MALICIOUS — 099aaf3a64c5e360df64dafc4dce4824339d06985b1c0578eed009f25dae7403

MALICIOUS — 099aaf3a64c5e360df64dafc4dce4824339d06985b1c0578eed009f25dae7403 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (70/100). 0 of 54 detection engines flagged it.

Identification

• SHA-256: 099aaf3a64c5e360df64dafc4dce4824339d06985b1c0578eed009f25dae7403
• SHA-1: 9d4dc446bc50bd8e9be08e2940574c91c14733c2
• MD5: f9b7a4839aba68b8eec4d8c4e7af7fed
• ssdeep: 768:gayHHvPWlxBZMEYD34VNZ5WZ9ZVSWlA1nW5loakM0jQ95N32mH:g3HH2lxBZMfD34DZ509ZvunWrzkEvNf
• TLSH: T1A637632A7B537B8724C09016E69C4ED6A0C4D29BBB3381B5E366FB44883DC74982DC57
• Submitted as: 099aaf3a64c5e360df64dafc4dce4824339d06985b1c0578eed009f25dae7403
• File type: html · Size: 72853 bytes
• Verdict: malicious (70/100)

Detections (0 of 54 engines)

No engine flagged this sample.

Why this verdict

The malicious score of 70/100 is the fusion of 5 weighted signals:

• Obfuscated powershell script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Contacted 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css, http://dieshellsuitdie.blogspot.com/favicon.ico, http://dieshellsuitdie.blogspot.com/feeds/posts/default - static signal, weight 0.35, confidence 0.60
• Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
• Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

280 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• ctldl.windowsupdate.com
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• officeclient.microsoft.com
• www.msn.com
• odc.officeapps.live.com
• licensing.mp.microsoft.com
• settings-win.data.microsoft.com
• assets.msn.com
• www.bing.com
• fe3cr.delivery.mp.microsoft.com
• slscr.update.microsoft.com

Dropped files

• 01fd5e97161babbad499bc595d450f35200680b8b3e8aa13d38864a1f20706f6 - 01fd5e97161babbad499bc595d450f35200680b8b3e8aa13d38864a1f20706f6

Embedded URLs

• https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css
• http://dieshellsuitdie.blogspot.com/favicon.ico
• http://dieshellsuitdie.blogspot.com/2008/06/review-infadels-free-things-for-poor.html
• http://dieshellsuitdie.blogspot.com/feeds/posts/default
• http://dieshellsuitdie.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/7494302025711624539/posts/default
• http://dieshellsuitdie.blogspot.com/feeds/2101998328416999056/comments/default
• https://www.blogger.com/static/v1/jsbin/403901366-ieretrofit.js
• http://www.dieshellsuit.co.uk/uploads/infadels-freethingsforpoorpeople-cd.jpg
• http://www.pingadw.com/b.js&gt
• https://lh6.googleusercontent.com/proxy/zTX1FPk6mqcEvvqRw6ixTvs13f2-bHcFq12dfgGUOBESrOyx0NjcukeBbFlWxPQconhKSbYEmOC7diSOJKQV6QDNGCVz6LEhP1M-DVC9q2ojGKGnk3QfHJkvKPQHikO4Ng=w1200-h630-p-k-no-nu
• https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.png
• https://resources.blogblog.com/blogblog/data/1kt/simple/gradients_light.png
• https://www.blogger.com/dyn-css/authorization.css?targetBlogID=7494302025711624539&amp
• https://www.blogger.com/go/adspersonalization
• https://apis.google.com/js/plusone.js
• http://dieshellsuitdie.blogspot.com/
• http://schema.org/BlogPosting
• http://www.pingadw.com/b.js
• http://www.dieshellsuit.co.uk/article_detail.asp?rID=2596
• http://schema.org/Person
• https://www.blogger.com/profile/01669127553800934341
• https://www.blogger.com/email-post.g?blogID=7494302025711624539&postID=2101998328416999056
• https://resources.blogblog.com/img/icon18_email.gif
• https://www.blogger.com/post-edit.g?blogID=7494302025711624539&postID=2101998328416999056&from=pencil

Embedded domains

• www.blogger.com
• dieshellsuitdie.blogspot.com
• www.dieshellsuit.co.uk
• www.pingadw.com
• lh6.googleusercontent.com
• resources.blogblog.com
• blogspot.com
• apis.google.com
• pagead2.googlesyndication.com
• schema.org
• www.myspace.com
• www.assoc-amazon.co.uk
• www.netvibes.com
• add.my.yahoo.com
• www.blogblog.com

Embedded IP addresses

• 52.168.117.174
• 52.123.252.242
• 4.230.171.124
• 20.247.184.197
• 48.211.4.16
• 172.215.188.225
• 135.233.95.135
• 20.165.94.63
• 40.79.167.9
• 52.168.117.168
• 40.84.97.4
• 72.153.5.60
• 85.210.193.152
• 52.148.114.188
• 52.110.12.28
• 52.110.12.30

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report