SUSPICIOUS — d99d89593ebfc2cbc6d387f3dfaf25fc8c1d8e08e93434456bb8a2a6f7c92c4e

SUSPICIOUS — d99d89593ebfc2cbc6d387f3dfaf25fc8c1d8e08e93434456bb8a2a6f7c92c4e is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (69/100). 1 of 54 detection engines flagged it.

Identification

• SHA-256: d99d89593ebfc2cbc6d387f3dfaf25fc8c1d8e08e93434456bb8a2a6f7c92c4e
• SHA-1: 45b12b900c0fb354a0d054063ab21df1c06cd534
• MD5: c23e58e82c72e8d31068be89884ced18
• ssdeep: 96:woqBYnnv8sZS0rdMyu/F8YCDm4Un9frt:2B2nNg0rqyu/+HDZUBt
• TLSH: T1761832336DB8B859D9C40CC9A5709C882CE6FE2FBC25D5CF4B954F84405C3A2E0251AB
• Submitted as: d99d89593ebfc2cbc6d387f3dfaf25fc8c1d8e08e93434456bb8a2a6f7c92c4e
• File type: script · Size: 3864 bytes
• Verdict: suspicious (69/100)

Detections (1 of 54 engines)

• Microsoft Defender: Trojan:HTML/Phish.AMK!MTB

Why this verdict

The suspicious score of 69/100 is the fusion of 2 weighted signals:

• Microsoft Defender flagged Trojan:HTML/Phish.AMK!MTB (rule Trojan:HTML/Phish.AMK!MTB) - engine signal, weight 0.55, confidence 0.85
• Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75

Dynamic analysis (windows)

1144 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• desktop-hsgcbep._dosvc._tcp.local
• desktop-hsgcbep(1)._dosvc._tcp.local
• desktop-hsgcbep(2)._dosvc._tcp.local
• desktop-hsgcbep(3)._dosvc._tcp.local
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• 23.40.52.209
• 23.11.37.157
• 40.126.14.160
• 4.144.132.223 SG · Singapore · AS8075 Microsoft Corporation
• 52.123.252.198 AU · Sydney · AS8075 Microsoft Corporation
• 23.198.40.44
• 52.110.12.10 AU · Sydney · AS8075 Microsoft Corporation

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded IP addresses

• 4.144.132.223
• 52.123.252.198
• 52.110.12.10
• 4.230.171.124
• 40.84.85.40

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report