SUSPICIOUS — 790b9c20151aa1b3616d3fd0067948c2a76bef8d9eba5c957f31b0d9bdae8301.bin

SUSPICIOUS — 790b9c20151aa1b3616d3fd0067948c2a76bef8d9eba5c957f31b0d9bdae8301.bin is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (41/100). 0 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 790b9c20151aa1b3616d3fd0067948c2a76bef8d9eba5c957f31b0d9bdae8301
SHA-1: 65a738605c38b41abec35dcf854d039873a2f1ad
MD5: e96425d2010ef32440ca14d6c15710ad
ssdeep: 6144:1SRX5yBEPlndotbb9Lz3aIuZfxlTH6Sdg9M9TP+:1vydy9PaHZfXTDdsYTP+
TLSH: T1AC426D0159E7AAC7C7A463543F6A58285842AF0F35E54A24C90F3FDF70968F90C93BA1
Submitted as: 790b9c20151aa1b3616d3fd0067948c2a76bef8d9eba5c957f31b0d9bdae8301.bin
File type: script · Size: 215852 bytes
Verdict: suspicious (41/100)

Source: MalShare · first seen 2026-08-21T12:05:00.676Z · SHA-256 verified

Detections (0 of 53 engines)

No engine flagged this sample.

MITRE ATT&CK

Why this verdict

The suspicious score of 41/100 is the fusion of 1 weighted signal:

Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75

Dynamic analysis (windows)

16147 behavior events · 2 ATT&CK techniques · 7 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
250.255.255.239.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787918749&P2=404&P3=2&P4=XDH%2f8vLp63JJ1ZIUr%2fsy5yygZcd79vP4RxCyam4L75SnulXNZi9yH1g7pGhVTfCuql7LrNnZ40KjLedDfid99g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787918810&P2=404&P3=2&P4=hpej8NPgbngEWnM7ocWQk0cQb6fxr3hx1XH6sw1FFpzm%2b%2blrEaHCXjpiaK8OOuyg3VSsJ1Bc3%2f31oxkTK7iXVg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
23.40.52.85

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\PhotoEngine\PhotoStudio.vbs - 776b1c08913606783206acfdf83554226d08a847bba1c1fe2907c2819cb72381
C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_0ckzndwo.uhf.psm1 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
C:\Users\analyst\AppData\Local\Temp\x25t7zpo\cfg_24359_fb7d.ps1 - 61ad3accdbf3585e55dfa7bd3ed0fc017d4732364dd35ee10182046ce12e35a7
e776274c8d3711f2ce95faffb7a2cd95abd03c8547d45abeebb4083ee9e16e89 - e776274c8d3711f2ce95faffb7a2cd95abd03c8547d45abeebb4083ee9e16e89
440c0341a35324d0746d44bd04de4060f907ae30521ef0ad2090f21b2b1b82cf - 440c0341a35324d0746d44bd04de4060f907ae30521ef0ad2090f21b2b1b82cf
07a5e7813dae35d575d8cb45091976c7f049592f5a2b1520f1340a4bf2083da0 - 07a5e7813dae35d575d8cb45091976c7f049592f5a2b1520f1340a4bf2083da0
b73b4dfc0738c6dcba9349db87ad5380617022078a6d0c45f0814783ecfeddfe - b73b4dfc0738c6dcba9349db87ad5380617022078a6d0c45f0814783ecfeddfe

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787918749&P2=404&P3=2&P4=XDH%2f8vLp63JJ1ZIUr%2fsy5yygZcd79vP4RxCyam4L75SnulXNZi9yH1g7pGhVTfCuql7LrNnZ40KjLedDfid99g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787918810&P2=404&P3=2&P4=hpej8NPgbngEWnM7ocWQk0cQb6fxr3hx1XH6sw1FFpzm%2b%2blrEaHCXjpiaK8OOuyg3VSsJ1Bc3%2f31oxkTK7iXVg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

172.172.255.216
172.66.2.5
52.123.252.198
52.123.252.241
52.110.12.3
52.110.12.50
4.230.171.124
52.253.84.76
203.26.79.13
20.184.175.16
74.179.77.164
135.232.92.137
52.123.128.14
40.103.64.226
74.178.240.61
172.178.240.163
52.168.117.168
57.154.63.210
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report