SUSPICIOUS — a02d77f9772441079da5967da1be4f705ba3d98d63c52314c6fb6a9b7b320c68
SUSPICIOUS — a02d77f9772441079da5967da1be4f705ba3d98d63c52314c6fb6a9b7b320c68 is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 0 of 53 detection engines flagged it.
Identification
- SHA-256:
a02d77f9772441079da5967da1be4f705ba3d98d63c52314c6fb6a9b7b320c68 - SHA-1:
7a3f32e670d4a3931d148aad7217cd43e8591531 - MD5:
45f058dcae38e9e10081246375d81eda - ssdeep:
384:lBYArna/8uRsMHaK7EBuyEjXpqCnMwws:lBYaq8uRHHlbj4s - TLSH:
T1BF26974A3FC8B59A850445322D890448AEE19C0FF77624C9895CCF889EEEB277478D77 - Submitted as: a02d77f9772441079da5967da1be4f705ba3d98d63c52314c6fb6a9b7b320c68
- File type: script · Size: 14316 bytes
- Verdict: suspicious (54/100)
Detections (0 of 53 engines)
No engine flagged this sample.
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://cleverjump.org/counter.js, https://semalt.com, https://semalt.com/?s= - static signal, weight 0.35, confidence 0.60
Dynamic analysis (windows)
1201 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- c.pki.goog
- ntp.ubuntu.com
- desktop-hsgcbep
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Dropped files
- efda27a2ef8f58ad8f925e933c925a3929beec63006b00ac7c23217e0838eed6 -
efda27a2ef8f58ad8f925e933c925a3929beec63006b00ac7c23217e0838eed6
Embedded URLs
- https://cleverjump.org/counter.js
- https://semalt.com
- https://semalt.com/?s=
- https://semalt.com/popups/popup_wow.php?lang=en
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787878019&P2=404&P3=2&P4=Wx5c9xcoR6Dtd%2f9Wv0aFrJqauq%2fIy%2bwUV96BDBnq%2fYJWazzcHcGH1t4ZXSnU0EUIdhMk5dD7wDn9L1T2TEFa2Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787878072&P2=404&P3=2&P4=XR4fos%2fRIxP5EwxZ9s8aTroqHwIDkn7uUNpp2767h3HMih6nyLfgVhv%2bI%2faqymd%2fHJeVV6NIzxinbBjq0xrWKQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://c.pki.goog/r/gsr1.crl
- http://c.pki.goog/r/r4.crl
- http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787274705&P2=404&P3=2&P4=D05dfxLv0rLJiFEWzdl9qVT%2bxgOiq7bh1o9wP2xFAo8PEqZBnlDyCSY1beFudVRdkgVdKZ0Zcx3HMywvPvWJlQ%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787274372&P2=404&P3=2&P4=WueNKRQ8vmoJU1ZzUuLRovJkdsFM13zNKJKZasFWWSUgNvX5eX8lmGmuGmWA8iWsJUtegNGwu9k8GbN9ak5sTQ%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- kickvox.com
- www.cwmedellin.com
- registryproductreviews.com
- screentimecontrolforkids.com
- water-meter-china.com
- jxvpn.com
- chrome.google.com
- sites.google.com
- kindhunter.com
- cleverjump.org
- semalt.com
- yapi-club.ru
- trustpilot.com
Embedded IP addresses
- 57.155.104.224
- 20.184.175.13
- 52.110.12.46
- 4.230.171.124
- 4.144.132.114
- 135.233.95.144
- 20.42.179.204
- 20.165.94.54
- 20.231.239.246
- 13.69.116.107
- 52.123.128.14
- 40.103.64.242
- 135.234.160.244
- 203.26.79.13
- 74.179.71.159
- 4.150.223.110
- 52.178.17.234
- 172.172.255.218
- 52.123.252.247
- 20.42.65.89
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report