SUSPICIOUS — 32355d18c0964d6a36a4c52477d5121719f8a21cfaa7b0ad1facfd38dfa8a4fe

SUSPICIOUS — 32355d18c0964d6a36a4c52477d5121719f8a21cfaa7b0ad1facfd38dfa8a4fe is a unknown sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (40/100), attributed to the Office365 family. 1 of 53 detection engines flagged it.

Identification

• SHA-256: 32355d18c0964d6a36a4c52477d5121719f8a21cfaa7b0ad1facfd38dfa8a4fe
• SHA-1: 99417b86ccd770b4e7af058cc261590bbb7fedb1
• MD5: ff1011aa2910b55599b1a189521990d7
• ssdeep: 3072:+89NYyrlvTbD+BxktKyVUoDkUNG2ym+d/PngTedK8iW2g/mO5:PYS+kkUNGz75
• TLSH: T19D414C76614C6F6380186F2AAECE133576803D9FD25006558B8ADAE87C98F70FD4643B
• Submitted as: 32355d18c0964d6a36a4c52477d5121719f8a21cfaa7b0ad1facfd38dfa8a4fe
• File type: unknown · Size: 194701 bytes
• Verdict: suspicious (40/100) · Family: Office365

Detections (1 of 53 engines)

• YARA: PhishingKit (t4d): PK_Office365_Login_Clone

Why this verdict

The suspicious score of 40/100 is the fusion of 2 weighted signals:

• YARA: PhishingKit (t4d) flagged PK_Office365_Login_Clone (rule PK_Office365_Login_Clone) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://aadcdn.msauth.net, https://aadcdn.msauth.net/shared/1.0/, https://uoe-my.sharepoint.com/_forms/default.aspx - static signal, weight 0.35, confidence 0.60

Embedded URLs

• https://aadcdn.msauth.net
• https://login.microsoftonline.com/jsdisabled
• https://login.live.com/logout.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
• https://login.live.com/forgetme.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
• https://login.microsoftonline.com/common/DeviceCodeStatus
• https://login.microsoftonline.com/common/GetCredentialType?mkt=en-US
• https://login.microsoftonline.com/common/GetOneTimeCode
• https://login.microsoftonline.com/2e9f06b0-1669-4589-8789-10a06934dc61/uxlogout
• https://login.microsoftonline.com/forgetuser
• https://go.microsoft.com/fwlink/p/?LinkID=733247
• https://login.microsoftonline.com/common/PIA/EndAuth
• https://aadcdn.msauth.net/shared/1.0/
• https://www.microsoft.com/en-US/servicesagreement/
• https://privacy.microsoft.com/en-US/privacystatement
• https://login.microsoftonline.com/2e9f06b0-1669-4589-8789-10a06934dc61/login
• https://login.microsoftonline.com/2e9f06b0-1669-4589-8789-10a06934dc61/reprocess?ctx=rQIIAZWRP2zTUBDG_eLUTdLWRBUDY4WC-NcX37Od9ycSQn55DlWXIAYkulS24yiBNjaJI5qOTLBVAhYGkBg7IoFQJ-Z26dzJYwULgoWRRCyM5Rt-upNOuvu-u6WTOmnW4K8cPCeGXo_gKJ5X_2i0Wqm-__Xyxkmqwfr3zf318PqbQ0T6WZaOm5Y1SWK8O62P-8EoTpPBMKtHya613UtGu2OrG_eCyU5WD8bp3heEThE6R-iw8JSD8jgIJn2v7drSdiilUjaIzzhzlEsEUY7v8Mas86WnAFPRkgRaDFquzSkQV6qGdD3JfAZcKCHailObqzb3fGUTcNpScVdKX7Q4o4yfFS51vEnWt-dIRoP9-GehPL9xO03G2Vu92FHw7FC_UCAf9Zodix7QEDChVGC3wQXmbAYCAVDhuN2IkmPdSNJ4OOieFtG34jLozVKpUtWuaGva7yL6sDCL9dXJp5u1u6z1buP1zueVa9rxgrWp9joeefxQkqyvOpYnNrYe8Cf3GEynbm8iLSeVj2JxO9qC6A5tkgMDHRjGkVEu6VXtqt66T84N9MNALxa1o_L__-isctkGm2AQ2GZrwJvObIezdbqEzpZJpRwl4SgYdgfd1RohYZcDd2a-Y8AuCRs4DBnHEEauE_GAxzx4vnKhsa8rWm6i3Czkpp6bxdxcyE0jNxdzs5Sb5dys5ObSHw2
• https://uoe-my.sharepoint.com/_forms/default.aspx
• https://login.microsoftonline.com/2e9f06b0-1669-4589-8789-10a06934dc61/resume?ctx=rQIIAZWRO2zTUBSGfePETdLGRJ0YEQriVcf3-nEfkRDy9XWougQxINGl8lMJNLFJHNF0ZIKtErAwgMSYEQmEOjG3S-ZOHitYECyMJGJhLP_w6RzpDP__n1syaqNOC_6Vqa2owSRBWhivpn803qw33_96eeM0k-DW953DreD6mzlA_TzPJh1dn6axNpy1J31_HGfpYJS3w3So7yXpeDjRozjxp_t5259kB18AWABwDsC89JRC4VDICPecrmVww8QYc24jj1BiCgsxJEzPpPZy87gjoIaZyxF0CXQtg2KILC5sbjmceARSJhjrCooNKrrU8YSBoNnlglqce8ylBBN6VrrUc6Z531ghHQ8O45-l2srjXpZO8rdyuSfgs7l8oUI-yi0jZgnEAdQQxkyzbMo0SpZA0IeYmVYUYnQiK2kWjwbRogy-lTeg3KlW603psnRF-l0GHyrLWl-dfrrZukvcd9uv9z83rkknFX1HHPQc9PghR3lf9HSHbe8-oE_uETibWcmU62bGH8XsdrgLwzu4g44UcKQox0qtKjelq7J7H50r4IcCXqxJx7X__9FiHZxtoHotTIOxP4oG0WYLoSCikJrLgDHULBTYWhAQqsEgtMyQ-jSm_vPGhc6-NqRCBYVaKlS5UMuFWilUpVDXCrVaqLVCrRfq-h81
• https://login.microsoftonline.com/common/debugmode
• https://login.microsoftonline.com/2e9f06b0-1669-4589-8789-10a06934dc61/reprocess?ctx=rQIIAZWRO2zTUBSGfePETdLGRJ0YEQriVcf3-nEfkRDy9XWougQxINGl8lMJNLFJHNF0ZIKtErAwgMSYEQmEOjG3S-ZOHitYECyMJGJhLP_w6RzpDP__n1syaqNOC_6Vqa2owSRBWhivpn803qw33_96eeM0k-DW953DreD6mzlA_TzPJh1dn6axNpy1J31_HGfpYJS3w3So7yXpeDjRozjxp_t5259kB18AWABwDsC89JRC4VDICPecrmVww8QYc24jj1BiCgsxJEzPpPZy87gjoIaZyxF0CXQtg2KILC5sbjmceARSJhjrCooNKrrU8YSBoNnlglqce8ylBBN6VrrUc6Z531ghHQ8O45-l2srjXpZO8rdyuSfgs7l8oUI-yi0jZgnEAdQQxkyzbMo0SpZA0IeYmVYUYnQiK2kWjwbRogy-lTeg3KlW603psnRF-l0GHyrLWl-dfrrZukvcd9uv9z83rkknFX1HHPQc9PghR3lf9HSHbe8-oE_uETibWcmU62bGH8XsdrgLwzu4g44UcKQox0qtKjelq7J7H50r4IcCXqxJx7X__9FiHZxtoHotTIOxP4oG0WYLoSCikJrLgDHULBTYWhAQqsEgtMyQ-jSm_vPGhc6-NqRCBYVaKlS5UMuFWilUpVDXCrVaqLVCrRfq-h81
• https://login.microsoftonline.com/common/instrumentation/dssostatus
• https://go.microsoft.com/fwlink/?linkid=2013738
• https://login.microsoft.com/2e9f06b0-1669-4589-8789-10a06934dc61/fido/get?uiflavor=Web
• https://login.microsoftonline.com/common/instrumentation/reportpageload
• https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/watson.min_ybdb1ixzkv-fkor2mu6q6w2.js

Embedded domains

• aadcdn.msauth.net
• aadcdn.msftauth.net
• login.microsoftonline.com
• login.live.com
• 2flogin.microsoftonline.com
• github.com
• passwordreset.microsoftonline.com
• account.live.com
• go.microsoft.com
• signup.microsoft.com
• 2fuoe-my.sharepoint.com
• microsoftonline.com
• www.microsoft.com
• privacy.microsoft.com
• uoe-my.sharepoint.com
• autologon.microsoftazuread-sso.com
• login.microsoft.com
• git.io
• modal-backdrop.in
• background.app
• background-image-holder.app
• middle.app
• inner.app
• sign-in-box.app
• vertical-split-content.app

More Office365 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report