SUSPICIOUS — custom-element-template.js

SUSPICIOUS — custom-element-template.js is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (61/100). 0 of 53 detection engines flagged it.

Identification

SHA-256: fb3db0ebf5867a685ac255380bdecee28f524990cde2bfcfc12105228438c333
SHA-1: 295e9b565a5a6778bfa2aadfe7b971c3c25cd2a0
MD5: d8a13539b57d987600957f4ac0a6c076
ssdeep: 48:1Onx9tUrA6z8dgqUsxfuprsiXhSX5FFyZGW8mCya24OMp3lBH:Qt+kg3s5upTopUCysfpL
TLSH: T1E5148C553275EDCF8B730EF6D4C5071E449220E2CD810168561CD2C1FA36D3CAA2C69D
Submitted as: custom-element-template.js
File type: script · Size: 1899 bytes
Verdict: suspicious (61/100)

Detections (0 of 53 engines)

No engine flagged this sample.

Why this verdict

The suspicious score of 61/100 is the fusion of 3 weighted signals:

Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 30 external host(s) and 30 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

277 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787944054&P2=404&P3=2&P4=dxvTRbK3Sy0U3psEkm68pFVXiqO81P5ayn40EzB7WsYPux6HVaBwdXvjBqZZyQCxVPi1N2frSmufRNqsSCfyiQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787944085&P2=404&P3=2&P4=DTKGB15Ou3emI8SGs09hKD1iudiqx2AcZmDVobKDI%2bjem6ERCLiD7ieXgRWpYD7XABPS1MwlUoxS33hWRUDcpQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787340849&P2=404&P3=2&P4=aZTPhH0fEC0nd7c59zATQA3bycWhrT%2fReDdB%2fLSmWF%2bSkDlWfQx%2bmsI2vgGk8sbCNXjiB2KN8cmpr8IhX8F%2fbA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787340398&P2=404&P3=2&P4=GQGLWeVPDQkfEtxGqxwG8vmT0LQd67rORA0UoVM5ZC6G28Grw2PQbcfLfoSwFVap1hYCjsI4enXp7q4rUszzZw%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

baidu.com

Embedded IP addresses

4.150.223.101
52.123.252.192
20.247.185.124
4.230.171.124
20.42.179.204
74.178.76.128
57.154.63.210
20.165.94.54
4.150.223.106
20.231.239.246
52.123.128.14
52.123.129.14
52.123.252.242
51.104.15.252
4.207.44.67
203.26.79.13
52.123.252.229
20.165.94.46
135.234.160.245
52.148.114.188
72.145.35.110
135.232.92.137
135.234.160.246
20.89.1.10
48.192.143.121

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report