SUSPICIOUS — d328402c3353e32dad58909c1e407f2b17bb262e1760ae1f055a4b7934046d12
SUSPICIOUS — d328402c3353e32dad58909c1e407f2b17bb262e1760ae1f055a4b7934046d12 is a unknown sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (57/100), attributed to the Office365 family. 1 of 54 detection engines flagged it.
Identification
- SHA-256:
d328402c3353e32dad58909c1e407f2b17bb262e1760ae1f055a4b7934046d12 - SHA-1:
3ea4b4498d61e44d153885e2f1c832479464e5d6 - MD5:
677d68e8a61ff5ef8394c1ad9523c5f8 - ssdeep:
3072:gQI3QI58qaQI6B5QI3BfXYJf+BxktKyVUvrkUNG2ym+d/PngTezK8iH2g/Oj5:sZfy6Bn3BfXk+pkUNGzR5 - TLSH:
T1DD414C3661496F7380186F2AAECE533576403D9FD25005958B8ADAE87C98F70FD8243B - Submitted as: d328402c3353e32dad58909c1e407f2b17bb262e1760ae1f055a4b7934046d12
- File type: unknown · Size: 195727 bytes
- Verdict: suspicious (57/100) · Family: Office365
Detections (1 of 54 engines)
- YARA: PhishingKit (t4d): PK_Office365_Login_Clone
Why this verdict
The suspicious score of 57/100 is the fusion of 2 weighted signals:
- YARA: PhishingKit (t4d) flagged PK_Office365_Login_Clone (rule
PK_Office365_Login_Clone) - engine signal, weight 0.65, confidence 0.70 - Embedded network infrastructure: https://aadcdn.msauth.net, https://aadcdn.msauth.net/shared/1.0/, https://liveswinburneeduau-my.sharepoint.com/_forms/default.aspx - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://aadcdn.msauth.net
- https://login.microsoftonline.com/jsdisabled
- https://login.live.com/logout.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
- https://login.live.com/forgetme.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
- https://login.microsoftonline.com/common/DeviceCodeStatus
- https://login.microsoftonline.com/common/GetCredentialType?mkt=en-US
- https://login.microsoftonline.com/common/GetOneTimeCode
- https://login.microsoftonline.com/df7f7579-3e9c-4a7e-b844-420280f53859/uxlogout
- https://login.microsoftonline.com/forgetuser
- https://go.microsoft.com/fwlink/p/?LinkID=733247
- https://login.microsoftonline.com/common/PIA/EndAuth
- https://aadcdn.msauth.net/shared/1.0/
- https://www.microsoft.com/en-US/servicesagreement/
- https://privacy.microsoft.com/en-US/privacystatement
- https://login.microsoftonline.com/df7f7579-3e9c-4a7e-b844-420280f53859/login
- https://login.microsoftonline.com/df7f7579-3e9c-4a7e-b844-420280f53859/reprocess?ctx=rQIIAaVRPW_TQAD11alJQqtGVYUYK5QJdMl92L47SyAcfwShQEIZKmWp7PisWCRxiGMonRATYso_AFXAECEGJtSJlU6Zs7JUDAgxMdKIhbESb3h6wxvex3UV17BVRX9B4YohimMMe3Kl_sFku1x5_cP9ejhTlLfDN7euHHd35uB2fzodZ1a9PkieyOxpMgrzyUjKKA9yOHxWy_rBRI7TZDSt9dJh_SBOJ8OsHsk4yAfTWpCNDz8DsADgDID52mPXJx6yhUBcmAb3eYPZrmDCoZ7BHGq7tuswk5jcaZgEU2ZAk9jUdXwD2ZxRn_rcYIx6JjMw9xxKTN-0iW4Km9jYNnWH-AIxIXTscq8hKPeWa1ttO5_2yYrSSXIkf62VVhkPxmk2nasXGuaTWo1iFjODCUil6EE9YBKGXNehThDhKDYoN8SpqqVjOUqiRQF8L2wg1SoWyxXlqrKr_C6A4_XzeeW3rXuv7n5sPh-9K7-XH5TT9foDxjO-F93fb3XjfqfZ9mkrad3wwn2ZP-wz-agZt_eCQefO-IjfNC0808BM0060UlGtKNdUp4PPNPBTAy8vKSel__5qWd45L4QhEhCjXUItA1s66S4ug-UGLpd6aTgJRlESbVcxDiOOOIWcSQR1HBowDBmHKOzptMcDLnnwYvNCti-byh81
- https://liveswinburneeduau-my.sharepoint.com/_forms/default.aspx
- https://login.microsoftonline.com/df7f7579-3e9c-4a7e-b844-420280f53859/resume?ctx=rQIIAaWRvW_TQADFfXFqktCqUYUQI0KZQJfc-WzfXSQQjj-CUCChDJW6VP44K1YT28Q2lE6ICTHlPwBVwBAhBibUiZVOmbuyVAwIMTFCxMJYiTc8veENT793XcZt3G2hvyJw5RBFEYaBWKV_NNtqNF99t78czCXpzfT1rctHu5cW4Pa4KLK82-lM4scifxInfjlLhAhLr4TTp-187M1ElsZJ0Q7SaWcvSmfTvBOKyCsnRdvLs4NPACwBOANgUXlku6qDTM4R44bOXNajps0pt4ijU4uYtmlb1FANZvUMFROqQ0M1iW25OjIZJS5xmU4pcQyqY-ZYRDVcw1Q1g5uqiU1Ds1SXI8q5hm3m9Dhhzmllc2iWxVhdWTqLD8XPSn21cS9L82IhnwvMR7kVRjSiOuWQCB5AzaMC-kzToKYilaFIJ0znJ7KSZiKJw2UVfKuuI7lbqzWa0hXpqvSrCo7W_uAVXzfvvbz7of8sedt4J95LJ2udB5TlbDu8vzPYjcaj_tAlg3hww_F3RPlwTMV-Pxpue5PRneyQ3TS6eK6AuaIcK_Wa3JSuydYInynghwJeXJCO6__91fIiOF3HjXqQ-jMvCeNwq4WxHzLECGRUIKhhX4e-TxlEfqCRgHlMMO_5xrlqnzek3w2
- https://aadcdn.msauthimages.net/dbd5a2dd-8z-zfnvui1qt4djrf8zk0xrboc2i8e4hxkeylzqido/logintenantbranding/0/bannerlogo?ts=637340834054678521
- https://aadcdn.msauthimages.net/dbd5a2dd-8z-zfnvui1qt4djrf8zk0xrboc2i8e4hxkeylzqido/logintenantbranding/0/illustration?ts=635993193312907480
- http://swi.nu/pwdhelp
- https://login.microsoftonline.com/common/debugmode
- https://login.microsoftonline.com/df7f7579-3e9c-4a7e-b844-420280f53859/reprocess?ctx=rQIIAaWRvW_TQADFfXFqktCqUYUQI0KZQJfc-WzfXSQQjj-CUCChDJW6VP44K1YT28Q2lE6ICTHlPwBVwBAhBibUiZVOmbuyVAwIMTFCxMJYiTc8veENT793XcZt3G2hvyJw5RBFEYaBWKV_NNtqNF99t78czCXpzfT1rctHu5cW4Pa4KLK82-lM4scifxInfjlLhAhLr4TTp-187M1ElsZJ0Q7SaWcvSmfTvBOKyCsnRdvLs4NPACwBOANgUXlku6qDTM4R44bOXNajps0pt4ijU4uYtmlb1FANZvUMFROqQ0M1iW25OjIZJS5xmU4pcQyqY-ZYRDVcw1Q1g5uqiU1Ds1SXI8q5hm3m9Dhhzmllc2iWxVhdWTqLD8XPSn21cS9L82IhnwvMR7kVRjSiOuWQCB5AzaMC-kzToKYilaFIJ0znJ7KSZiKJw2UVfKuuI7lbqzWa0hXpqvSrCo7W_uAVXzfvvbz7of8sedt4J95LJ2udB5TlbDu8vzPYjcaj_tAlg3hww_F3RPlwTMV-Pxpue5PRneyQ3TS6eK6AuaIcK_Wa3JSuydYInynghwJeXJCO6__91fIiOF3HjXqQ-jMvCeNwq4WxHzLECGRUIKhhX4e-TxlEfqCRgHlMMO_5xrlqnzek3w2
- https://login.microsoftonline.com/common/instrumentation/dssostatus
- https://go.microsoft.com/fwlink/?linkid=2013738
Embedded domains
- aadcdn.msauth.net
- aadcdn.msftauth.net
- login.microsoftonline.com
- login.live.com
- 2flogin.microsoftonline.com
- github.com
- passwordreset.microsoftonline.com
- account.live.com
- go.microsoft.com
- signup.microsoft.com
- 2fliveswinburneeduau-my.sharepoint.com
- microsoftonline.com
- www.microsoft.com
- privacy.microsoft.com
- liveswinburneeduau-my.sharepoint.com
- aadcdn.msauthimages.net
- swin.edu.au
- student.swin.edu.au
- autologon.microsoftazuread-sso.com
- login.microsoft.com
- git.io
- modal-backdrop.in
- background.app
- background-image-holder.app
- middle.app
More Office365 samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report