CLEAN — 8e3f2ab1a9e519af20252fecfb85291da19ee696300dcf34f6c51ba65788332e

CLEAN — 8e3f2ab1a9e519af20252fecfb85291da19ee696300dcf34f6c51ba65788332e is a pe sample analyzed by MalwareAnalyzer by Cyble with a clean verdict (0/100). 2 of 55 detection engines flagged it.

Identification

• SHA-256: 8e3f2ab1a9e519af20252fecfb85291da19ee696300dcf34f6c51ba65788332e
• SHA-1: c04ce102ce8089895c4e8bc1f252a3e67710f4e6
• MD5: fecfa25a92185ca069682d03934b5ec3
• imphash: d41d8cd98f00b204e9800998ecf8427e
• ssdeep: 384:V5yrM6L2N4V7t/r7iisFmiT3WawHt1+VSfCy1sPGADzdgQI8BXhTqQRrFhkTtz9:KFL2ulG7VKf8WQI8BNqQhAh
• TLSH: T1732B3A6C53B1AF88FBF7DBA028D4EF1F1463A4DEB2F6291C2713D45E12A09839544119
• Submitted as: 8e3f2ab1a9e519af20252fecfb85291da19ee696300dcf34f6c51ba65788332e
• File type: pe · Size: 22738 bytes
• Verdict: clean (0/100)

Detections (2 of 55 engines)

• Microsoft Defender: Ransom:Win32/StopCrypt.PS!MTB
• Trellix Stinger (McAfee): Lockbit-FSWW!FECFA25A9218

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• ctldl.windowsupdate.com
• login.live.com
• ocsp.digicert.com
• desktop-hsgcbep
• config.edge.skype.com
• v20.events.data.microsoft.com
• windows.msn.com
• oneocsp.microsoft.com
• licensing.mp.microsoft.com
• www.msn.com

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded IP addresses

• 52.123.252.203
• 20.42.73.26
• 20.247.185.124
• 4.230.171.124
• 172.215.188.232
• 135.233.95.144
• 20.165.94.54
• 4.150.223.113
• 20.236.44.162
• 52.123.128.14
• 52.123.129.14
• 40.103.64.242
• 4.207.44.69
• 135.233.45.223
• 52.148.114.188
• 184.84.165.171
• 52.110.12.48
• 184.84.165.136
• 52.110.12.10

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report