MALICIOUS — Delivery Doc One Drive Doc.shtml

MALICIOUS — Delivery Doc One Drive Doc.shtml is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (71/100). 0 of 53 detection engines flagged it.

Identification

SHA-256: fa75db4c90c7bdb8c5df08578ad06f38cec113c0a898bfda31048f4b1016713f
SHA-1: 508d9d89f937ea180d6839e224863cb4bbf9bc8f
MD5: 8a3ecbc69354d9d0ca92ed9bffa2331d
ssdeep: 12:hnMEwhuX4w4vy4Wh96QclfVI9xD8Cpb8KcI:hMhmMvy4Wvsq9ywwKB
TLSH: T1110E5C1A78D52E4C4BCA0249D159C8E0E98ED04E0227D25F0A62DB7409F8BC0696C765
Submitted as: Delivery Doc One Drive Doc.shtml
File type: html · Size: 426 bytes
Verdict: malicious (71/100)

Detections (0 of 53 engines)

No engine flagged this sample.

Why this verdict

The malicious score of 71/100 is the fusion of 4 weighted signals:

Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Contacted 30 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://estebuste.es/wp-content/vjm/crypt/?email=fvl@delizia.com.bo - static signal, weight 0.35, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

279 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd
http://www.w3.org/1999/xhtml
https://estebuste.es/wp-content/vjm/crypt/?email=fvl@delizia.com.bo
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787785270&P2=404&P3=2&P4=ckTg5o%2f4WmO7FFtCduCKzN%2b7D74x4JQtO%2bqClxTek8qyiD%2f%2bjyRh%2bBfuSCWkx0b2WAFZRIMaF7uD1lILJEXu%2fQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787785282&P2=404&P3=2&P4=Zty8k7hHkarkfZLdaLAq%2fuq4Ye1y8pIzWguP428IfpVzWwFWbGXVfbULYZUEcUz3I59rXLCWS5Qyu0x5K7VHBg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787182011&P2=404&P3=2&P4=PVFi%2fQRY8%2bjjomqtnuy0OrP4pT7WxDSaCIe%2b47TugQtSjbE13HuFc676bv5JMj3u9l6WO4B8bBZBI8Btw1uw7A%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787181503&P2=404&P3=2&P4=LWCPQtEyc2JE8zM%2fWrUrrB1GfFJp3HeQTqPcXP9T%2fho%2fSK8teE8AYRuiHLZ0r37SeLoNRrY8w2RcEdZys6NJkg%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.w3.org
estebuste.es

Embedded IP addresses

48.211.4.16
20.184.175.0
52.123.252.192
20.247.185.124
4.230.171.124
57.154.63.210
135.233.95.144
74.179.77.164
135.232.92.137
51.116.246.105
52.123.128.14
20.231.239.246
40.99.134.2
172.66.2.5
20.184.175.4
172.178.240.163
74.179.71.159
203.26.79.13
52.110.12.47
52.110.12.15
52.148.114.188
92.223.78.30
172.170.180.133
4.207.44.68
104.46.162.224

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report