SUSPICIOUS — 11b12268b4bad9cc8303aa77e754999d1974b460697ef8f61f4664952d40feb1
SUSPICIOUS — 11b12268b4bad9cc8303aa77e754999d1974b460697ef8f61f4664952d40feb1 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 0 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
11b12268b4bad9cc8303aa77e754999d1974b460697ef8f61f4664952d40feb1 - SHA-1:
b28d17733a6667eedeec2878b9e28f270f51b297 - MD5:
a146454b1feb120be09e0fbbe5f092ac - ssdeep:
3072:sO9buKupNuQuruvlrJqMGE7+5/tnP7+l/tnUMx0Fgh9Gbjgbs9D:sO9btKNxYUlrJqMt7+5/tnP7+l/tnUMM - TLSH:
T1F83DB9694705BADF12804E1EB189B86E90D4C2FBE7BA11BDC5C49E0DF815FB0780AB45 - Submitted as: 11b12268b4bad9cc8303aa77e754999d1974b460697ef8f61f4664952d40feb1
- File type: html · Size: 135462 bytes
- Verdict: suspicious (54/100)
Detections (0 of 53 engines)
No engine flagged this sample.
MITRE ATT&CK
Why this verdict
The suspicious score of 54/100 is the fusion of 5 weighted signals:
- Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 31 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: http://rozblog.com/temp/rang/like.png, https://danlowdmosegiirani.rozblog.com/js/site.js?4, https://danlowdmosegiirani.rozblog.com/cat-i/52/page/2 - static signal, weight 0.35, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
275 behavior events · 1 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- officeclient.microsoft.com
- settings-win.data.microsoft.com
- www.bing.com
- licensing.mp.microsoft.com
- tas02.sls.update.microsoft.com
- v10.events.data.microsoft.com
Embedded URLs
- http://rozblog.com/temp/rang/like.png
- https://danlowdmosegiirani.rozblog.com/js/site.js?4
- https://danlowdmosegiirani.rozblog.com/cat-i/52/page/2
- https://danlowdmosegiirani.rozblog.com/
- https://danlowdmosegiirani.rozblog.com/cat-i/52
- http://www.rozblog.com/theme/rozblog_v4/favi1.ico
- http://rozblog.com/temp/pro/ads_468.jpg
- https://danlowdmosegiirani.rozblog.com/cat-i/1
- https://danlowdmosegiirani.rozblog.com/cat-i/2/mo2/
- https://danlowdmosegiirani.rozblog.com/cat-i/3/mo3/
- https://danlowdmosegiirani.rozblog.com/cat-i/4/MO4/
- https://danlowdmosegiirani.rozblog.com/cat-i/5/MO5/
- https://danlowdmosegiirani.rozblog.com/cat-i/6/mo6/
- https://danlowdmosegiirani.rozblog.com/cat-i/7/mo7/
- https://danlowdmosegiirani.rozblog.com/cat-i/8
- https://danlowdmosegiirani.rozblog.com/cat-i/9
- https://danlowdmosegiirani.rozblog.com/cat-i/10
- https://danlowdmosegiirani.rozblog.com/cat-i/11
- https://danlowdmosegiirani.rozblog.com/cat-i/12
- https://danlowdmosegiirani.rozblog.com/cat-i/13
- https://danlowdmosegiirani.rozblog.com/cat-i/14
- https://danlowdmosegiirani.rozblog.com/cat-i/15
- https://danlowdmosegiirani.rozblog.com/cat-i/16
- https://danlowdmosegiirani.rozblog.com/cat-i/17
- https://danlowdmosegiirani.rozblog.com/cat-i/18
Embedded domains
- rozblog.com
- danlowdmosegiirani.rozblog.com
- www.rozblog.com
- danlowdmosegiirani.rzb.ir
- irannaz.com
- gerivani.thestore.ir
- dl.vivamusic.ir
- aishic.com
- up.multijob.ir
- aishic.ir
- novinpc.ir
- elmag.ir
- alachigh4.rozblog.com
- www.kyanvar.com
- greatsoftware.mihanblog.com
- mystar721.mihanblog.com
- applephones.mihanblog.com
- rezanikjoo.mihanblog.com
- ebrahim12.mihanblog.com
- hesabdarei.ir
- perspolis-7.mihanblog.com
- liyana1128.mihanblog.com
- www.baghe-fadak.mihanblog.com
- mohammad716.mihanblog.com
- daftareomr.mihanblog.com
Embedded IP addresses
- 135.232.92.34
- 4.150.223.114
- 52.123.252.198
- 52.110.12.30
- 4.247.188.224
- 52.230.60.54
- 74.178.240.61
- 4.150.223.115
- 20.236.44.162
- 162.159.142.9
- 20.76.201.171
- 52.110.12.38
- 85.210.196.11
- 135.233.45.222
- 4.207.44.68
- 172.66.2.5
- 92.223.78.30
- 72.153.5.96
- 57.155.101.212
- 172.215.188.225
- 52.123.128.14
- 20.184.175.2
- 52.123.129.14
- 74.178.76.54
- 52.182.143.212
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report