG68syNc5fB24KUPDldnKAmHwjFPy3OjP0YcT6%2fekwIbgyg1eEcvyKmLpF8nIFN1Dos8lW%2fDw3PMbn4NXw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
• 23.40.52.209
• 23.11.37.157
• 20.190.167.66
• 150.171.22.17
• 23.33.238.178

Embedded URLs

• http://192.168.2.120/reverse_shell_120_4444.ps1
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788019564&P2=404&P3=2&P4=EgyKxG68syNc5fB24KUPDldnKAmHwjFPy3OjP0YcT6%2fekwIbgyg1eEcvyKmLpF8nIFN1Dos8lW%2fDw3PMbn4NXw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

• 192.168.2.120
• 4.230.171.124
• 20.42.73.30
• 135.232.92.137
• 72.145.35.98
• 203.26.79.13
• 40.84.85.40

More Maldoc samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report