SUSPICIOUS — swan-game-open-data.js

SUSPICIOUS — swan-game-open-data.js is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (61/100). 0 of 53 detection engines flagged it.

Identification

SHA-256: 8789cca189e9321fa579561462da682fa1b94e994e92b34a6d80993cb5234f28
SHA-1: 8d4ee81e085469fe6888ea0192a187f6c869c188
MD5: 620c1eeb89acb8c158a1ca938dab4d0d
ssdeep: 192:gaHtgG0sYYnDCWHaCzoHo2XAYMY1n0qjj0X38h3CZvyqAD:gaHtwKCdCC+I0HifX
TLSH: T1B924439B7A9DBDE0CC1D54573E98BC0F2727EEA9B1D198D0D24EC3142AE4CD46C24809
Submitted as: swan-game-open-data.js
File type: script · Size: 11622 bytes
Verdict: suspicious (61/100)

Detections (0 of 53 engines)

No engine flagged this sample.

Why this verdict

The suspicious score of 61/100 is the fusion of 3 weighted signals:

Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 22 external host(s) and 27 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

280 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787944155&P2=404&P3=2&P4=FFfLR%2baFldB2YuoY4PjmFyZmVWj5ytNX5Ce4l%2b2OFmk4yVwH5aFc2yJt0GKb7Z4N8LcnirjRMCYX0C%2f%2fnfC%2f8w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787944174&P2=404&P3=2&P4=IQlGJ78WTWdfYns9KpzKynCp9XdhEyQxnjcmb1U9pXF6%2fdUVaFMXSb82JgND7shcf1sFjnXy%2fOgNImweNQMDwA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787340856&P2=404&P3=2&P4=Y7QJ49LfbeSnWwrO9lDeESf7P3BpwqOyROs%2bloDRekuDE0f6kJ2YKeEpehxpHNQ1OcOK8Xq5YS%2fKcHY9W%2flT4g%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787340436&P2=404&P3=2&P4=EWjyMR6yq36NiYk0AyHsqPgNVxLWvd8yJfrR%2bDSRSycfCutqJvVi9DNedWWxdKq7w41U0RwKAZgKecOT9RUXOQ%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

bdimg.com
bdstatic.com

Embedded IP addresses

104.46.162.231
52.253.84.76
4.230.171.124
40.84.97.4
74.178.76.128
20.165.94.54
4.150.223.106
52.123.129.14
20.76.201.171
135.234.160.246
52.123.252.227
20.165.94.46
203.26.79.13
52.148.114.188
20.42.179.204
20.165.94.63
48.192.143.121
51.132.193.104
104.46.162.230
72.153.5.130
52.110.12.21
52.110.12.24

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report