SUSPICIOUS — extension.js

SUSPICIOUS — extension.js is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (61/100). 0 of 53 detection engines flagged it.

Identification

SHA-256: fafa4a2121c7638aa42be5ff7298366f6aefcac4e4c10c57b9487108c763c304
SHA-1: 2e944f1a9d77b7f59282ec9e4cbf925e7c992c79
MD5: c5a1a930934d32f9ea4a32a3e1a564b8
ssdeep: 24:+yUVBg3J74cB9LDqqIeTWbJmvi7h3I82VxtWy7sO5ZFWFX5XH/8Ldz:+yUV+J8cHLDqqNSbJYYB2VUkQXERz
TLSH: T1DB14D37A33E978DF6A550CE9674B081ED4E313D9A88206CBD8095D483D23C6452853AB
Submitted as: extension.js
File type: script · Size: 1550 bytes
Verdict: suspicious (61/100)

Detections (0 of 53 engines)

No engine flagged this sample.

Why this verdict

The suspicious score of 61/100 is the fusion of 3 weighted signals:

Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 33 external host(s) and 28 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

278 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787944023&P2=404&P3=2&P4=B8LqJTMwfXtkJ3ZKqs%2bJTNZgb1dbruN%2baxOc3u0iPolHY%2fJ%2ffw7mdCytKz71%2b%2bxGYUFD16h7afF0nxan2zvsug%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787944071&P2=404&P3=2&P4=JjKaVMy1f4uEylwvLakxkvMF6emD1IY465EpJ7d4A4eWxU9R0%2b0gjMpkJFrncQnw2PLbTNSH2KXrKPJC1GNrow%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787340764&P2=404&P3=2&P4=WC8uWaqvuy1cIJLv2fZRUcuc%2fMuAw9Aj3BPv9jOgFyiCTexSIZ4Yd4%2bLDXv0k8n7Yci%2brvFazVuAlVjMTYhh8A%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787340298&P2=404&P3=2&P4=CCgyhRhe7v9NN0oUnSdxg%2foCcHLtcx980W3g2stvcecM%2b9ljYzZcTDhS1MqAu%2buBJ7eAz3veVtTKPT8LXIO8VQ%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

52.110.12.30
52.110.12.4
51.116.246.106
4.230.171.124
4.247.188.224
52.230.59.222
74.178.76.128
20.165.94.54
4.150.223.101
52.123.252.192
20.165.94.46
20.231.239.246
52.123.129.14
52.123.128.14
203.26.79.13
52.123.252.233
4.150.223.106
52.123.252.240
135.234.160.245
52.123.252.229
52.123.252.236
52.148.114.188
4.150.223.114
13.69.116.107
72.145.35.110

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report