SUSPICIOUS — e33f2bb168135f4f78844ba43c671d7f1175f9609ea14d0539d58d6a3b4604cf
SUSPICIOUS — e33f2bb168135f4f78844ba43c671d7f1175f9609ea14d0539d58d6a3b4604cf is a unknown sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (57/100), attributed to the Office365 family. 1 of 54 detection engines flagged it.
Identification
- SHA-256:
e33f2bb168135f4f78844ba43c671d7f1175f9609ea14d0539d58d6a3b4604cf - SHA-1:
7b2d2a7ec1be1e75228713aab315ab188e650fa5 - MD5:
df8170eb057b02d753df9ce9c28963aa - ssdeep:
3072:o8qi0du+BxktKyVUvrkUNG2ym+d/PngTezK8iH2g/Oj5:AiB+pkUNGzR5 - TLSH:
T131415C36614C6F7380186E2AAECE533576403D9FE21405958B8ADAE87C98F70FD4643B - Submitted as: e33f2bb168135f4f78844ba43c671d7f1175f9609ea14d0539d58d6a3b4604cf
- File type: unknown · Size: 194690 bytes
- Verdict: suspicious (57/100) · Family: Office365
Detections (1 of 54 engines)
- YARA: PhishingKit (t4d): PK_Office365_Login_Clone
Why this verdict
The suspicious score of 57/100 is the fusion of 2 weighted signals:
- YARA: PhishingKit (t4d) flagged PK_Office365_Login_Clone (rule
PK_Office365_Login_Clone) - engine signal, weight 0.65, confidence 0.70 - Embedded network infrastructure: https://aadcdn.msauth.net, https://aadcdn.msauth.net/shared/1.0/, https://plytecfi-my.sharepoint.com/_forms/default.aspx - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://aadcdn.msauth.net
- https://login.microsoftonline.com/jsdisabled
- https://login.live.com/logout.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
- https://login.live.com/forgetme.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
- https://login.microsoftonline.com/common/DeviceCodeStatus
- https://login.microsoftonline.com/common/GetCredentialType?mkt=en-US
- https://login.microsoftonline.com/common/GetOneTimeCode
- https://login.microsoftonline.com/dc538a16-3bad-42f6-8066-b7a63397b83b/uxlogout
- https://login.microsoftonline.com/forgetuser
- https://go.microsoft.com/fwlink/p/?LinkID=733247
- https://login.microsoftonline.com/common/PIA/EndAuth
- https://aadcdn.msauth.net/shared/1.0/
- https://www.microsoft.com/en-US/servicesagreement/
- https://privacy.microsoft.com/en-US/privacystatement
- https://login.microsoftonline.com/dc538a16-3bad-42f6-8066-b7a63397b83b/login
- https://login.microsoftonline.com/dc538a16-3bad-42f6-8066-b7a63397b83b/reprocess?ctx=rQIIAZ2RMW_TQACFfXVqktCKqGJgrKpMSJfc-e7sO0sMZycWEkNRq5TCUvlshwQa20mcQjoiVWLMzAASLCgjLKhiQOpEFzJH_ICKASEGxEgiFsaKNzy94Rue3rup4xp2quivCFw6RO02hmG8TP9osFGuvPreehFrGtqa3Dv7-OvzyRRYnTzPhk69nh2O8zhsd2FvXBt2gkGcpd0kr4Vpr37QTge9YT2K28HoMK8Fw-zpBwBmAFwAMF3pU-q6lpCWxV1TmpiyhkulRAy51GoKLAQXLvNtn5pEEuITiG0hKZOW2zB9tECbC5B6TUFF0_Vsz8YN3yM-ZTbG0nQZJVwQv9kQruciD1lyvnJtW47yjrm0dNA9jn-ulJYdD7J0mE_1S83xTq9GISM8wBYkKoggNdsW5MiyoLIDixBhK07UuW6kWZx0o1kBfCusId0pFssV7Ya2qf0ugNeri1Eff3m73_96Jk_evN95-RBp56v1ZG_U2lZKHOH9ZMdWirT25HHnDjlSMbv_JHnEvPQ23-30x7vyFnPwxAATwzg1SkW9om3p3l18YYAfBnh-RTst_edD8_J1E5kYIgEx3kTUocwh7MHsKpiv4XIpTNUgSKJutFHFWEUccQK5HSNIsWJQKZtDpEJKQh7wmAfP1i-FfVrX_gA1
- https://plytecfi-my.sharepoint.com/_forms/default.aspx
- https://login.microsoftonline.com/dc538a16-3bad-42f6-8066-b7a63397b83b/resume?ctx=rQIIAZ2RvW_TQADFfXFqktCKqBMjqjIhXXLnO5_vIjGcnVhIDEWtUspU-fxBUhrbSZy26YhUiTEzA0iwoIywoIoBqRNdyFzxB1QMCDEgRhKxMFa84ekNv-Hpvbs6ruNmDf0VgUuHKI4xDKJl-kfD9Ur11ffOi0jT0Mb00fnHX59PZ4B18zwbNRuN7GCSR0Hcg_1JfdT1h1GW9pK8HqT9xl6cDvujRhjF_vggr_uj7PgDAHMArgCYFQaUOg4TkjHumNLE1Go5VEpkIYeytsBCcOFYnu1Rk0hCPAKxLSS1JHNapocWaHsBUrctqGg7ru3auOW5xKOWjbE0HYsSLojXbgnHdZCLmLws3NqU47xrLi0d9k6in4XysuNelo7ymX6tOd7ptTCwCPcxg0T5IaRmzCBHjEFl-4wQYStO1IVupFmU9MJ5EXwrriK9WSpVqtpt7Y72uwheryxGffrl7e7g67k8ffN-6-UTpF2sNJKdcWdTKXGId5MtWynS2ZEn3QfkUEXW46Nk33LT-3y7O5hsy3tWE08NMDWMM6Nc0qvahu4-xFcG-GGA5ze0s_J_PjS_CS5XcaUcpGroJ2EvXK9hrEKOOIHcjhCkWFlQKZtDpAJKAu7ziPvP1q6FfVrT_gA1
- https://login.microsoftonline.com/common/debugmode
- https://login.microsoftonline.com/dc538a16-3bad-42f6-8066-b7a63397b83b/reprocess?ctx=rQIIAZ2RvW_TQADFfXFqktCKqBMjqjIhXXLnO5_vIjGcnVhIDEWtUspU-fxBUhrbSZy26YhUiTEzA0iwoIywoIoBqRNdyFzxB1QMCDEgRhKxMFa84ekNv-Hpvbs6ruNmDf0VgUuHKI4xDKJl-kfD9Ur11ffOi0jT0Mb00fnHX59PZ4B18zwbNRuN7GCSR0Hcg_1JfdT1h1GW9pK8HqT9xl6cDvujRhjF_vggr_uj7PgDAHMArgCYFQaUOg4TkjHumNLE1Go5VEpkIYeytsBCcOFYnu1Rk0hCPAKxLSS1JHNapocWaHsBUrctqGg7ru3auOW5xKOWjbE0HYsSLojXbgnHdZCLmLws3NqU47xrLi0d9k6in4XysuNelo7ymX6tOd7ptTCwCPcxg0T5IaRmzCBHjEFl-4wQYStO1IVupFmU9MJ5EXwrriK9WSpVqtpt7Y72uwheryxGffrl7e7g67k8ffN-6-UTpF2sNJKdcWdTKXGId5MtWynS2ZEn3QfkUEXW46Nk33LT-3y7O5hsy3tWE08NMDWMM6Nc0qvahu4-xFcG-GGA5ze0s_J_PjS_CS5XcaUcpGroJ2EvXK9hrEKOOIHcjhCkWFlQKZtDpAJKAu7ziPvP1q6FfVrT_gA1
- https://login.microsoftonline.com/common/instrumentation/dssostatus
- https://go.microsoft.com/fwlink/?linkid=2013738
- https://login.microsoft.com/dc538a16-3bad-42f6-8066-b7a63397b83b/fido/get?uiflavor=Web
- https://login.microsoftonline.com/common/instrumentation/reportpageload
- https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/watson.min_ybdb1ixzkv-fkor2mu6q6w2.js
Embedded domains
- aadcdn.msauth.net
- aadcdn.msftauth.net
- login.microsoftonline.com
- login.live.com
- 2flogin.microsoftonline.com
- github.com
- passwordreset.microsoftonline.com
- account.live.com
- go.microsoft.com
- signup.microsoft.com
- 2fplytecfi-my.sharepoint.com
- microsoftonline.com
- www.microsoft.com
- privacy.microsoft.com
- plytecfi-my.sharepoint.com
- autologon.microsoftazuread-sso.com
- login.microsoft.com
- git.io
- modal-backdrop.in
- background.app
- background-image-holder.app
- middle.app
- inner.app
- sign-in-box.app
- vertical-split-content.app
More Office365 samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report