MALICIOUS — 1bbbf2bf4f7428a3f42b85080d17a4841c0764a9a8489e84c359e3f83c46656f.bin

MALICIOUS — 1bbbf2bf4f7428a3f42b85080d17a4841c0764a9a8489e84c359e3f83c46656f.bin is a office-ooxml sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (85/100). 1 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 1bbbf2bf4f7428a3f42b85080d17a4841c0764a9a8489e84c359e3f83c46656f
• SHA-1: f941620064dbd2caed4c6109277d93b77fcbc078
• MD5: 753132dda2dd73491c0b881edaff00e8
• File type: office-ooxml · Size: 12742 bytes
• Verdict: malicious (85/100)

Source: MalShare · first seen 2026-08-05T16:24:17.871Z · SHA-256 verified

Detections (1 of 51 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob

MITRE ATT&CK

• T1112
• T1105

Dynamic analysis (windows)

1606 behavior events · 1 ATT&CK techniques · 26 dropped files.

Runtime network

• www.msftconnecttest.com
• inference.location.live.net
• 250.255.255.239.in-addr.arpa
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• desktop-hsgcbep
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• ntp.ubuntu.com
• http://www.msftconnecttest.com/connecttest.txt
• http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786552519&P2=404&P3=2&P4=AtlgxlW%2bEDPHEcpw4jzvfgY7%2be5F13JIjj4siCBhPld8oY738xlhWY1c%2btSQo1xX%2bh3K2zvWm1yaYPyEktf8eQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
• 192.168.122.107
• 23.40.52.85
• 20.190.167.149
• 52.178.17.234 NL · Amsterdam · AS8075 Microsoft Corporation
• 23.33.238.178
• 204.79.197.203
• 150.171.22.17
• 23.11.37.157

Dropped files

• /opt/CAPEv2/storage/analyses/13619/files/309397d13bd251edc2329238d5391d5113073b5550a8a795990e4f8f5f3e58e7 — 309397d13bd251edc2329238d5391d5113073b5550a8a795990e4f8f5f3e58e7
• root_.cache_dconf_user — 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
• root_.cache_mesa_shader_cache_index — 6d0552c4e71fe85e6cdc7e7745882ea91b382fbc56448f2e9e1c2d77dcf67d81
• root_.config_libreoffice_4_.lock — 58032b1f99ac5eb9668060553823540f479ade39d4127a44965c310095b934ae
• root_.config_libreoffice_4_user_GraphicsRenderTests.log — ca66014b962c5f87639d09e17a2dc07c7d1657c2f71a392b1d9bb67cd3a511d9
• root_.config_libreoffice_4_user_autotext_mytexts.bau — 951c8adf2ef8d3edeadb03b0c4374a2d75cf5fed945eeff259d33aa2e77acf7f
• root_.config_libreoffice_4_user_basic_Standard_Module1.xba — b434faf21386064e2e81af758f307ae8bea72c0cb6c8510d55b1bc1bb38f8612
• root_.config_libreoffice_4_user_basic_Standard_dialog.xlb — 85c83411f1285a0d0d9b511a7ea7dd06d5ac9b97f90d286adaca084212e3fe80
• root_.config_libreoffice_4_user_basic_Standard_script.xlb — 80cb10b100053f6e0b26bb009a2b8ccbdedb761901680500a4736f7afbf1f959
• root_.config_libreoffice_4_user_basic_dialog.xlc — 5b72c4cc5130eccab44cbfb91270befaeaf8ee7ab97cf205ee2abb582fa4a9e5
• root_.config_libreoffice_4_user_config_autotbl.fmt — 713229151490c66f043cb4865147c97458b4f33e4eb5f2bb4133c58cbe77041e
• root_.config_libreoffice_4_user_database_biblio.odb — c3dd4e9008be33cdede3abf822e9b748a201704adf95aad92ab894dd98b3fe85
• root_.config_libreoffice_4_user_database_biblio_biblio.dbf — aefc2bb614c2e307870405e0fd72f4a22cf794c396a73ce0551f18a478e80ed2
• root_.config_libreoffice_4_user_database_biblio_biblio.dbt — 3ab142231d8075fdd02c95a691ddce590e0f81450744cb87ca610fd06d75cac1
• root_.config_libreoffice_4_user_extensions_buildid — 4e80829cd1c13534fecb420763830c6a6fe6d9a8a463cefc817071e313bdc7bc

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786552519&P2=404&P3=2&P4=AtlgxlW%2bEDPHEcpw4jzvfgY7%2be5F13JIjj4siCBhPld8oY738xlhWY1c%2btSQo1xX%2bh3K2zvWm1yaYPyEktf8eQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

• 20.165.94.63
• 74.178.76.44
• 52.178.17.234
• 4.230.171.124
• 57.154.63.210
• 74.178.76.54
• 74.178.240.61
• 40.74.98.196
• 40.79.141.152
• 203.26.79.13
• 142.250.195.110

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report