MALICIOUS — 08715c8d2c783339e82133d2adb6ba6070f7e101bbc692ab5b7380adecc6447e
MALICIOUS — 08715c8d2c783339e82133d2adb6ba6070f7e101bbc692ab5b7380adecc6447e is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the ScrInject family. 1 of 54 detection engines flagged it.
Identification
- SHA-256:
08715c8d2c783339e82133d2adb6ba6070f7e101bbc692ab5b7380adecc6447e - SHA-1:
67abed3623834cc90e10ca2e482cd03aebb24952 - MD5:
d8dc429c59b64914f1fb736398ce09e8 - ssdeep:
12288:qohkS25wbkU1tDGAz0R3ZryyNeUT/dWdLwmTXdcx:PhkS25wbkU1tDGAz0R3ZryyNeUT/MXc - TLSH:
T18D4BD8252EDE8E9F88049250B98C836828B59DCFD4A434DEE6C9C4C6CC5CD70BE79479 - Submitted as: 08715c8d2c783339e82133d2adb6ba6070f7e101bbc692ab5b7380adecc6447e
- File type: html · Size: 477828 bytes
- Verdict: malicious (84/100) · Family: ScrInject
Detections (1 of 54 engines)
- Microsoft Defender: Trojan:HTML/ScrInject.YYF!MTB
Why this verdict
The malicious score of 84/100 is the fusion of 6 weighted signals:
- Microsoft Defender flagged Trojan:HTML/ScrInject.YYF!MTB (rule
Trojan:HTML/ScrInject.YYF!MTB) - engine signal, weight 0.55, confidence 0.85 - Obfuscated powershell script: dynamic-exec, defense-evasion (layers: base64) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: http://ogp.me/ns#, http://curatiohealthcare.com/wp-content/themes/curatio/img/favicon.png, https://yoast.com/wordpress/plugins/seo/ - static signal, weight 0.35, confidence 0.60
- Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
289 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
- licensing.mp.microsoft.com
- www.bing.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
Embedded URLs
- http://ogp.me/ns#
- http://curatiohealthcare.com/wp-content/themes/curatio/img/favicon.png
- https://yoast.com/wordpress/plugins/seo/
- https://curatiohealthcare.com/blog/
- https://curatiohealthcare.com/blog/page/2/
- https://schema.org
- https://curatiohealthcare.com/#organization
- https://curatiohealthcare.com/
- https://curatiohealthcare.com/#website
- https://curatiohealthcare.com/blog/#webpage
- https://fonts.gstatic.com
- http://curatiohealthcare.com/wp-content/plugins/contact-form-7/includes/css/../../images/ajax-loader.gif
- http://curatiohealthcare.com/wp-content/plugins/search-filter-pro2/public/assets/css/chosen-sprite.png
- http://curatiohealthcare.com/wp-content/plugins/search-filter-pro2/public/assets/css/chosen-sprite@2x.png
- http://curatiohealthcare.com/wp-content/plugins/search-filter-pro2/public/assets/css/../img/ui-icons_ffffff_256x240.png
- http://www.w3.org/2000/svg
- http://curatiohealthcare.com/wp-content/themes/curatio/css/../fonts/fontawesome-webfont.eot?v=4.7.0
- http://curatiohealthcare.com/wp-content/themes/curatio/css/../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0
- http://curatiohealthcare.com/wp-content/themes/curatio/css/../fonts/fontawesome-webfont.woff2?v=4.7.0
- http://curatiohealthcare.com/wp-content/themes/curatio/css/../fonts/fontawesome-webfont.woff?v=4.7.0
- http://curatiohealthcare.com/wp-content/themes/curatio/css/../fonts/fontawesome-webfont.ttf?v=4.7.0
- http://curatiohealthcare.com/wp-content/themes/curatio/css/../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular
- http://curatiohealthcare.com/wp-content/themes/curatio/css/../fonts/Avenir-Medium.eot
- http://curatiohealthcare.com/wp-content/themes/curatio/css/../fonts/Avenir-Medium.eot?#iefix
- http://curatiohealthcare.com/wp-content/themes/curatio/css/../fonts/Avenir-Medium.woff2
Embedded domains
- ogp.me
- curatiohealthcare.com
- yoast.com
- schema.org
- fonts.gstatic.com
- li.no
- www.w3.org
- li.name
- face-bg.space
- child-bg.space
- www.googletagmanager.com
- www.facebook.com
- www.linkedin.com
- www.youtube.com
- instagram.com
- www.google.com
- product.link
- term.0.0.name
- post.link
- developer.mozilla.org
- developers.google.com
- botbuilder.engagely.ai
- wa.me
- wp-rocket.me
- www.hostingcloud.racing
Embedded IP addresses
- 4.150.223.101
- 4.230.171.124
- 20.42.179.192
- 20.247.185.124
- 74.178.76.54
- 74.179.77.204
- 4.207.44.66
- 135.233.95.144
- 72.153.5.60
- 52.148.114.188
- 52.110.12.18
- 52.110.12.51
More ScrInject samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report