SUSPICIOUS — 2d1ec17083ea606da07bf3a9ec8b23e26f95b4a5c75234150b506179c47ca0ba
SUSPICIOUS — 2d1ec17083ea606da07bf3a9ec8b23e26f95b4a5c75234150b506179c47ca0ba is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (65/100), attributed to the Maldoc family. 3 of 53 detection engines flagged it.
Identification
- SHA-256:
2d1ec17083ea606da07bf3a9ec8b23e26f95b4a5c75234150b506179c47ca0ba - SHA-1:
86c725b31674000d7ef89ddc289d2354b85f9a0c - MD5:
6a2e918e78a49b067be75ef52b4673ef - ssdeep:
1536:3ZcKgyOLPrNrVrt49rXrNreRa8G50rU2yvPVUFOj/r8oChepiz7oF3:Jn04o5O2yvPVTj1F3 - TLSH:
T1F338199738485EDCFD4D088AAEDCB4FB3B477A12B921A4D8837CDB08D460CB15895639 - Submitted as: 2d1ec17083ea606da07bf3a9ec8b23e26f95b4a5c75234150b506179c47ca0ba
- File type: script · Size: 84104 bytes
- Verdict: suspicious (65/100) · Family: Maldoc
Detections (3 of 53 engines)
- YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
- Microsoft Defender: Trojan:JS/Agent.AG!MSR
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 65/100 is the fusion of 3 weighted signals:
- Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule
DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://www.apple.com/quicktime/download, https://vimeo.com/api/oembed.json?url=, http://www.apple.com/quicktime/download/ - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.apple.com/quicktime/download
- http://www.adobe.com/go/getflash
- https://vimeo.com/api/oembed.json?url=
- http://www.apple.com/quicktime/download/
- http://www.apple.com/qtactivex/qtplugin.cab#version=
Embedded domains
- www.apple.com
- www.adobe.com
- ilightbox.net
- youtube.com
- youtu.be
- img.youtube.com
- vimeo.com
- g.top
- m.top
- m.top-g.top
- f.top
- o.top
- t.top
- www.facebook.com
- twitter.com
- delicious.com
- digg.com
- reddit.com
- player.vimeo.com
- www.youtube.com
- i.name
- a.name
- alliancehp.org
More Maldoc samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report