SUSPICIOUS — index.js

SUSPICIOUS — index.js is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 0 of 53 detection engines flagged it.

Identification

SHA-256: 5b52b5762a435c4a948b2c9d83150b05e60a690c3136ae2f8ee2bc8a02bfbbf3
SHA-1: 9bcf62f30f6ac3c5f742eb2d757c6d65cd4cd416
MD5: 125ec6528cd897cab8413c4803f88b73
ssdeep: 96:R0aYL4VD42uTSHF/VRixjSpRQGRIZ+LVSk:R0M4fTSVVRPpOx+LQk
TLSH: T15D16A2AA78997BE4CD0E504B6E95B95F33135BB87A2015C8E20CD7947B90ED0191CA0E
Submitted as: index.js
File type: script · Size: 3240 bytes
Verdict: suspicious (54/100)

Detections (0 of 53 engines)

No engine flagged this sample.

Why this verdict

The suspicious score of 54/100 is the fusion of 4 weighted signals:

Obfuscated javascript script: dynamic-exec, defense-evasion (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 32 external host(s) at runtime (26 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://hpd.baidu.com/v.gif - static signal, weight 0.35, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

280 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

https://hpd.baidu.com/v.gif
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787944018&P2=404&P3=2&P4=ChxcHJZkwREfGUMs1AXsABxqQ7WxWT9srPpZoHi%2b9m2AgKFAdJN37FF%2fz1ov2Fg6BJscdsXrdYOft3KNLt%2by6A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787944075&P2=404&P3=2&P4=PeDamATTP5FB6xKSWKG1vt9KXmaKmPMYKUbVOW%2bZTQFD1Onr62S0ILTItjOVHxMtwerlN16UlpsREpd41UouyQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787340797&P2=404&P3=2&P4=hxpPck2p4fq6FY1Mr0cMKFkbcdT2HpSE2k%2bTFZBQm6tVyQPXpABFz2rSHby14vFp2HIQtWUoanjH7x8ricGmxw%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787340345&P2=404&P3=2&P4=Ju7Ljmj70xyiH9Q4JKKolZawzN1n1HhRuVuNCsTZctUR3%2bTODhdqjSyyr3DuLFqe50NpkYzHazunEtYOuGckzQ%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

hpd.baidu.com

Embedded IP addresses

51.116.246.106
52.110.12.22
52.110.12.45
4.230.171.124
48.211.4.16
52.230.59.222
4.247.188.224
74.178.76.128
4.150.223.101
20.165.94.54
203.26.79.13
20.236.44.162
40.99.133.242
40.99.133.210
52.123.128.14
52.123.129.14
52.123.252.236
20.165.94.46
52.168.112.66
52.123.252.231
20.42.65.88
20.42.73.31
135.234.160.245
52.148.114.188
72.145.35.110

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report