CLEAN — d4c7772ecdb6737a5a4d668b999774639c3aff3fdd7b835b37b7d848f4800ef1

CLEAN — d4c7772ecdb6737a5a4d668b999774639c3aff3fdd7b835b37b7d848f4800ef1 is a script sample analyzed by MalwareAnalyzer by Cyble with a clean verdict (21/100). 0 of 54 detection engines flagged it.

Identification

• SHA-256: d4c7772ecdb6737a5a4d668b999774639c3aff3fdd7b835b37b7d848f4800ef1
• SHA-1: 17f2941e72defd5098a072a3fceb6523ab2c760d
• MD5: f055da9266d7239eb5c97b873da8c346
• ssdeep: 96:m5Ev4FfbFSCGG/iSrXZlCytT81FNRVSLj:yEEfbFSCGciSrDCytT81FNRVSLj
• TLSH: T1FF1AD0B69B717EFF9F8625C5690D2DAF0A0360C3B8006969E904ADC55C63CA91F1CC9C
• Submitted as: d4c7772ecdb6737a5a4d668b999774639c3aff3fdd7b835b37b7d848f4800ef1
• File type: script · Size: 4436 bytes
• Verdict: clean (21/100)

Detections (0 of 54 engines)

No engine flagged this sample.

Why this verdict

The clean score of 21/100 is the fusion of 1 weighted signal:

• Embedded network infrastructure: http://blozoo.net/f/gstats - static signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

1145 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• desktop-hsgcbep._dosvc._tcp.local
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/
• 23.40.52.85

Embedded URLs

• http://blozoo.net/f/gstats
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/

Embedded domains

• blozoo.net
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 57.154.63.210
• 20.42.179.192
• 72.153.5.63
• 48.211.4.16
• 52.123.252.224
• 52.110.12.49
• 57.155.104.224
• 4.230.171.124
• 104.18.33.89
• 135.232.92.97
• 74.179.77.204
• 4.144.132.223
• 4.150.223.107
• 72.153.5.137

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report