SUSPICIOUS — 471555ce95d7dbfc1b7870bac803c0c121c2dff447796bd402bbbe450bfad491

SUSPICIOUS — 471555ce95d7dbfc1b7870bac803c0c121c2dff447796bd402bbbe450bfad491 is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (61/100). 1 of 54 detection engines flagged it.

Identification

• SHA-256: 471555ce95d7dbfc1b7870bac803c0c121c2dff447796bd402bbbe450bfad491
• SHA-1: 91b9d92433581555096764beb38b27cb21d669ff
• MD5: 50610fbe0ff562ef92f7f826754afdd2
• ssdeep: 384:zDUbywemZO0hYmoZt31qHMoNU7ocIsf0We1imLh/3ynwFIFyNNGbBPE0Hf:zDSDTov31spzsQ13ywFIFZNHf
• TLSH: T19E2866AA47A0257F838AFD8320A0696E4A90B0CE795935F707D9C341204BDD8FC5B19B
• Submitted as: 471555ce95d7dbfc1b7870bac803c0c121c2dff447796bd402bbbe450bfad491
• File type: script · Size: 17446 bytes
• Verdict: suspicious (61/100)

Detections (1 of 54 engines)

• Kaspersky (KVRT): HEUR:Trojan-Dropper.Script.Generic

Why this verdict

The suspicious score of 61/100 is the fusion of 2 weighted signals:

• Kaspersky (KVRT) flagged HEUR:Trojan-Dropper.Script.Generic (rule HEUR:Trojan-Dropper.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• Obfuscated vbscript script: defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.35, confidence 0.75

Dynamic analysis (windows)

1187 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• desktop-hsgcbep._dosvc._tcp.local
• desktop-hsgcbep(1)._dosvc._tcp.local
• desktop-hsgcbep(2)._dosvc._tcp.local
• desktop-hsgcbep(3)._dosvc._tcp.local
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• 23.40.52.85
• 23.11.37.157
• 162.159.142.9 US · San Francisco · AS13335 Cloudflare, Inc.
• 20.190.167.149
• 52.123.252.198 AU · Sydney · AS8075 Microsoft Corporation
• 23.33.238.178
• 52.110.12.44 AU · Sydney · AS8075 Microsoft Corporation

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded IP addresses

• 85.210.193.152
• 162.159.142.9
• 52.123.252.198
• 52.110.12.44
• 4.230.171.124
• 57.154.63.210
• 72.145.35.101

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report