SUSPICIOUS — sweetalert2.all.min.js
SUSPICIOUS — sweetalert2.all.min.js is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (45/100). 0 of 50 detection engines flagged it.
Identification
- SHA-256:
0b7274b0b5b7f411de46416a6c9941062f7a57aaf919fdeda367b5959f4ce8ef - SHA-1:
341572abd41f0ca4ec64eb0d61dff2fa864bbece - MD5:
80924b62e5b3ac73aa4849776b439770 - ssdeep:
768:ffDhCNRo1S9FgTuuaJubBVuCsYGEgTvqARu1GMJ5348QuxuqAjlzVZg7VnThcccJ:fVCLp9FcdbW5JTyF1GMJ5oWyOZ9rw8O - TLSH:
T12937E9A3FD469F9BC8389D17ACDCA516373297C5BD5082F49388C680B894D909C9683F - Submitted as: sweetalert2.all.min.js
- File type: script · Size: 72765 bytes
- Verdict: suspicious (45/100)
Detections (0 of 50 engines)
No engine flagged this sample.
Why this verdict
The suspicious score of 45/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec, defense-evasion (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 4 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Dynamic analysis (linux)
1230 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- desktop-hsgcbep
- ntp.ubuntu.com
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 250.255.255.239.in-addr.arpa
- ff02::1:3
- 224.0.0.252
- 224.0.0.251
- ff02::fb
- 169.254.255.255
- 10.240.0.255
- 10.240.0.1
- 239.255.255.250
- ff02::16
- 224.0.0.22
- 185.125.190.58
- 185.125.190.57
- 255.255.255.255
Dropped files
- tmp_tmp.eGpLTiSjzO -
9529fa8e8fac5ba1a27bde68b38e84658a03086a5cbe1faec64dcb64d1d38998
Embedded URLs
- https://github.com/sweetalert2/sweetalert2/issues/new?template=02_feature_request.md
- https://github.com/sweetalert2/sweetalert2/wiki/Migration-from-SweetAlert-to-SweetAlert2#1-ie-support
Embedded domains
- document.body.style.top
- sweetalert2.github.io
- t.name
- o.name
- github.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report