SUSPICIOUS — 0e50d1cd1fcfd58c762767dcf94ff6fe06a1dcc02e84411f0fe3331e2ab22db7
SUSPICIOUS — 0e50d1cd1fcfd58c762767dcf94ff6fe06a1dcc02e84411f0fe3331e2ab22db7 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 50 detection engines flagged it.
Identification
- SHA-256:
0e50d1cd1fcfd58c762767dcf94ff6fe06a1dcc02e84411f0fe3331e2ab22db7 - SHA-1:
43f6ea1e2d158fe80bcf5292c53aee5f856ba288 - MD5:
f2471fb82d825b69719b30d7b2ac7862 - ssdeep:
1536:v2AH1+w/vqUoDKdkxg1akykwbpZTyrZBjpz+s91ztk1uexREd9qUcktPyUeSimJW:v2AHN1mxgcT7 - TLSH:
T13E3A6348F35360BF5ADE4234B0D4C83C548550F667EB4BAE9788D188684DCBA5D0E8AF - Submitted as: 0e50d1cd1fcfd58c762767dcf94ff6fe06a1dcc02e84411f0fe3331e2ab22db7
- File type: html · Size: 97083 bytes
- Verdict: suspicious (54/100)
Detections (1 of 50 engines)
- Microsoft Defender: Trojan:JS/Redirector.AYLB!MTB
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec, defense-evasion (layers: base64+char-code) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: http://gmpg.org/xfn/11, http://www.confindustriamoda.it/xmlrpc.php, https://www.googletagmanager.com/gtag/js?id=UA-106461011-1 - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://gmpg.org/xfn/11
- http://www.confindustriamoda.it/xmlrpc.php
- https://www.googletagmanager.com/gtag/js?id=UA-106461011-1
- http://www.confindustriamoda.it/wp-content/plugins/popup-builder/public/css/theme.css?ver=3.62.1
- https://cdnjs.cloudflare.com/ajax/libs/normalize/4.2.0/normalize.min.css?ver=4.9.18
- http://www.confindustriamoda.it/wp-content/themes/confindustria-moda/css/index.css?ver=1531217180
- http://www.confindustriamoda.it/wp-content/themes/confindustria-moda/css/front-page.css?ver=1531217180
- http://www.confindustriamoda.it/wp-content/plugins/popup-builder/public/js/Popup.js?ver=3.62.1
- http://www.confindustriamoda.it/wp-content/plugins/popup-builder/public/js/PopupConfig.js?ver=3.62.1
- https://cdnjs.cloudflare.com/ajax/libs/jquery/3.1.0/jquery.min.js?ver=4.9.18
- http://www.confindustriamoda.it/wp-content/plugins/popup-builder/public/js/PopupBuilder.js?ver=3.62.1
- http://www.confindustriamoda.it/wp-content/themes/confindustria-moda/src/index.js?ver=1531142233
- http://www.confindustriamoda.it/wp-content/themes/confindustria-moda/legacy/legacy-index.js?ver=1531217180
- https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.7.1/slick.min.js?ver=4.9.18
- http://www.confindustriamoda.it/wp-content/themes/confindustria-moda/src/front-page.js?ver=1531142233
- http://www.confindustriamoda.it/wp-content/themes/confindustria-moda/legacy/legacy-front-page.js?ver=1531217180
- http://www.confindustriamoda.it/wp-content/themes/confindustria-moda/src/elements/modules/gallery.js?ver=1531142233
- https://api.w.org/
- http://www.confindustriamoda.it/wp-json/
- http://www.confindustriamoda.it/xmlrpc.php?rsd
- http://www.confindustriamoda.it/wp-includes/wlwmanifest.xml
- http://www.confindustriamoda.it/en/homepage/
- http://www.confindustriamoda.it/
- http://www.confindustriamoda.it/it/home/
- http://www.confindustriamoda.it/wp-content/uploads/2017/09/cropped-favicon-32x32.png
Embedded domains
- gmpg.org
- www.confindustriamoda.it
- cdn.iubenda.com
- www.googletagmanager.com
- cdnjs.cloudflare.com
- s.w.org
- api.w.org
- www.w3.org
- www.assocalzaturifici.it
- www.anfao.it
- www.aip.it
- assopellettieri.it
- www.sistemamodaitalia.it
- www.federorafi.it
- www.unic.it
- www.assopellettieri.it
- www.sistemamodaitalia.com
- www.milanounica.it
- themicam.com
- mipel.com
- www.theonemilano.com
- dateyewear.com
- www.themicam.com
- www.modamadeinitaly.eu
- www.italianshoes.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report