SUSPICIOUS — 0b2cb9131056cba3149b8b37baa44084504864b8a4bb8b403e4ab24c32df8d43
SUSPICIOUS — 0b2cb9131056cba3149b8b37baa44084504864b8a4bb8b403e4ab24c32df8d43 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 0 of 53 detection engines flagged it.
Identification
- SHA-256:
0b2cb9131056cba3149b8b37baa44084504864b8a4bb8b403e4ab24c32df8d43 - SHA-1:
a054dc963c20f5583e74273abcb5c65dba34a8fa - MD5:
4facf39091abb919105f2a15b350ec2d - ssdeep:
1536:seFDjiTqADyMSwp34oRYpPazHiqYyHTZBenUZAzG8L5fKvrCUd26wyliR+GO8sd9:VFDjiFSzexBenUZAzG8L5fKvrC/yliR+ - TLSH:
T100385110F7F796A589C81892B944495884D9BE4F2C31B0EA872DCF4B542CFA1B4F439B - Submitted as: 0b2cb9131056cba3149b8b37baa44084504864b8a4bb8b403e4ab24c32df8d43
- File type: html · Size: 79923 bytes
- Verdict: suspicious (54/100)
Detections (0 of 53 engines)
No engine flagged this sample.
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated powershell script: dynamic-exec, defense-evasion (layers: base64) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: http://gmpg.org/xfn/11, https://wantedtransformation.ro/wp-content/themes/wanted/style.css, https://wantedtransformation.ro/xmlrpc.php - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://gmpg.org/xfn/11
- https://wantedtransformation.ro/wp-content/themes/wanted/style.css
- https://wantedtransformation.ro/xmlrpc.php
- https://wantedtransformation.ro/wp-content/themes/alyeska/framework/frontend/assets/js/html5.js
- https://wantedtransformation.ro/feed/
- https://wantedtransformation.ro/comments/feed/
- https://wantedtransformation.ro/wp-includes/css/dist/block-library/style.min.css?ver=5.8.2
- https://wantedtransformation.ro/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.5.2
- https://wantedtransformation.ro/wp-content/themes/alyeska/framework/frontend/assets/plugins/prettyphoto/css/prettyPhoto.css?ver=5.8.2
- https://wantedtransformation.ro/wp-content/themes/alyeska/framework/frontend/assets/css/plugins.css?ver=5.8.2
- https://wantedtransformation.ro/wp-content/themes/alyeska/framework/frontend/assets/css/themeblvd.css?ver=5.8.2
- https://wantedtransformation.ro/wp-content/themes/alyeska/assets/css/nav.min.css?ver=1.0
- https://wantedtransformation.ro/wp-content/themes/alyeska/assets/css/theme.min.css?ver=1.0
- https://wantedtransformation.ro/wp-content/themes/alyeska/assets/css/menus.min.css?ver=1.0
- https://wantedtransformation.ro/wp-content/themes/alyeska/assets/css/shape/stretch-light.min.css?ver=1.0
- https://wantedtransformation.ro/wp-content/themes/alyeska/assets/css/style/light.min.css?ver=1.0
- https://wantedtransformation.ro/wp-content/themes/alyeska/assets/css/ie.css?ver=1.0
- https://wantedtransformation.ro/wp-content/themes/alyeska/assets/css/responsive.min.css?ver=1.0
- https://ajax.googleapis.com/ajax/libs/jquery/1.7/jquery.min.js?ver=5.8.2
- https://wantedtransformation.ro/wp-content/themes/alyeska/framework/frontend/assets/plugins/prettyphoto/js/jquery.prettyPhoto.js?ver=3.1.3
- https://wantedtransformation.ro/wp-content/themes/alyeska/framework/frontend/assets/js/superfish.js?ver=1.4.8
- https://wantedtransformation.ro/wp-content/themes/alyeska/framework/frontend/assets/js/flexslider.js?ver=1.8
- https://wantedtransformation.ro/wp-content/themes/alyeska/framework/frontend/assets/js/roundabout.js?ver=1.1
- https://wantedtransformation.ro/wp-content/themes/alyeska/assets/js/alyeska.min.js?ver=1.0
- https://api.w.org/
Embedded domains
- gmpg.org
- ajax.googleapis.com
- s.w.org
- api.w.org
- fonts.googleapis.com
- google-analytics.com
- wantedtransformation.ro
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report