SUSPICIOUS — 2ec97fcbb16ae2a5f2c2c3071c512146b27628d3a222451b87bdb24f0c6ea65d

SUSPICIOUS — 2ec97fcbb16ae2a5f2c2c3071c512146b27628d3a222451b87bdb24f0c6ea65d is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (41/100). 2 of 53 detection engines flagged it.

Identification

SHA-256: 2ec97fcbb16ae2a5f2c2c3071c512146b27628d3a222451b87bdb24f0c6ea65d
SHA-1: d862655a13dd1ad543f976b7061adcbad7eb1141
MD5: 3b08f5272256610c46c6b69b5c5e0041
ssdeep: 192:AK44zFvjElLNZ1eaQZKoEzW1KF2DDkRkps21zfPku:fClLB2KoEzW1KFysPu
TLSH: T16B2174CA38959FDDCD4E74667FCAB883370B9B34E2A270D4829DCA9658A5CC03D14524
Submitted as: 2ec97fcbb16ae2a5f2c2c3071c512146b27628d3a222451b87bdb24f0c6ea65d
File type: script · Size: 8956 bytes
Verdict: suspicious (41/100)

Detections (2 of 53 engines)

Microsoft Defender: Trojan:JS/Agent.AG!MSR
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 41/100 is the fusion of 1 weighted signal:

Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75

Dynamic analysis (windows)

1245 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
250.255.255.239.in-addr.arpa
ntp.ubuntu.com
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787847071&P2=404&P3=2&P4=RUutHEBWqUSYesDjiYup6Fe%2bWR%2fZ8vMoHriuVa05j2bigiRnrBPg8bH2%2fzzokS4W8kExs5OPTlfPpf6IhLI80w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787847147&P2=404&P3=2&P4=kTOudaXfbh69FilvGPSulIWuONiYERJr3H%2fm8nAPGlLHPVFInsfA29DXQL8V5yg1RomG4R1TVq%2bjC%2fJ%2fwvpDug%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787847071&P2=404&P3=2&P4=RUutHEBWqUSYesDjiYup6Fe%2bWR%2fZ8vMoHriuVa05j2bigiRnrBPg8bH2%2fzzokS4W8kExs5OPTlfPpf6IhLI80w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787847147&P2=404&P3=2&P4=kTOudaXfbh69FilvGPSulIWuONiYERJr3H%2fm8nAPGlLHPVFInsfA29DXQL8V5yg1RomG4R1TVq%2bjC%2fJ%2fwvpDug%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

b.name
a.name
h.name
www.opentalksnews.com

Embedded IP addresses

172.233.212.224
40.84.85.40
172.172.255.216
20.42.179.204
135.233.95.144
20.42.72.131
52.123.252.194
52.110.12.5
20.42.179.192
4.230.171.124
52.230.60.54
74.178.240.51
135.232.92.137
52.123.129.14
40.99.133.210
20.42.65.93
135.234.160.246
52.123.252.230
20.42.73.30
203.26.79.13
52.123.252.241
92.223.78.30
135.232.92.34

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report