SUSPICIOUS — d3212cecb80244e2f66c763638b05c340f713b2903dad017baff04ca196ed50d
SUSPICIOUS — d3212cecb80244e2f66c763638b05c340f713b2903dad017baff04ca196ed50d is a unknown sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (57/100), attributed to the Office365 family. 1 of 54 detection engines flagged it.
Identification
- SHA-256:
d3212cecb80244e2f66c763638b05c340f713b2903dad017baff04ca196ed50d - SHA-1:
3acf2f6e7c3bed725a8b56b9338f62b1236b6188 - MD5:
065f58e943c97a77d2c3335e504895f4 - ssdeep:
3072:i8aztLiP4ES+BPktKyVUdrkUNG2ym+d/PngTezK8iH2g/Oz5:WtB+NkUNGzV5 - TLSH:
T15E415D7661486FB380186E2AAECE133576403D9FD21405958B8ADAF87C98F70FD4643B - Submitted as: d3212cecb80244e2f66c763638b05c340f713b2903dad017baff04ca196ed50d
- File type: unknown · Size: 194838 bytes
- Verdict: suspicious (57/100) · Family: Office365
Detections (1 of 54 engines)
- YARA: PhishingKit (t4d): PK_Office365_Login_Clone
Why this verdict
The suspicious score of 57/100 is the fusion of 2 weighted signals:
- YARA: PhishingKit (t4d) flagged PK_Office365_Login_Clone (rule
PK_Office365_Login_Clone) - engine signal, weight 0.65, confidence 0.70 - Embedded network infrastructure: https://aadcdn.msftauth.net, https://aadcdn.msftauth.net/shared/1.0/, https://wilsonvaluation602-my.sharepoint.com/_forms/default.aspx - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://aadcdn.msftauth.net
- https://login.microsoftonline.com/jsdisabled
- https://login.live.com/logout.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
- https://login.live.com/forgetme.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
- https://login.microsoftonline.com/common/DeviceCodeStatus
- https://login.microsoftonline.com/common/GetCredentialType?mkt=en-US
- https://login.microsoftonline.com/common/GetOneTimeCode
- https://login.microsoftonline.com/ad71e1eb-cc4c-438f-8593-ab5b568ca41b/uxlogout
- https://login.microsoftonline.com/forgetuser
- https://go.microsoft.com/fwlink/p/?LinkID=733247
- https://login.microsoftonline.com/common/PIA/EndAuth
- https://aadcdn.msftauth.net/shared/1.0/
- https://www.microsoft.com/en-US/servicesagreement/
- https://privacy.microsoft.com/en-US/privacystatement
- https://login.microsoftonline.com/ad71e1eb-cc4c-438f-8593-ab5b568ca41b/login
- https://login.microsoftonline.com/ad71e1eb-cc4c-438f-8593-ab5b568ca41b/reprocess?ctx=rQIIAaWRv2_TQBTHfXFiktDSqEKIsaBMoEvufLbvYqlSLnGOIaoSfqrKUvmnYpLYJnZK6diJsf9BJcZILEyoU-cOKHMmNioGhDrBRiIWxkp8pffVG56e3vfzHsm4hs0q-isC1w5REGDo-uvuH023y5WzH_vdUSJdeOOmOCt--T0HzWGWJalZr78Nx2kcHdrjmZ2FcWQgFU7e1dKhPfWTOIyymhtP6gdBPJ2kdc8P7Nk4q9lpcvQZgAUAVwDMc2-E1RLI4IRi0jAswi2qE2YQznBbIItywgXpMNHQLcE5bXcgIULoLU71lm4Ig1EuNMKJpq2K4g6nqmpxjdFGq9XAqhAEMbJaiwU3mIVY21jmtnp8lg3VtcXT8Ni_zpXWNx4kcZrN5RuB-SRXbY9iH_sOdF3NhRphAWR6g0Db0R3dYK6tYedSVuLEj0JvkQff8xtINovFckW6L-1Iv_LgQ2GF9-v1yb3CHbb3cdJ8UP22K10W6rOn3cdZ79iOXkzU5GVXGIPe0eGzV35_36GvUfx89GTQn-0FKBuOdqmJTxVwqijnSqkoV6SHcruPrxTwUwHvb0nnpf_-1bJ8V0UqhqgBMd5BuklUkxiDxW2w3MDlkhs7UzvyQm-7irHjsRVtyKiP4Cq9Dh2HMogcVyMus5nP7JPNG41dbEp_AA2
- https://wilsonvaluation602-my.sharepoint.com/_forms/default.aspx
- https://login.microsoftonline.com/ad71e1eb-cc4c-438f-8593-ab5b568ca41b/resume?ctx=rQIIAaWRv2_TQBTHfXFiktDSqAPqCCgT6JI7n-27RKqUS5xjiKqEn6q6VOdfiklim9hpS8dOjP0PKjFGYmFCnTp3QJk7sVExINQJNhKxMFbiK72v3vD09L6f91jFNdysor8icOUQBQGGrr_q_tF0s1w5-7HbGyXKhTduibPil99z0BpmWZI26_XDcJzG0YEcz2QWxpGFdDh5V0uHcuoncRhlNTee1PeDeDpJ654fyNk4q8k0OfoMwAKAawDmubfCbgtkcUIxaVg24TY1CbMIZ7gjkE054YJ0mWiYtuCcdrqQECHMNqdm27SExSgXBuHEMJZFcZdTXbe5wWij3W5gXQiCGFmuxYJbzEasY13lNvp8lg31lcXT8Ni_yZVWN-4ncZrN1VuB-aRWpUexj30Huq7hQoOwADKzQaB0TMe0mCsN7FyqWpz4Uegt8uB7fg2pzWKxXFG2lAfKrzz4UFji_Xpzcr9wj-18nLQeVr9tK5eF-uxZ70nWP5bRy4mevOoJa69_dPD8tT_YdegbFL8YPd0bzHYClA1H27SJTzVwqmnnWqmoVpRHameArzXwUwPv7yjnpf_-1eIuuFrD5ZIbO1MZeaG3WcXY8dgSK2TUR3AZ04SOQxlEjmsQl0nmM3myfquxi3XlDw2
- https://login.microsoftonline.com/common/debugmode
- https://login.microsoftonline.com/ad71e1eb-cc4c-438f-8593-ab5b568ca41b/reprocess?ctx=rQIIAaWRv2_TQBTHfXFiktDSqAPqCCgT6JI7n-27RKqUS5xjiKqEn6q6VOdfiklim9hpS8dOjP0PKjFGYmFCnTp3QJk7sVExINQJNhKxMFbiK72v3vD09L6f91jFNdysor8icOUQBQGGrr_q_tF0s1w5-7HbGyXKhTduibPil99z0BpmWZI26_XDcJzG0YEcz2QWxpGFdDh5V0uHcuoncRhlNTee1PeDeDpJ654fyNk4q8k0OfoMwAKAawDmubfCbgtkcUIxaVg24TY1CbMIZ7gjkE054YJ0mWiYtuCcdrqQECHMNqdm27SExSgXBuHEMJZFcZdTXbe5wWij3W5gXQiCGFmuxYJbzEasY13lNvp8lg31lcXT8Ni_yZVWN-4ncZrN1VuB-aRWpUexj30Huq7hQoOwADKzQaB0TMe0mCsN7FyqWpz4Uegt8uB7fg2pzWKxXFG2lAfKrzz4UFji_Xpzcr9wj-18nLQeVr9tK5eF-uxZ70nWP5bRy4mevOoJa69_dPD8tT_YdegbFL8YPd0bzHYClA1H27SJTzVwqmnnWqmoVpRHameArzXwUwPv7yjnpf_-1eIuuFrD5ZIbO1MZeaG3WcXY8dgSK2TUR3AZ04SOQxlEjmsQl0nmM3myfquxi3XlDw2
- https://login.microsoftonline.com/common/instrumentation/dssostatus
- https://go.microsoft.com/fwlink/?linkid=2013738
- https://login.microsoft.com/ad71e1eb-cc4c-438f-8593-ab5b568ca41b/fido/get?uiflavor=Web
- https://login.microsoftonline.com/common/instrumentation/reportpageload
- https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/watson.min_ybdb1ixzkv-fkor2mu6q6w2.js
Embedded domains
- aadcdn.msftauth.net
- aadcdn.msauth.net
- login.microsoftonline.com
- login.live.com
- 2flogin.microsoftonline.com
- github.com
- passwordreset.microsoftonline.com
- account.live.com
- go.microsoft.com
- signup.microsoft.com
- 2fwilsonvaluation602-my.sharepoint.com
- microsoftonline.com
- www.microsoft.com
- privacy.microsoft.com
- wilsonvaluation602-my.sharepoint.com
- autologon.microsoftazuread-sso.com
- login.microsoft.com
- git.io
- modal-backdrop.in
- background.app
- background-image-holder.app
- middle.app
- inner.app
- sign-in-box.app
- vertical-split-content.app
More Office365 samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report