MALICIOUS — 847b4ad90b1daba2d9117a8e05776f3f902dda593fb1252289538acf476c4268.bin

MALICIOUS — 847b4ad90b1daba2d9117a8e05776f3f902dda593fb1252289538acf476c4268.bin is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (83/100). 2 of 54 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: 847b4ad90b1daba2d9117a8e05776f3f902dda593fb1252289538acf476c4268
• SHA-1: 422eda5a133d4bd324c634f113639a57c38bb552
• MD5: 5daf53bf848bb4cda008a655bdecf425
• ssdeep: 96:j1Xp6Fi8ComWlyo5kxb2mRWcxHnLVRmqq4mAP0JEp7USUO5ip5iW33KlKXFd18eH:D6FismQVmamRVHLVwtKP8KK6uGiut3W
• TLSH: T1DE1C4082828181628FC59B54EBC22B89F1FED351C823FC29907DBC93A6A6465F116039
• Submitted as: 847b4ad90b1daba2d9117a8e05776f3f902dda593fb1252289538acf476c4268.bin
• File type: script · Size: 5558 bytes
• Verdict: malicious (83/100)

Source: MalShare · first seen 2026-08-23T08:50:08.262Z · SHA-256 verified

Detections (2 of 54 engines)

• Microsoft Defender: Trojan:JS/Phish!MSR
• Kaspersky (KVRT): HEUR:Trojan-Downloader.Script.SLoad.gen

MITRE ATT&CK

• T1543.003
• T1112
• T1071.001

Why this verdict

The malicious score of 83/100 is the fusion of 3 weighted signals:

• Microsoft Defender flagged Trojan:JS/Phish!MSR (rule Trojan:JS/Phish!MSR) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.Script.SLoad.gen (rule HEUR:Trojan-Downloader.Script.SLoad.gen) - engine signal, weight 0.55, confidence 0.85
• Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75

Dynamic analysis (windows)

2530 behavior events · 3 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• soundata.top
• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://soundata.top/resources.dll
• 23.40.52.85
• 23.11.37.157
• 20.190.142.167
• 52.123.252.227 AU · Sydney · AS8075 Microsoft Corporation
• 23.33.238.178
• 52.110.12.16 AU · Sydney · AS8075 Microsoft Corporation
• 4.230.171.124 KR · Seoul · AS8075 Microsoft Corporation
• 23.33.238.173
• 23.33.238.107

Dropped files

• b2ae6abf9225d5f1214f5f0dddb663dd0e876aedf9fbb2e8b395ba6ea593809f - b2ae6abf9225d5f1214f5f0dddb663dd0e876aedf9fbb2e8b395ba6ea593809f

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://soundata.top/resources.dll

Embedded domains

• soundata.top

Embedded IP addresses

• 72.145.35.97
• 4.247.188.233
• 51.132.193.105
• 85.210.196.11
• 52.123.252.227
• 52.110.12.16
• 4.230.171.124
• 104.18.33.89
• 4.144.132.223
• 74.179.77.204
• 40.79.141.154
• 52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report