SUSPICIOUS — bd5291d8d8fcefc8d2c6822931c6b4a97ef76fb5aa48aab9e6095db083048ad4

SUSPICIOUS — bd5291d8d8fcefc8d2c6822931c6b4a97ef76fb5aa48aab9e6095db083048ad4 is a unknown sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (40/100), attributed to the Office365 family. 1 of 53 detection engines flagged it.

Identification

• SHA-256: bd5291d8d8fcefc8d2c6822931c6b4a97ef76fb5aa48aab9e6095db083048ad4
• SHA-1: 2bd21dec54181fdbd420db53d47f34a476b3d846
• MD5: ff0ba14c30a82dbbebfa95d26b9d8793
• ssdeep: 3072:iDt8WgRRQ0GBl+BxktKyVUoDkUNG2ym+d/PngTedK8iW2g/mO5:tRC0++kkUNGz75
• TLSH: T193415D3661486F6380186F2AAECE133576407D9FE25405558B8ADAF8BC98F70FD4243B
• Submitted as: bd5291d8d8fcefc8d2c6822931c6b4a97ef76fb5aa48aab9e6095db083048ad4
• File type: unknown · Size: 194862 bytes
• Verdict: suspicious (40/100) · Family: Office365

Detections (1 of 53 engines)

• YARA: PhishingKit (t4d): PK_Office365_Login_Clone

Why this verdict

The suspicious score of 40/100 is the fusion of 2 weighted signals:

• YARA: PhishingKit (t4d) flagged PK_Office365_Login_Clone (rule PK_Office365_Login_Clone) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://aadcdn.msauth.net, https://aadcdn.msauth.net/shared/1.0/, https://elkriverbiz.sharepoint.com/_forms/default.aspx - static signal, weight 0.35, confidence 0.60

Embedded URLs

• https://aadcdn.msauth.net
• https://login.microsoftonline.com/jsdisabled
• https://login.live.com/logout.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
• https://login.live.com/forgetme.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
• https://login.microsoftonline.com/common/DeviceCodeStatus
• https://login.microsoftonline.com/common/GetCredentialType?mkt=en-US
• https://login.microsoftonline.com/common/GetOneTimeCode
• https://login.microsoftonline.com/e834bf97-afd2-4231-b9a6-c465d412ab66/uxlogout
• https://login.microsoftonline.com/forgetuser
• https://go.microsoft.com/fwlink/p/?LinkID=733247
• https://login.microsoftonline.com/common/PIA/EndAuth
• https://aadcdn.msauth.net/shared/1.0/
• https://www.microsoft.com/en-US/servicesagreement/
• https://privacy.microsoft.com/en-US/privacystatement
• https://login.microsoftonline.com/e834bf97-afd2-4231-b9a6-c465d412ab66/login
• https://login.microsoftonline.com/e834bf97-afd2-4231-b9a6-c465d412ab66/reprocess?ctx=rQIIAZ1RO2zTUAD0ixM3SVs3qgAxFpSp6MXvY_u9F4khzx8qqChUlZCQUGXHNjU0ceqkH3VkQAwMnTuAhJg6woLKkrlT504eGComhBgQYqARC2PFDacbTrrT3aKKW7jdRH9B4YQhShIMu_FE_YN8vt54-wO_uaEo46dXw19ffp_QI2BvjEaDYdsw4s3neboT52G63xpuBHk8yNL-qNXNesZ6kuW9oRHFSbC9OWoFw8HeJwBOATgH4Ki0xRn1HCYlQx3mckcwLKkriNmhpk-I2-GWaTGPUiqpdH0moSdd2ZFSMGo7wpGeyxATvm-ZWGCbegR5CBGfO35HCuz5khJKLYsSSZnluj4_K82tdLZHG2RCWZ7ux99LtUnH9UE2HB2q5RUX7R6pl1rlg9qMOTXDRDAYJBGBJqEYhiKwYde0rcjEJAht-0TVskHcT6PTMvhankFqu1qtN5TryoLyswzeVS62vbb85OPi-OW914cL7z_7JeWkYqzJINnbT23j4erdnd6mMJbXyJ1Hzi2XP9txrN0eW0ruL22xaLWf3UZtfKCBA0071mpVtaHcVJ0H-FwD3zTwako5rv3nUWf1KwQRDJGARCwg0TYvgszHp9PgbAbXa90szIN-lEbzTYzDiCNOIWcxgiYOLRiGjEMUdk3a5QGPefBi9lK28axS6KDQS4WuFnq50CuFrhX6VKFXC71W6PVCn_4D0
• https://elkriverbiz.sharepoint.com/_forms/default.aspx
• https://login.microsoftonline.com/e834bf97-afd2-4231-b9a6-c465d412ab66/resume?ctx=rQIIAZ2RPWzTUACE_eLETdLWRJVAjAVlKnL8fmy_50gMef6hgopCVYkJVf4lhiROHTetMjIgBobOHUBCTB1hQWXJnClzJw8MFRNCDAgxQMTCWHHD6YYbTt9tiKiF2k34V0RZuALjGClBtEj_KFurN958R69vCML0yVX_5-dfM3IKjG6eD0dtVY16z7JkHGV-MmmNul4WDdNkkLeCtK_uxWnWH6lhFHsHvbzljYZHHwGYA3ABwGlpn1HiWJRzCjvUZpZJESe2ibUO0VyM7Q7TNZ06hBBOuO1Srjjc5h3OTUoMy7S4Y1NITdfVNWQigzgYOhBil1luh5vIcTnBhOg6wZxQ3bZddl66st05yLt4YWmWTKJvpdpi494wHeUnYnnbhoen4qWovBebESOaH5tU8eIQKxomSPFNz1ACzdBDDWHPN4yZKKXDaJCE8zL4Ul6BYrtarTeE68K68KMM3lb-sL229fjDxvTFvVcn6-8-uSVhVlF3uRcfTRJDfbhzd9zvmerWLr7zyLpls6djSz_s0834_uY-DXcG6W3YRscSOJakM6lWFRvCTdF6gC4k8FUCL5eEs9p_HjVfBucrqF4LUj_zBmESrjUR8kMGGVEYjaCiIV9XfJ8yBfqBRgLmsYh5z1cvVZuuCoUMCrlUyGIhlwu5UshSIS8VcrWQa4VcL-Tl3w2
• https://login.microsoftonline.com/common/debugmode
• https://login.microsoftonline.com/e834bf97-afd2-4231-b9a6-c465d412ab66/reprocess?ctx=rQIIAZ2RPWzTUACE_eLETdLWRJVAjAVlKnL8fmy_50gMef6hgopCVYkJVf4lhiROHTetMjIgBobOHUBCTB1hQWXJnClzJw8MFRNCDAgxQMTCWHHD6YYbTt9tiKiF2k34V0RZuALjGClBtEj_KFurN958R69vCML0yVX_5-dfM3IKjG6eD0dtVY16z7JkHGV-MmmNul4WDdNkkLeCtK_uxWnWH6lhFHsHvbzljYZHHwGYA3ABwGlpn1HiWJRzCjvUZpZJESe2ibUO0VyM7Q7TNZ06hBBOuO1Srjjc5h3OTUoMy7S4Y1NITdfVNWQigzgYOhBil1luh5vIcTnBhOg6wZxQ3bZddl66st05yLt4YWmWTKJvpdpi494wHeUnYnnbhoen4qWovBebESOaH5tU8eIQKxomSPFNz1ACzdBDDWHPN4yZKKXDaJCE8zL4Ul6BYrtarTeE68K68KMM3lb-sL229fjDxvTFvVcn6-8-uSVhVlF3uRcfTRJDfbhzd9zvmerWLr7zyLpls6djSz_s0834_uY-DXcG6W3YRscSOJakM6lWFRvCTdF6gC4k8FUCL5eEs9p_HjVfBucrqF4LUj_zBmESrjUR8kMGGVEYjaCiIV9XfJ8yBfqBRgLmsYh5z1cvVZuuCoUMCrlUyGIhlwu5UshSIS8VcrWQa4VcL-Tl3w2
• https://login.microsoftonline.com/common/instrumentation/dssostatus
• https://go.microsoft.com/fwlink/?linkid=2013738
• https://login.microsoft.com/e834bf97-afd2-4231-b9a6-c465d412ab66/fido/get?uiflavor=Web
• https://login.microsoftonline.com/common/instrumentation/reportpageload
• https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/watson.min_ybdb1ixzkv-fkor2mu6q6w2.js

Embedded domains

• aadcdn.msauth.net
• aadcdn.msftauth.net
• login.microsoftonline.com
• login.live.com
• 2flogin.microsoftonline.com
• github.com
• passwordreset.microsoftonline.com
• account.live.com
• go.microsoft.com
• signup.microsoft.com
• 2felkriverbiz.sharepoint.com
• microsoftonline.com
• www.microsoft.com
• privacy.microsoft.com
• elkriverbiz.sharepoint.com
• autologon.microsoftazuread-sso.com
• login.microsoft.com
• git.io
• modal-backdrop.in
• background.app
• background-image-holder.app
• middle.app
• inner.app
• sign-in-box.app
• vertical-split-content.app

More Office365 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report