SUSPICIOUS — 11b6dd65b74539c2602d346ea7f3aefb583989270a1507872fca1451cbbdb20f

SUSPICIOUS — 11b6dd65b74539c2602d346ea7f3aefb583989270a1507872fca1451cbbdb20f is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 11b6dd65b74539c2602d346ea7f3aefb583989270a1507872fca1451cbbdb20f
• SHA-1: 85d9e71dfe2b1d7726539286e8c99ea90e2981eb
• MD5: c52ea908bafa5d0b98eff442a3896fa9
• ssdeep: 1536:/m2tobDeCB2NTR7jRD5qnnm6kBgOY2n3CZbZP0JwZx2BVM:ubbDeCsNTR7jRD5qnm6kuYnSZbZsJPBW
• TLSH: T18437C537321A3ADF0490A92799984B99D0C59BCBEA3344B4D2E7EA44ED24E703C1D947
• Submitted as: 11b6dd65b74539c2602d346ea7f3aefb583989270a1507872fca1451cbbdb20f
• File type: html · Size: 71048 bytes
• Verdict: suspicious (54/100)

Detections (2 of 53 engines)

• Microsoft Defender: TrojanClicker:JS/Faceliker.N
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/204402360-widget_css_bundle.css, http://fonts.googleapis.com/css?family=Play, http://fonts.googleapis.com/css?family=Lobster - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/204402360-widget_css_bundle.css
• http://fonts.googleapis.com/css?family=Play
• http://fonts.googleapis.com/css?family=Lobster
• http://fonts.googleapis.com/css?family=Shadows+Into+Light
• http://fonts.googleapis.com/css?family=Droid+Sans:bold
• http://fonts.googleapis.com/css?family=Droid+Serif:bold
• http://fonts.googleapis.com/css?family=Raleway:100
• http://dailygamenewshere.blogspot.com/favicon.ico
• http://dailygamenewshere.blogspot.com/2012/01/scarygirl-announcement-trailer.html
• http://dailygamenewshere.blogspot.com/feeds/posts/default
• http://dailygamenewshere.blogspot.com/feeds/posts/default?alt=rss
• https://draft.blogger.com/feeds/820309436066365949/posts/default
• http://dailygamenewshere.blogspot.com/feeds/1054851093237481700/comments/default
• https://i.ytimg.com/vi/BMFVRTbM3UQ/hqdefault.jpg
• https://lh3.googleusercontent.com/proxy/3isMNr7H0iD5AR398XtW0rH2KSqk8QgYElEbraEGbUuFPxLk3kQsSZ4_6XufCFFDH3yBC9rDUFQZ52wgYGmd0JsXRT0=w1200-h630-n-k-no-nu
• http://creativecommons.org/licenses/by/3.0
• http://3.bp.blogspot.com/-n__hhKZzYD8/TuX5cBhzA-I/AAAAAAAAByI/X8taZqBHJjc/s1600/wrapper.png
• http://2.bp.blogspot.com/_Ax-O2ayi6kU/TUV8EMX-UTI/AAAAAAAABWE/sPzPhAKq9AY/s1600/search.png
• http://2.bp.blogspot.com/_8GxSJXcDIwk/TBM41zdJRTI/AAAAAAAABp0/Y-bxfWbuf8s/s1600/1276328132_date.png
• http://3.bp.blogspot.com/_8GxSJXcDIwk/TBNBFo0rK-I/AAAAAAAABq8/VO_ATeuF6sM/s1600/aaa.png
• http://2.bp.blogspot.com/_8GxSJXcDIwk/TBM6sX5_MNI/AAAAAAAABp8/2RwKjFNZjcQ/s1600/1276328597_comment.png

Embedded domains

• www.w3.org
• www.google.com
• www.blogger.com
• fonts.googleapis.com
• dailygamenewshere.blogspot.com
• draft.blogger.com
• i.ytimg.com
• www.scarygirlgame.com
• lh3.googleusercontent.com
• fonts.gstatic.com
• www.deluxetemplates.net
• creativecommons.org
• 3.bp.blogspot.com
• 2.bp.blogspot.com
• 4.bp.blogspot.com
• 1.bp.blogspot.com
• ajax.googleapis.com
• www.serie3.info
• www.perspectived.com
• adf.ly
• example.com
• yoursite.com
• blogspot.com
• apis.google.com
• pagead2.googlesyndication.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report