CLEAN — 849b21754c24a8f31958a03ede95d9e5a7f5527d7f9b251a10a20b0ec2a43e76

CLEAN — 849b21754c24a8f31958a03ede95d9e5a7f5527d7f9b251a10a20b0ec2a43e76 is a script sample analyzed by MalwareAnalyzer by Cyble with a clean verdict (0/100). 3 of 53 detection engines flagged it.

Identification

SHA-256: 849b21754c24a8f31958a03ede95d9e5a7f5527d7f9b251a10a20b0ec2a43e76
SHA-1: 1777d2d3080a4cbd89f8f375e7899fe8b74a9be3
MD5: b1be4779235309cbb96a822d18692a13
ssdeep: 48:2FFFFFFFFFFFi+FFFFFFFDFFFFFFFFFFFi+FFFFFFFFFFFi+FFFFFFFc:fpn1
TLSH: T1B71812D40E8EC831E364E00F0F78DC4D33121181EECE7022F749F31A124E7862066660
Submitted as: 849b21754c24a8f31958a03ede95d9e5a7f5527d7f9b251a10a20b0ec2a43e76
File type: script · Size: 3984 bytes
Verdict: clean (0/100)

Detections (3 of 53 engines)

Microsoft Defender: Trojan:BAT/Bomb!AMTB
Emsisoft (Emergency Kit): Gen:Heur.Bat.1
Kaspersky (KVRT): Trojan.BAT.Bomb.f

Dynamic analysis (windows)

1116 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
c.pki.goog
250.255.255.239.in-addr.arpa
ntp.ubuntu.com
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787892961&P2=404&P3=2&P4=O8QBRdZABUVk1qeCEp%2fWSY7TgpBnQWF1aQQ%2be%2bmauBSRAVCxGgpy8lda3msTM%2fyUchbF%2fXEtN5hTaTKmAYt8YA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787892961&P2=404&P3=2&P4=O8QBRdZABUVk1qeCEp%2fWSY7TgpBnQWF1aQQ%2be%2bmauBSRAVCxGgpy8lda3msTM%2fyUchbF%2fXEtN5hTaTKmAYt8YA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787893022&P2=404&P3=2&P4=lQo5Q5%2f9OCTVKoPiUahOxyHq7c4gpBFPH0P%2f7eSXdUndzwPFsrAr7cYW%2bYqgcqvJmJshZ01V8ed9gcKuz1Seig%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787289714&P2=404&P3=2&P4=FtrKleM4pFyrd%2f%2bYlYVPcmHkWdLvA2HIfJMEZkW6APTchppRJrw%2bhSkinnGmijAAJN8AVE%2bAnsgUMgxImSTR9A%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787289269&P2=404&P3=2&P4=NCPGyoZCrKkMmfmxwbbIQIdB22wiP%2fe1zT4J%2bFae5U8xlWzWAic0PBUwt195Tt2cJAs5y0Bx5xBFbmwCZ7q%2fyg%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

85.210.193.152
4.247.188.233
51.132.193.105
20.42.65.91
172.172.255.216
52.230.59.222
57.155.104.224
4.144.132.114
4.230.171.124
74.178.76.128
74.179.77.164
135.233.95.80
72.154.7.97
52.123.129.14
203.26.79.13
52.123.128.14
40.99.133.226
40.99.133.210
92.223.78.30
172.178.240.163
20.42.179.204
104.208.16.94

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report