MALICIOUS — fb977e876c48dbfd68168029a68182013dba924c4e7af354af0dabdd8b1cc37f
MALICIOUS — fb977e876c48dbfd68168029a68182013dba924c4e7af354af0dabdd8b1cc37f is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100), attributed to the Office365 family. 2 of 53 detection engines flagged it.
Identification
- SHA-256:
fb977e876c48dbfd68168029a68182013dba924c4e7af354af0dabdd8b1cc37f - SHA-1:
c0ba7b55d3eaa8da08056c14d772b62cdd0de3b6 - MD5:
6fa31786b0f8c1aab1417375bd6c285c - ssdeep:
768:2/xx0Ur2CdFgSr58eNB9+DWCYaPTIgI5ra2dkZ7jCirVQg09V71JCj0:2Bc+DdkZ7eixQt77f1 - TLSH:
T1222F18BA38AE7CEFC84D4C0B1E5855AA9B06E5DEA5A074E4E3C84F442063D81EC1855F - Submitted as: fb977e876c48dbfd68168029a68182013dba924c4e7af354af0dabdd8b1cc37f
- File type: html · Size: 35611 bytes
- Verdict: malicious (88/100) · Family: Office365
Detections (2 of 53 engines)
- YARA: PhishingKit (t4d): PK_Office365_Login_Clone
- Emsisoft (Emergency Kit): Trojan.HTML.Phishing.BUG
Why this verdict
The malicious score of 88/100 is the fusion of 6 weighted signals:
- Memory forensics: 4 finding(s), e.g. process hidden from a listing (rule
windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 30 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
- YARA: PhishingKit (t4d) flagged PK_Office365_Login_Clone (rule
PK_Office365_Login_Clone) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://aadcdn.msftauth.net, https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupa, https://aadcdn.msftauth.net/shared/1.0/content/images/def - static signal, weight 0.35, confidence 0.60
- Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
278 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- settings-win.data.microsoft.com
Embedded URLs
- http://www.w3.org/TR/html4/strict.dtd
- https://aadcdn.msftauth.net
- https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupa
- https://aadcdn.msftauth.net/shared/1.0/content/images/def
- https://aadcdn.msftauth.net/ests/2.1/content/images/w
- https://aadcdn.msftauth.net/ests/2.1/content/images/personal
- https://aadcdn.msftauth.net/ests/2.1/content/images/
- https://login.microsoftonline.com/common/uxlogout
- https://login.microsoftonline.com/forgetuser
- https://autologon.mic
- https://autologon.microsoftazurea
- https://autologon.microsoftazu
- https://login.microsoftonline.com/common/instrumentation/repo
- https://login.microsoftonline.com/common/instrum
- https://go.microsoft.com/fwlink/p
- https://login.live.com/Me.srf
- https://login.live.com/oauth20_authori
- https://account.live.com/pas
- https://account.microsoft.com
- http://windows.microsoft.com/en-US/windows-live/sign-in-single-
- https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/log
- https://www.microsoft.com/en-
- https://privacy.microsoft.com/en-
- https://aadcdn.msftauth.net/est
- https://aadcdn.msftauth.net/ests/2.1/content/c
Embedded domains
- www.w3.org
- aadcdn.msftauth.net
- aadcdn.msauth.net
- live.com
- login.microsoftonline.com
- rosoftazuread-sso.com
- d-sso.com
- read-sso.com
- tologon.microsoftazuread-sso.com
- example.com
- example.onmicrosoft.com
- go.microsoft.com
- login.live.com
- account.live.com
- account.microsoft.com
- windows.microsoft.com
- www.microsoft.com
- privacy.microsoft.com
- www.office.com
- outlook.office365.com
- webshell.suite.office.com
- n.name
- t.co
- autologon.mic
- autologon.microsoftazurea
Embedded IP addresses
- 13.89.179.12
- 52.123.252.204
- 48.211.4.16
- 4.230.171.124
- 52.253.84.76
- 57.154.63.210
- 74.178.76.128
- 4.150.223.101
- 74.179.77.164
- 20.165.94.63
- 20.112.250.133
- 52.123.129.14
- 40.99.134.2
- 52.123.128.14
- 52.123.252.195
- 203.26.79.13
- 135.234.160.244
- 52.123.252.248
- 135.232.92.34
- 92.223.78.30
- 20.184.175.16
- 4.150.223.110
- 52.148.114.188
- 48.199.12.1
- 52.178.17.2
More Office365 samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report