SUSPICIOUS — b63a766a049b107ef2b20e0554f0aae276af5dfec24061cad64f192149743455
SUSPICIOUS — b63a766a049b107ef2b20e0554f0aae276af5dfec24061cad64f192149743455 is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (46/100). 0 of 56 detection engines flagged it.
Identification
- SHA-256:
b63a766a049b107ef2b20e0554f0aae276af5dfec24061cad64f192149743455 - SHA-1:
fb0b33a4d707405b82d39931778554c5796149a3 - MD5:
f7a59c2dbd587bbd6ef76364b96272a7 - imphash:
ad9ecb7d1256dd23f50e5904dde465ab - ssdeep:
768:5Yznu/P/LQnQjL8Y0Ys53WUshnJ47UH27chXkGgAn3/Pt//pekEHX:5YznuXTQQk53WUshJ47UW7chXDgA3ppC - TLSH:
T1AD322A5102463121D2F2ED99E41DDCED8003F868B0711BEE820B865DD2AD3D7A9F9DE5 - Submitted as: b63a766a049b107ef2b20e0554f0aae276af5dfec24061cad64f192149743455
- File type: pe · Size: 46312 bytes
- Verdict: suspicious (46/100)
Detections (0 of 56 engines)
No engine flagged this sample.
Why this verdict
The suspicious score of 46/100 is the fusion of 2 weighted signals:
- Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: http://www.gnu.org/licenses/ - static signal, weight 0.35, confidence 0.60
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
- www.bing.com
- licensing.mp.microsoft.com
- tas02.sls.update.microsoft.com
- fe3cr.delivery.mp.microsoft.com
Embedded URLs
- http://msdn.microsoft.com/en-us/library/bb762153%28VS.85%29.aspx
- http://www.gnu.org/licenses/
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- msdn.microsoft.com
- cygwin.com
- www.gnu.org
Embedded IP addresses
- 20.42.65.93
- 52.123.252.240
- 4.230.171.124
- 40.84.97.4
- 4.144.132.114
- 20.165.94.63
- 74.178.240.51
- 20.50.73.5
- 52.110.12.2
- 52.110.12.49
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report