MALICIOUS — 269e4f844172fe0d0c01883d43fe7ea5a1c101e3467b2d839490deff38f2ac6b

MALICIOUS — 269e4f844172fe0d0c01883d43fe7ea5a1c101e3467b2d839490deff38f2ac6b is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100). 0 of 53 detection engines flagged it.

Identification

SHA-256: 269e4f844172fe0d0c01883d43fe7ea5a1c101e3467b2d839490deff38f2ac6b
SHA-1: acf8a6f8fa13c85e7ec1f6ccff5d918cd78e1086
MD5: b514e229f33b93c9f91cca4b1b6ad163
ssdeep: 96:GyrZT/o1JhSJp8hGxq9if8aqaTfYTzyyra9AkYLVErqif:7hb2x6Jf2zLraqnBif
TLSH: T19F1AC81F32264E9D0250242E91F82261DCC3F60DFA5536CB6BDF0FBA981D52590672BA
Submitted as: 269e4f844172fe0d0c01883d43fe7ea5a1c101e3467b2d839490deff38f2ac6b
File type: html · Size: 4554 bytes
Verdict: malicious (84/100)

Detections (0 of 53 engines)

No engine flagged this sample.

Why this verdict

The malicious score of 84/100 is the fusion of 5 weighted signals:

Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 22 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://icons.iconarchive.com/icons/dakirby309/simply-styled/256/Microsoft-Purchase, https://cdn1.cloudpro.co.uk/sites/cloudprod7/files/styles/thumbnail_large_620x350/public/onedrive_logo.png?itok=w_rJbRrF, https://laskinnix.com/doc498/exceldirve.php - static signal, weight 0.35, confidence 0.60
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

278 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://icons.iconarchive.com/icons/dakirby309/simply-styled/256/Microsoft-Purchase
https://cdn1.cloudpro.co.uk/sites/cloudprod7/files/styles/thumbnail_large_620x350/public/onedrive_logo.png?itok=w_rJbRrF
https://laskinnix.com/doc498/exceldirve.php
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787823370&P2=404&P3=2&P4=J19dZMoVJCwxPMgKasloPWbCwEWdXk0amXq8PfEzoNzfC0RbfgSbHn5N%2bjkSy5fP%2bz39%2bbZHkza7SsgIRoh1wA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787823431&P2=404&P3=2&P4=mmZPiJJewXnSdD9ge4ojGqsOIjiHinWjavYindmBY%2fTfqMN5VsG7SEcV7gtOLLDUoirew23WY0X2eaCuruF40g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

icons.iconarchive.com
cdn1.cloudpro.co.uk
laskinnix.com
glacesdesalpes.com

Embedded IP addresses

20.184.175.16
52.123.252.235
4.230.171.124
85.210.193.152
4.144.132.223
135.232.92.137
74.179.77.164
4.150.223.107
20.236.44.162
52.123.128.14
40.103.64.226
52.123.129.14
4.207.44.70
135.233.45.222
135.233.95.80
203.26.79.13
52.148.114.188
20.42.73.31
74.178.76.44
72.154.7.108
52.110.12.54
52.110.12.1

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report