SUSPICIOUS — 9ec3f1c174a58929296ade5ee480108d74f1c29298c7b8a53a4f4680614f370a
SUSPICIOUS — 9ec3f1c174a58929296ade5ee480108d74f1c29298c7b8a53a4f4680614f370a is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
9ec3f1c174a58929296ade5ee480108d74f1c29298c7b8a53a4f4680614f370a - SHA-1:
537ece871d71d8f46edcca0fe6d6e0ff6ada3bdd - MD5:
f0bb8cfb50e1e1222c4b2cbfcc37b661 - ssdeep:
384:5b9kmQkLrwVOyzirVyKnxRsIB9Db5HjiWn8xHOxvRVgD75zBY5vImg3FzGpL9ARY:5b9vLsgyziJp3Db5OxHOxvYD73Y5vQzS - TLSH:
T1312AA6533C4DBD8CCC0E51DB3E98789B7B13EA19E65754C4D2B8D685BCFD8904886029 - Submitted as: 9ec3f1c174a58929296ade5ee480108d74f1c29298c7b8a53a4f4680614f370a
- File type: script · Size: 21783 bytes
- Verdict: suspicious (54/100)
Detections (1 of 50 engines)
- Microsoft Defender: Trojan:JS/Redirector.AYLB!MTB
MITRE ATT&CK
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec, defense-evasion (layers: char-code+concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: http://opensource.org/licenses/MIT, https://js.donatelloflowfirstly.ga/stats.js - static signal, weight 0.35, confidence 0.60
Dynamic analysis (windows)
1225 behavior events · 1 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- staging.to-do.officeppe.com
- desktop-hsgcbep
- 250.255.255.239.in-addr.arpa
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- desktop-hsgcbep._dosvc._tcp.local
- desktop-hsgcbep(1)._dosvc._tcp.local
- _dosvc._tcp.local
- desktop-hsgcbep(2)._dosvc._tcp.local
- ntp.ubuntu.com
- crl4.digicert.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded URLs
- http://opensource.org/licenses/MIT
- https://js.donatelloflowfirstly.ga/stats.js
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- opensource.org
- e.top
- o.top
- o.bottom-o.top
- p.bottom-p.top
- a.top
- d.top-a.top
- b.top
- p-n.top
- s.top
- f.top
- i.top
- t.top-p.top
- e.name
- this.popper.style.top
- n.top
- p.top
- l.top
- t.top
- h.top
- js.donatelloflowfirstly.ga
Embedded IP addresses
- 20.42.73.30
- 74.178.76.44
- 72.153.5.137
- 135.233.95.144
- 52.123.252.244
- 52.123.129.14
- 162.159.36.2
- 4.230.171.124
- 203.26.79.13
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report