YARAhub by abuse.ch Detect files is `SliverFox` malware
Verdictmalware
Severitymedium
WEBSITE ANALYSIS REPORT
https://1drv.ms/b/c/7188d38ff278e424/IQBN8wx3S6ELRJpAO7fWPVhJAeSinLHKtu9i62xIzAdArJs?e=z9OTq5
public
Report summary
Submitted and final observations · captured HTTP activity
- Submitted URL
- https://1drv.ms/b/c/7188d38ff278e424/IQBN8wx3S6ELRJpAO7fWPVhJAeSinLHKtu9i62xIzAdArJs?e=z9OTq5
- Submitted IP / ASN
150.171.22.11 AS8075 · Microsoft Corporation
- Final URL
- https://onedrive.live.com/?id=%2Fpersonal%2F7188d38ff278e424%2FDocuments%2FGroupe%20Sclavo%20Commande%20N%C2%B0%20800655122%2Epdf&listurl=%2Fpersonal%2F7188d38ff278e424%2FDocuments&ithint=file%2Cpdf&e=z9OTq5&migratedtospo=true&parent=%2Fpersonal%2F7188d38ff278e424%2FDocuments&redeem=aHR0cHM6Ly8xZHJ2Lm1zL2IvYy83MTg4ZDM4ZmYyNzhlNDI0L0lRQk44d3gzUzZFTFJKcEFPN2ZXUFZoSkFlU2luTEhLdHU5aTYyeEl6QWRBckpzP2U9ejlPVHE1&ga=1
- Final IP / ASN
- 13.107.139.11 AS8068 · MICROSOFT-CORP-MSN-AS-BLOCK
Final page
- Page title
- Groupe Sclavo Commande N° 800655122.pdf
- Final DOM MIME
- text/html; charset=utf-8
- Final DOM size
- 943.3 KB (965950 bytes)
Detections
Activity
- HTTP requests
- 152
- Observed hosts
- 8
- Script records
- 438
Estimated HTTP data
- Sent
- ~372.4 KB
- Received
- ~21.64 MB
Page capture
Final browser state
Detection signals
URLQuery findings, Threat Detection Systems, and IDS alerts
Threat Detection Systems
1Host infrastructure
Observed hosts are context, not independent maliciousness verdicts
| Host | Rank | Registered | First seen | Last seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
| onedrive.live.com | 5215 | 1994-12-28 | 2014-02-19 | 2026-10-14 | 33.7 KB | 1.08 MB | 13.107.139.11 | Microsoft SharePoint:16.0.0.27730 CMS SharePoint is a cloud-based collaborative platform to manage and share content. HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. Microsoft ASP.NET:4.0.30319 Web frameworks ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages. Microsoft ASP.NET Web frameworks ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages. |
| res-1.cdn.office.net 1 alerts | 990 | 1994-11-14 | 2020-12-08 | 2026-10-08 | 5.0 KB | 1.33 MB |  23.36.76.128 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| ecs.office.com | 69 | 1999-04-20 | 2020-01-24 | 2026-10-08 | 1.4 KB | 2.9 KB | 52.123.128.14 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| 1drv.ms | 4331 | 2013-08-28 | 2016-02-29 | 2026-10-08 | 553 B | 743 B | 150.171.22.11 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| browser.events.data.microsoft.com | 380 | 1991-05-02 | 2018-05-25 | 2026-10-09 | 4.7 KB | 603 B | Not recorded | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. Microsoft HTTPAPI:2.0 Web servers Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security. |
| login.live.com | 179 | 1994-12-28 | 2012-05-21 | 2026-10-09 | 830 B | 0 B | Not recorded | |
| storage.live.com | 448 | 1994-12-28 | 2012-06-20 | 2026-10-08 | 636 B | 891 B | 168.62.216.242 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. Microsoft HTTPAPI:2.0 Web servers Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security. |
| res.public.onecdn.static.microsoft | 930 | 2023-05-05 | 2024-03-21 | 2026-10-12 | 61.3 KB | 19.23 MB | 23.36.76.115 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. WebAssembly Programming languages WebAssembly (abbreviated Wasm) is a binary instruction format for a stack-based virtual machine. Wasm is designed as a portable compilation target for programming languages, enabling deployment on the web for client and server applications. |