SUSPICIOUS — d3281964f0bf3283372ef3726756d0289177db490d16785aa0480e171ed40a84
SUSPICIOUS — d3281964f0bf3283372ef3726756d0289177db490d16785aa0480e171ed40a84 is a unknown sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (57/100), attributed to the Office365 family. 1 of 54 detection engines flagged it.
Identification
- SHA-256:
d3281964f0bf3283372ef3726756d0289177db490d16785aa0480e171ed40a84 - SHA-1:
86797e2a4d3acb65011b2b39df7d6e68eb7b267d - MD5:
88a8841fd916d76552f0b06e4ca3dd34 - ssdeep:
3072:+8x7XsGNyZ+BPktKyVUPrkUNG2ym+d/PngTezK8iH2g/Oz5:F7XsG6+TkUNGzV5 - TLSH:
T1E5414D77614C6FA380186F2AAECE533576403D9FD21005958B8ADAE47C98F60FD8243B - Submitted as: d3281964f0bf3283372ef3726756d0289177db490d16785aa0480e171ed40a84
- File type: unknown · Size: 195199 bytes
- Verdict: suspicious (57/100) · Family: Office365
Detections (1 of 54 engines)
- YARA: PhishingKit (t4d): PK_Office365_Login_Clone
Why this verdict
The suspicious score of 57/100 is the fusion of 2 weighted signals:
- YARA: PhishingKit (t4d) flagged PK_Office365_Login_Clone (rule
PK_Office365_Login_Clone) - engine signal, weight 0.65, confidence 0.70 - Embedded network infrastructure: https://aadcdn.msftauth.net, https://aadcdn.msftauth.net/shared/1.0/, https://hwbcpa-my.sharepoint.com/_forms/default.aspx - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://aadcdn.msftauth.net
- https://login.microsoftonline.com/jsdisabled
- https://login.live.com/logout.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
- https://login.live.com/forgetme.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
- https://login.microsoftonline.com/common/DeviceCodeStatus
- https://login.microsoftonline.com/common/GetCredentialType?mkt=en-US
- https://login.microsoftonline.com/common/GetOneTimeCode
- https://login.microsoftonline.com/e69174dc-3e79-4ecc-a09d-e8884b5e9f07/uxlogout
- https://login.microsoftonline.com/forgetuser
- https://go.microsoft.com/fwlink/p/?LinkID=733247
- https://login.microsoftonline.com/common/PIA/EndAuth
- https://aadcdn.msftauth.net/shared/1.0/
- https://www.microsoft.com/en-US/servicesagreement/
- https://privacy.microsoft.com/en-US/privacystatement
- https://login.microsoftonline.com/e69174dc-3e79-4ecc-a09d-e8884b5e9f07/login
- https://login.microsoftonline.com/e69174dc-3e79-4ecc-a09d-e8884b5e9f07/reprocess?ctx=rQIIAZ2RvYsTQQDFd25zaxIvGA4FweaQ2AiTzOzszM4sWOxXQJsYjrvimmM_Jmzukuy6u0FjKQja3X9wYJlSLeRsrK9KIQgRtJPDQsTqGsELNpaHr_jxilc83rur4ja2WuivCFwRosEAw0iu3D_KN-vN4x8vP91fKMr5m-Pfxfj9jTkwkrLMCqvTSR6HURbA8axdJEEus3Q4KdtROu7sD9J8XHRiOQimo7IdFNmTdwAsADgDYL72yCXM5sLpIp95iHtdhzPbZDazHYZMKihDxHFMT_cwdlnX9SG2fUoodU1GupQz3_Ad29YJYp5wBRWe7_sM0a6gnCPX9YkQtk593eUG1ru6TZdr13r2tEz0FdJ8-FT-WqutOu5naVHO1UuN8VptSSawacQRJNIU0JBRBAMkYig550ZIpRgg81TV0kxOhvGiAr5XNpBqVav1pnJT2VLOK-DV-sWkz-8sG18WufP288dvX29h5XS90zeKYHZRvi-MvkF20mnSk3tT9CAbBSP7kB3szrZl0jtMd7d37hELH2ngSNNOtFpVbSq3VfchPtPATw28uKKc1P7rn2X9uo50DJGAGG9hYVFu6WJvcRUsN3C9FqVhHkziYbzZwjiMOeIEclMiaOCQwjA0OURhZJCIB1zy4FnjUrEPDeUP0
- https://hwbcpa-my.sharepoint.com/_forms/default.aspx
- https://login.microsoftonline.com/e69174dc-3e79-4ecc-a09d-e8884b5e9f07/resume?ctx=rQIIAZ2RvYsTQQDFd7K5NYkXDAeCYCMSG2GSmZ2d2ZmAxX6CNjEcd4XNsR8TNl6SXXc33MVSELS7_-DAMqVayNlYX5VCECJoJ4eFiNU1ghdsLA9f8eMVr3i8d1fFHdxro78icE2IhkMMI7l2_yjfarSOf7z8dH-pKOdvjn8Xk_fXF8BIyjIret1uchBGWQAn806RBLnM0tG07ETppLs3TPNJ0Y3lMJiNy05QZIfvAFgCcAbAovLEIcziwvaRx1zEXd_mzDKZxSybIZMKyhCxbdPVXYwd5jsexJZHCaWOyYhPOfMMz7YsnSDmCkdQ4XqexxD1BeUcOY5HhLB06ukON7Du6xZdVa71rVmZ6Guk-eip_FWprzvuZWlRLtRLjfFabUsmsGnEESTSFNCQUQQDJGIoOedGSKUYIvNU1dJMTkfxsgq-VzeR2qvVGi3lhnJLOa-CVxsXkz6_s2p-Web2288fv329iZXTje7AKIL5RfmBMAYG2UlnSV8-mqEH2TgYW_vs8e58Wyb9_XR3e-ce6eEjDRxp2olWr6kt5bbqPMRnGvipgRdXlJP6f_2zvApWm7hRj9IwD6bxKN5qYxzGHHECuSkRNHBIYRiaHKIwMkjEAy558Kx5qdiHpvIH0
- https://aadcdn.msftauthimages.net/dbd5a2dd-2ukecpbuazacrtz1wgmyszqrsbwserd-p2pkujhjina/logintenantbranding/0/illustration?ts=636688084859568967
- https://login.microsoftonline.com/common/debugmode
- https://login.microsoftonline.com/e69174dc-3e79-4ecc-a09d-e8884b5e9f07/reprocess?ctx=rQIIAZ2RvYsTQQDFd7K5NYkXDAeCYCMSG2GSmZ2d2ZmAxX6CNjEcd4XNsR8TNl6SXXc33MVSELS7_-DAMqVayNlYX5VCECJoJ4eFiNU1ghdsLA9f8eMVr3i8d1fFHdxro78icE2IhkMMI7l2_yjfarSOf7z8dH-pKOdvjn8Xk_fXF8BIyjIret1uchBGWQAn806RBLnM0tG07ETppLs3TPNJ0Y3lMJiNy05QZIfvAFgCcAbAovLEIcziwvaRx1zEXd_mzDKZxSybIZMKyhCxbdPVXYwd5jsexJZHCaWOyYhPOfMMz7YsnSDmCkdQ4XqexxD1BeUcOY5HhLB06ukON7Du6xZdVa71rVmZ6Guk-eip_FWprzvuZWlRLtRLjfFabUsmsGnEESTSFNCQUQQDJGIoOedGSKUYIvNU1dJMTkfxsgq-VzeR2qvVGi3lhnJLOa-CVxsXkz6_s2p-Web2288fv329iZXTje7AKIL5RfmBMAYG2UlnSV8-mqEH2TgYW_vs8e58Wyb9_XR3e-ce6eEjDRxp2olWr6kt5bbqPMRnGvipgRdXlJP6f_2zvApWm7hRj9IwD6bxKN5qYxzGHHECuSkRNHBIYRiaHKIwMkjEAy558Kx5qdiHpvIH0
- https://login.microsoftonline.com/common/instrumentation/dssostatus
- https://go.microsoft.com/fwlink/?linkid=2013738
- https://login.microsoft.com/e69174dc-3e79-4ecc-a09d-e8884b5e9f07/fido/get?uiflavor=Web
- https://login.microsoftonline.com/common/instrumentation/reportpageload
Embedded domains
- aadcdn.msftauth.net
- aadcdn.msauth.net
- login.microsoftonline.com
- login.live.com
- 2flogin.microsoftonline.com
- github.com
- passwordreset.microsoftonline.com
- account.live.com
- go.microsoft.com
- signup.microsoft.com
- 2fhwbcpa-my.sharepoint.com
- microsoftonline.com
- www.microsoft.com
- privacy.microsoft.com
- hwbcpa-my.sharepoint.com
- aadcdn.msftauthimages.net
- example.com
- autologon.microsoftazuread-sso.com
- login.microsoft.com
- git.io
- modal-backdrop.in
- background.app
- background-image-holder.app
- middle.app
- inner.app
More Office365 samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report