MALICIOUS — ad3b82c6cd7f14e7f88bef0627cf878590154b5ca51d169610492deb108a5e68.bin

MALICIOUS — ad3b82c6cd7f14e7f88bef0627cf878590154b5ca51d169610492deb108a5e68.bin is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the AntiVM family. 5 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: ad3b82c6cd7f14e7f88bef0627cf878590154b5ca51d169610492deb108a5e68
SHA-1: e418a743896bc4af7dda559e6d2e8086e688c8ab
MD5: eb24441e259a9a3c61f8002eca8c0a68
ssdeep: 24576:fZf1Y407E/0sD3H0EXyVjTxG35SW3+2eaTTA7L85O11rEwpY5w01kO:xBwsDjXyHWOY3YrEckV
TLSH: T1055778503C49E0E5D5885F90CFBA48FE116CF98194C8C886AEFB2DC7B79589051B8C9E
Submitted as: ad3b82c6cd7f14e7f88bef0627cf878590154b5ca51d169610492deb108a5e68.bin
File type: script · Size: 1548627 bytes
Verdict: malicious (94/100) · Family: AntiVM

Source: MalShare · first seen 2026-08-19T07:02:26.552Z · SHA-256 verified

Detections (5 of 53 engines)

YARA: Yara-Rules community: YR_AntiVM_Sandbox
Hash: MalShare: known-malicious-hash
Microsoft Defender: Trojan:Win32/Malgent
Emsisoft (Emergency Kit): Trojan.GenericKD.81102436
Kaspersky (KVRT): HEUR:Trojan.Script.SAgent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 94/100 is the fusion of 3 weighted signals:

Hash: MalShare flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
Obfuscated powershell script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiVM_Sandbox (rule YR_AntiVM_Sandbox) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis (windows)

53649 behavior events · 2 ATT&CK techniques · 22 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep._dosvc._tcp.local
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
desktop-hsgcbep
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - baf9e9fb83eadfe1f1be746daaec9d4176924c420489ce4d1ded66dccc1fd136
C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_zx0fy5d1.h1c.psm1 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache - a0afeb749046bcc4a185ed44327d9773a6ad3b5c9ecc367b0ec5ae3ee3d61c1c
C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\usb_enum\usb_enum_PZLPGXCW.cmd - 83531086362a094aa6358e5929757402c69cdd53340f3d0747e09c08d6859745
ddff9addfac559461cf0db25b071b4918f55bb7cae966ae504b37036c6f21410 - ddff9addfac559461cf0db25b071b4918f55bb7cae966ae504b37036c6f21410
dac66cf9ad5d8be5f829a10f93c994f0ed5dc85c4533be5f610a64a77a503b8e - dac66cf9ad5d8be5f829a10f93c994f0ed5dc85c4533be5f610a64a77a503b8e
6339172b55b8d961b35b2dca4b7a0ed348abe34c7365b34272125ec30b2a7f39 - 6339172b55b8d961b35b2dca4b7a0ed348abe34c7365b34272125ec30b2a7f39
b7b327bc6d4de289a05916d989c4d6d1cb6a7f09af28f09d2135012a8395fb36 - b7b327bc6d4de289a05916d989c4d6d1cb6a7f09af28f09d2135012a8395fb36
2c8154c9e7893f5638ac551b34e5515e4bdeee9e4c83c119e5ed6991ef4c6913 - 2c8154c9e7893f5638ac551b34e5515e4bdeee9e4c83c119e5ed6991ef4c6913
e978f9a7b0f3da78388c2c70c4fff118ceb084792c47b7b05949cff1021b06b7 - e978f9a7b0f3da78388c2c70c4fff118ceb084792c47b7b05949cff1021b06b7
3cc0d18c3db1ea6f5c23f1fc933edb91053d973650f8126c9ac9a887a60cb812 - 3cc0d18c3db1ea6f5c23f1fc933edb91053d973650f8126c9ac9a887a60cb812
92f91703c4546805892d2a9f5ba8cf21fbdf642d271ca679f5cc1f958a0644a4 - 92f91703c4546805892d2a9f5ba8cf21fbdf642d271ca679f5cc1f958a0644a4
f8d16126d81c82558746df9fd7cce87e9e334d963c3386e10d108455faba1375 - f8d16126d81c82558746df9fd7cce87e9e334d963c3386e10d108455faba1375
0b3f16300ade87efbbdeb32c792b7c4e72df1864c573cbddf52f5dba63fd019b - 0b3f16300ade87efbbdeb32c792b7c4e72df1864c573cbddf52f5dba63fd019b
fc1c3cd5359ee8f15a57d049568ae097790b1af503b9ee1892c1328c861d35a5 - fc1c3cd5359ee8f15a57d049568ae097790b1af503b9ee1892c1328c861d35a5

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787728436&P2=404&P3=2&P4=WT%2bYw0%2bTf18CNmGT%2bknwZ6QEWuX4e8SJcPv%2fnipNu5pPLgtjfXuEaLL3MOdRMCW2i6GoTsJDJjjufR9vWO97lQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded IP addresses

135.233.95.144
72.145.35.105
52.168.117.171
52.168.117.174
20.184.175.18
4.150.223.99
52.123.252.202
52.230.59.222
52.110.12.32
52.110.12.50
4.230.171.124
135.232.92.137
135.233.95.135
52.123.129.14
52.182.143.212
72.145.35.97
203.26.79.13
52.123.252.241
20.165.94.46
52.148.114.188
162.159.36.2
172.66.2.5

More AntiVM samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report