MALICIOUS — c361929297efcfe80f4df737a7e659aca7ace0c3ac9bd75e75ae777f0b4b0ca6
MALICIOUS — c361929297efcfe80f4df737a7e659aca7ace0c3ac9bd75e75ae777f0b4b0ca6 is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the Maldoc family. 2 of 54 detection engines flagged it.
Identification
- SHA-256:
c361929297efcfe80f4df737a7e659aca7ace0c3ac9bd75e75ae777f0b4b0ca6 - SHA-1:
283c636d77c18871d1fd016919fbc11be9817c4c - MD5:
ec6bb13a29cf4a0b74140318a3e8d393 - ssdeep:
384:MjSNnvTaBduvHgDgAkKJ+WsDj+36eWZR+EnKhx74qVq+E1WC8HDEn6BbpPgyvDsR:MGVm2Slq/+3oHK/iSY6BbpPVvDsQPVsR - TLSH:
T1042BBFDB05D18627374F0DAF945E228F6809A2E90175AEC156D7C23C2D49C93ACAF30B - Submitted as: c361929297efcfe80f4df737a7e659aca7ace0c3ac9bd75e75ae777f0b4b0ca6
- File type: script · Size: 22564 bytes
- Verdict: malicious (84/100) · Family: Maldoc
Detections (2 of 54 engines)
- YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
- Kaspersky (KVRT): HEUR:Trojan-Downloader.Script.Generic
Why this verdict
The malicious score of 84/100 is the fusion of 3 weighted signals:
- YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule
DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.70, confidence 0.70 - Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.Script.Generic (rule
HEUR:Trojan-Downloader.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - Obfuscated vbscript script: dynamic-exec (layers: base64) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Dynamic analysis (windows)
1179 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- 250.255.255.239.in-addr.arpa
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
- http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
- http://yr.c.lencr.org/
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
- http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
- http://yr.c.lencr.org/
- http://c.pki.goog/r/gsr1.crl
- http://c.pki.goog/r/r4.crl
Embedded domains
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 20.165.94.63
- 20.42.179.204
- 172.172.255.216
- 20.184.175.18
- 203.26.79.13
- 4.247.188.224
- 172.66.2.5
- 34.104.35.123
- 4.150.223.102
- 52.110.12.8
- 52.110.12.25
- 4.230.171.124
- 20.247.184.197
- 52.123.252.229
- 4.209.250.170
- 20.42.73.26
- 104.18.33.89
Registry keys
- HKCU\Software\Classes\CLSID\{
More Maldoc samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report