MALICIOUS — 11b0ed1c6339e630e315ab7d87e6a05359fbac4a20ff5eb30882bf7fee4cbf30

MALICIOUS — 11b0ed1c6339e630e315ab7d87e6a05359fbac4a20ff5eb30882bf7fee4cbf30 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the Obfus family. 3 of 53 detection engines flagged it.

Identification

• SHA-256: 11b0ed1c6339e630e315ab7d87e6a05359fbac4a20ff5eb30882bf7fee4cbf30
• SHA-1: 2ebffe09db34df6ab3bf3014cce36fbc4dedfb92
• MD5: a3b7eb5b446426dd3ad026b730f247c6
• ssdeep: 768:DkPBy2lsFTXGRSNwDYawM2aOWxym21pTW:cBy2cTXGR7Yap2kc1pTW
• TLSH: T1C53293281BF065CFCBD105969008995898D1FEBB5921F2A7872DCF0F644CBB1E4F80A6
• Submitted as: 11b0ed1c6339e630e315ab7d87e6a05359fbac4a20ff5eb30882bf7fee4cbf30
• File type: html · Size: 45020 bytes
• Verdict: malicious (93/100) · Family: Obfus

Detections (3 of 53 engines)

• ClamAV (daily): Js.Trojan.Obfus-633
• Microsoft Defender: Trojan:JS/HideLink.A
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 93/100 is the fusion of 3 weighted signals:

• ClamAV (daily) flagged Js.Trojan.Obfus-633 (rule Js.Trojan.Obfus-633) - engine signal, weight 0.90, confidence 0.95
• Obfuscated javascript script: dynamic-exec (layers: base64) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: http://www.raffaellabrutto.com/news-2009/cdm-snowboard-raffaella-brutto-6a-a-la-molina-spagna.html, http://www.raffaellabrutto.com/plugins/content/rokcomments/rokcomments.css, http://www.raffaellabrutto.com/modules/mod_itpsocialbuttons/style.css - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd
• http://www.w3.org/1999/xhtml
• http://www.raffaellabrutto.com/news-2009/cdm-snowboard-raffaella-brutto-6a-a-la-molina-spagna.html
• http://www.raffaellabrutto.com/plugins/content/rokcomments/rokcomments.css
• http://www.raffaellabrutto.com/modules/mod_itpsocialbuttons/style.css
• http://platform.twitter.com/widgets.js
• http://www.google.com/jsapi?key=ABQIAAAAiIITlt7nzR969Jnc9B0zLhTFpL4t48a98EQz7iR4kesTqVC0shS4OACLzcD_mMkBRgTym6xKtgAWSQ
• http://www.raffaellabrutto.com/index.php?option=com_search&amp
• http://www.raffaellabrutto.com/
• http://www.raffaellabrutto.com/images/stories/news/asiva.gif
• http://www.raffaellabrutto.com/News-2009/cdm-snowboard-raffaella-brutto-6a-a-la-molina-spagna.html
• http://www.raffaellabrutto.com/news-2009/cdm-snowboard-raffaella-brutto-6a-a-la-molina-spagna.html?option=com_content&amp
• http://translate.google.com/translate_p?client=tmpg&hl=en&langpair=
• http://www.fisi.org/node/32461
• http://www.fis-ski.com/uk/604/613.html?sector=SB&amp
• http://it.wikipedia.org/wiki/Raffaella_Brutto
• http://www.facebook.com/pages/Raffaella-Brutto/80770176562
• http://www.facebook.com/raffaellabrutto
• https://twitter.com/raffaellabrutto
• http://www.raffaellabrutto.it/go.htm
• http://www.wintersport-news.it/it_IT/home/Road_to_Sochi
• http://www.asiva.it/articolo_1_0_4709.aspx
• http://twitter.com/share
• https://apis.google.com/js/plusone.js
• http://www.facebook.com/sharer.php?u=http://www.raffaellabrutto.com/News-2009/cdm-snowboard-raffaella-brutto-6a-a-la-molina-spagna.html&amp

Embedded domains

• www.w3.org
• www.raffaellabrutto.com
• platform.twitter.com
• www.google.com
• connect.facebook.net
• translate.google.com
• www.fisi.org
• www.fis-ski.com
• it.wikipedia.org
• www.facebook.com
• twitter.com
• www.raffaellabrutto.it
• www.wintersport-news.it
• www.asiva.it
• apis.google.com
• static.ak.fbcdn.net
• widgets.twimg.com
• www.plimun.com
• www.regione.vda.it
• www.sportmilitarealpino.it
• www.saliceocchiali.it
• www.levelgloves.com
• stores.ebay.it
• www.shinystat.com
• del.icio.us

More Obfus samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report