SUSPICIOUS — 11b84f2268a79401d1587336aefd89dda050f4bbb8d951752febfb8ca5566319
SUSPICIOUS — 11b84f2268a79401d1587336aefd89dda050f4bbb8d951752febfb8ca5566319 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
11b84f2268a79401d1587336aefd89dda050f4bbb8d951752febfb8ca5566319 - SHA-1:
36ba258fefc0e90d0c2d743259107c00930e365a - MD5:
2869a9cc4b48202f279f58feaf6dec86 - ssdeep:
1536:nhJAg0mX+PzO4+MAuUfMYmJAzJSgm1WpYkCBloHcifl9CBloalk0SUrlElgZy/5H:hlZfZmJAzWMJ6bZzxfzQshKJpMs - TLSH:
T1A23C293AF0492E6F94A09521157C14B872CE86FBE9722DEEE7C1AD80CE1CC654C7C429 - Submitted as: 11b84f2268a79401d1587336aefd89dda050f4bbb8d951752febfb8ca5566319
- File type: html · Size: 117438 bytes
- Verdict: suspicious (54/100)
Detections (2 of 53 engines)
- Microsoft Defender: TrojanClicker:JS/Faceliker.D
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, https://lh4.googleusercontent.com/-LWNtQQZnBeA/Uxic9MC0zNI/AAAAAAAAC2Y/3Px55h_HkeI/s16-no/favicon-image.png, http://xzone.vn/App_Themes/Web/images/system/cute-icon.png?v=32 - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.facebook.com/2008/fbml
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- https://lh4.googleusercontent.com/-LWNtQQZnBeA/Uxic9MC0zNI/AAAAAAAAC2Y/3Px55h_HkeI/s16-no/favicon-image.png
- http://xzone.vn/App_Themes/Web/images/system/cute-icon.png?v=32
- http://i.imgur.com/eyzCxC7.jpg
- http://xzone.vn/App_Themes/Web/images/system/bgHeadTop2.png?v=32
- http://xzone.vn/App_Themes/Web/images/system/bgHeadTopButton.png?v=32
- http://xzone.vn/App_Themes/Web/images/system/transparent65.png?v=32
- http://xzone.vn/App_Themes/Web/images/system/bgNavtop.png?v=32
- http://xzone.vn/App_Themes/Web/images/system/transparent50.png?v=32
- http://xzone.vn/App_Themes/Web/images/system/bgContentMid.png?v=32
- http://xzone.vn/App_Themes/Web/images/system/bgTitleBlockMain.png?v=32
- http://xzone.vn/App_Themes/Web/images/system/bgBlockNew.png?v=32
- http://xzone.vn/App_Themes/Web/images/system/bgBlockMainRight.png?v=32
- http://xzone.vn/App_Themes/Web/images/system/bgRightMainTitle.png?v=32
- http://xzone.vn/App_Themes/Web/images/system/bgRightMainContent.png?v=32
- http://xzone.vn/App_Themes/Web/images/system/img-list.gif?v=32
- http://xzone.vn/App_Themes/Web/images/system/bgTitleSmallBlock.png?v=32
- http://xzone.vn/App_Themes/Web/images/system/line.png?v=32
- http://xzone.vn/App_Themes/Web/images/system/bgBlockNewHead.png?v=32
- http://data.xzone.vn//Upload/Event/259/Nam_2012/Thang_3/Ngay_30/video.png
Embedded domains
- www.w3.org
- www.google.com
- www.facebook.com
- www.blogger.com
- vitaminhanhphuc.com
- gmail.com
- lh4.googleusercontent.com
- djdownload.biz
- www.relax9x.com
- i.imgur.com
- lh5.googleusercontent.com
- 4.bp.blogspot.com
- lh6.ggpht.com
- www.vitaminhanhphuc.com
- d.link
- tcr.tynt.com
- baodatjsc.blogspot.com
- 3.bp.blogspot.com
- blogspot.com
- ajax.googleapis.com
- connect.facebook.net
- googledrive.com
- bit.ly
- 1.bp.blogspot.com
- lh3.googleusercontent.com
Embedded IP addresses
- 1.34.38.19
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report