SUSPICIOUS — cdd7d04fea272447b5932a371d5bdb858f2200737d200c0b87cc781618244eb9
SUSPICIOUS — cdd7d04fea272447b5932a371d5bdb858f2200737d200c0b87cc781618244eb9 is a unknown sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (57/100), attributed to the Office365 family. 1 of 54 detection engines flagged it.
Identification
- SHA-256:
cdd7d04fea272447b5932a371d5bdb858f2200737d200c0b87cc781618244eb9 - SHA-1:
1127cfeaaa2b658ca4d936f4441089019b18c1ce - MD5:
8324ee712b19c11fd933062030c9e4c8 - ssdeep:
3072:+Mc8ZjaHbpcDw2nTW+BPktKyVUdrkUNG2ym+d/PngTezK8iH2g/Oz5:IHmS+NkUNGzV5 - TLSH:
T10A415C3661486FB380186F2AAECE133576407D9FD25005958B8ADAE87C98F70FD4643B - Submitted as: cdd7d04fea272447b5932a371d5bdb858f2200737d200c0b87cc781618244eb9
- File type: unknown · Size: 194857 bytes
- Verdict: suspicious (57/100) · Family: Office365
Detections (1 of 54 engines)
- YARA: PhishingKit (t4d): PK_Office365_Login_Clone
Why this verdict
The suspicious score of 57/100 is the fusion of 2 weighted signals:
- YARA: PhishingKit (t4d) flagged PK_Office365_Login_Clone (rule
PK_Office365_Login_Clone) - engine signal, weight 0.65, confidence 0.70 - Embedded network infrastructure: https://aadcdn.msftauth.net, https://aadcdn.msftauth.net/shared/1.0/, https://firstgraderecruitment-my.sharepoint.com/_forms/default.aspx - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://aadcdn.msftauth.net
- https://login.microsoftonline.com/jsdisabled
- https://login.live.com/logout.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
- https://login.live.com/forgetme.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
- https://login.microsoftonline.com/common/DeviceCodeStatus
- https://login.microsoftonline.com/common/GetCredentialType?mkt=en-US
- https://login.microsoftonline.com/common/GetOneTimeCode
- https://login.microsoftonline.com/95873dc5-93b0-4d27-a80a-aa6d53a1e24a/uxlogout
- https://login.microsoftonline.com/forgetuser
- https://go.microsoft.com/fwlink/p/?LinkID=733247
- https://login.microsoftonline.com/common/PIA/EndAuth
- https://aadcdn.msftauth.net/shared/1.0/
- https://www.microsoft.com/en-US/servicesagreement/
- https://privacy.microsoft.com/en-US/privacystatement
- https://login.microsoftonline.com/95873dc5-93b0-4d27-a80a-aa6d53a1e24a/login
- https://login.microsoftonline.com/95873dc5-93b0-4d27-a80a-aa6d53a1e24a/reprocess?ctx=rQIIAa2RvW_TUADE_erUJCEVUQUSY4UyIb34fdl-tsTgOHbUqqggAUOW6vmrcUvs1HYkkpEJplZIjAiBxJIRFtQF5oohI8pfUDEgxMQGiVgYO3DD6YYbTr-7LeM2tlroryhcOURxjGEQrdI_yjfrzdfff796I0nSLD05OpKLdzPgDMpyVFiqGid5UR7kIozyKMjHSTmM0hIOJ-1iIPJolCVp2Q6yobofZ_mwUMMoFuPHZVsUoycfAZgDcAHAbO3Y6GqIY90hzO4w18PeMpsuNhgyTW4jj5iIUmYjZOq2YRAH6raDmG50DMdzie4apmFjTD3qIodhnSNdY7yLkOtSynXSdTBijNiEaV2bakQji7Vre_a4HJCVZXkyjX6u1VYb90dZUc7kS7F5L7dMjRs0DDRoUh9BFhIDCo4EFEIPNSpwRJg4l5VsFKVJOK-Ab5UGkq1qtd6Ubkpb0q8KeLu-JHzyiarPPzzovbjxMv_S-Cqdr6vbk_vC6bveXVtNt3d7085Bb7fb39N2CpUfH4aTR9N-shMnDs0e3sEWPlXAqaKcKbWq3JRuyc49fKGAHwp4dkU6q_2Puxb16wQRDJEJMd1CuoV1i-n9-VWwaOB6Lcj8XKRhEm62MPZDjjiF3IiWTLCvQd83OER-wGjABY-4eLpxqdrnDekP0
- https://firstgraderecruitment-my.sharepoint.com/_forms/default.aspx
- https://login.microsoftonline.com/95873dc5-93b0-4d27-a80a-aa6d53a1e24a/resume?ctx=rQIIAa1Rv2sTUQC-10vPJKYYCoKjSCbh5d6vu_cu4HC53IWWShXUIUt596u51tyldxcwGZ10ahEcRRRcMuoiXXQuDhmlf0FxEHFy0wQXxw5-w8c3fMP347aK27jTQn9B4YohimMMg2il_kG-WW--_v771RtFUebp8eGhWrybA2dYluOio-txkhflfi7DKI-CfJKUoygt4WjaLoYyj8ZZkpbtIBvpe3GWjwo9jGI5eVy2ZTF-8hGABQAXAMzXjnjPQAKbDmF2l7ke9pbacjFnyLKEjTxiIUqZjZBl2pwTB5q2g5jJu9zxXGK63OI2xtSjLnIYNgUyDSZ6CLkupcIkPQcjxohNmNGzqUEMcr52bdeelEOyoixPZtHPtdoq4944K8q5eqlt3qstyxCchoEBLeojyELCoRRIQinN0KASR4TJM1XLxlGahIsK-FZpILVTrdabyg3lpvKrAt6uLxc-_kT15x8e9F9cf5l_aXxVztb1rel96Qxc766tp1s7_Vl3v7_TG-wa24Uujg7C6aPZINmOE4dmD-_gDj7RwImmnWq1qtpUbqnOPXyhgR8aeHZFOa39j7sWV8F5A9drQebnMg2TcLOFsR8KJCgUPFqWx74BfZ8LiPyA0UBIEQn5dONSts8byh81
- https://login.microsoftonline.com/common/debugmode
- https://login.microsoftonline.com/95873dc5-93b0-4d27-a80a-aa6d53a1e24a/reprocess?ctx=rQIIAa1Rv2sTUQC-10vPJKYYCoKjSCbh5d6vu_cu4HC53IWWShXUIUt596u51tyldxcwGZ10ahEcRRRcMuoiXXQuDhmlf0FxEHFy0wQXxw5-w8c3fMP347aK27jTQn9B4YohimMMg2il_kG-WW--_v771RtFUebp8eGhWrybA2dYluOio-txkhflfi7DKI-CfJKUoygt4WjaLoYyj8ZZkpbtIBvpe3GWjwo9jGI5eVy2ZTF-8hGABQAXAMzXjnjPQAKbDmF2l7ke9pbacjFnyLKEjTxiIUqZjZBl2pwTB5q2g5jJu9zxXGK63OI2xtSjLnIYNgUyDSZ6CLkupcIkPQcjxohNmNGzqUEMcr52bdeelEOyoixPZtHPtdoq4944K8q5eqlt3qstyxCchoEBLeojyELCoRRIQinN0KASR4TJM1XLxlGahIsK-FZpILVTrdabyg3lpvKrAt6uLxc-_kT15x8e9F9cf5l_aXxVztb1rel96Qxc766tp1s7_Vl3v7_TG-wa24Uujg7C6aPZINmOE4dmD-_gDj7RwImmnWq1qtpUbqnOPXyhgR8aeHZFOa39j7sWV8F5A9drQebnMg2TcLOFsR8KJCgUPFqWx74BfZ8LiPyA0UBIEQn5dONSts8byh81
- https://login.microsoftonline.com/common/instrumentation/dssostatus
- https://go.microsoft.com/fwlink/?linkid=2013738
- https://login.microsoft.com/95873dc5-93b0-4d27-a80a-aa6d53a1e24a/fido/get?uiflavor=Web
- https://login.microsoftonline.com/common/instrumentation/reportpageload
- https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/watson.min_ybdb1ixzkv-fkor2mu6q6w2.js
Embedded domains
- aadcdn.msftauth.net
- aadcdn.msauth.net
- login.microsoftonline.com
- login.live.com
- 2flogin.microsoftonline.com
- github.com
- passwordreset.microsoftonline.com
- account.live.com
- go.microsoft.com
- signup.microsoft.com
- 2ffirstgraderecruitment-my.sharepoint.com
- microsoftonline.com
- www.microsoft.com
- privacy.microsoft.com
- firstgraderecruitment-my.sharepoint.com
- autologon.microsoftazuread-sso.com
- login.microsoft.com
- git.io
- modal-backdrop.in
- background.app
- background-image-holder.app
- middle.app
- inner.app
- sign-in-box.app
- vertical-split-content.app
More Office365 samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report