MALICIOUS — 11b91c67e35640a4123fded0e29e996e7f9d78371625d520624d2bc52b87bdc3

MALICIOUS — 11b91c67e35640a4123fded0e29e996e7f9d78371625d520624d2bc52b87bdc3 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the Autolike family. 3 of 53 detection engines flagged it.

Identification

• SHA-256: 11b91c67e35640a4123fded0e29e996e7f9d78371625d520624d2bc52b87bdc3
• SHA-1: 2b50472ea77cde38c1620234079e8e53cdc1e77a
• MD5: e81f1f279b9b355286a6a2fadc862dad
• ssdeep: 1536:wbzrHoEwNVtL11FTTg/s4k4D0bUwHmE4UE+Btn:wi7th1FTTg5k4D0bUwHmE4UE+Btn
• TLSH: T1FF39955F3A72768B04E08416B5AC8AE550C6C273A92392F4F376EF48D13CDB0D949C66
• Submitted as: 11b91c67e35640a4123fded0e29e996e7f9d78371625d520624d2bc52b87bdc3
• File type: html · Size: 89658 bytes
• Verdict: malicious (93/100) · Family: Autolike

Detections (3 of 53 engines)

• ClamAV (daily): Js.Malware.Autolike-1
• Microsoft Defender: TrojanClicker:JS/Faceliker.D
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 93/100 is the fusion of 3 weighted signals:

• ClamAV (daily) flagged Js.Malware.Autolike-1 (rule Js.Malware.Autolike-1) - engine signal, weight 0.90, confidence 0.95
• Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css, http://yesilcam-sinema-video-izle-vizyon.blogspot.com/favicon.ico, http://yesilcam-sinema-video-izle-vizyon.blogspot.com/feeds/posts/default - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css
• http://yesilcam-sinema-video-izle-vizyon.blogspot.com/favicon.ico
• http://yesilcam-sinema-video-izle-vizyon.blogspot.com/2010/05/sakarya-frat-23-bolum-izle-indir-26.html
• http://yesilcam-sinema-video-izle-vizyon.blogspot.com/feeds/posts/default
• http://yesilcam-sinema-video-izle-vizyon.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/1017688895260153585/posts/default
• http://yesilcam-sinema-video-izle-vizyon.blogspot.com/feeds/9065937451177024657/comments/default
• https://www.blogger.com/static/v1/jsbin/403901366-ieretrofit.js
• http://1.bp.blogspot.com/_FFfrqqNbaP8/SysstPCTOTI/AAAAAAAABJk/aaYv9IPb6jI/s400/sakarya-fIRat-son-bolum-izle.JPG
• http://1.bp.blogspot.com/_FFfrqqNbaP8/SysstPCTOTI/AAAAAAAABJk/aaYv9IPb6jI/w1200-h630-p-k-no-nu/sakarya-fIRat-son-bolum-izle.JPG
• http://themes.googleusercontent.com/image?id=0BwVBOzw_-hbMYjBmMTkxYTItOGZiMy00YTc0LWI1ZGUtYTY5ZDkxOTRlNDU2
• http://www.istockphoto.com/googleimages.php?id=10131462&platform=blogger
• https://www.blogger.com/dyn-css/authorization.css?targetBlogID=1017688895260153585&amp
• https://apis.google.com/js/plusone.js
• http://3.bp.blogspot.com/-s-hxrPYysUc/TwuMuz2WKfI/AAAAAAAAAGE/BKAGLFoauJk/s1600/gulnuxin.gif
• http://yesilcam-sinema-video-izle-vizyon.blogspot.com/
• http://img196.imageshack.us/img196/7449/playery.swf
• http://video.ak.facebook.com/cfs-ak-snc4/32859/562/124809194207940_4256.mp4&ec_rate=10&type=video&image=http://i41.tinypic.com/e8o31f.jpg&logo=http://i39.tinypic.com/2nis492_th.png&stretching=exactfit&skin=http://img59.imageshack.us/img59/5451/modieus.swf
• http://video.ak.facebook.com/cfs-ak-snc4/32783/577/124809674207892_64576.mp4&ec_rate=10&type=video&image=http://i41.tinypic.com/e8o31f.jpg&logo=http://i39.tinypic.com/2nis492_th.png&stretching=exactfit&skin=http://img59.imageshack.us/img59/5451/modieus.swf
• http://video.ak.facebook.com/cfs-ak-snc4/32875/630/124812550874271_8016.mp4&ec_rate=10&type=video&image=http://i41.tinypic.com/e8o31f.jpg&logo=http://i39.tinypic.com/2nis492_th.png&stretching=exactfit&skin=http://img59.imageshack.us/img59/5451/modieus.swf
• http://video.ak.facebook.com/cfs-ak-snc4/32991/909/124814767540716_11985.mp4&ec_rate=10&type=video&image=http://i41.tinypic.com/e8o31f.jpg&logo=http://i39.tinypic.com/2nis492_th.png&stretching=exactfit&skin=http://img59.imageshack.us/img59/5451/modieus.swf

Embedded domains

• www.w3.org
• www.google.com
• www.blogger.com
• yesilcam-sinema-video-izle-vizyon.blogspot.com
• 1.bp.blogspot.com
• tinachen.org
• header.padding.top
• header.margin.top
• widget.padding.top
• widget.outer.margin.top
• date.header.border.radius.top
• date.space
• date.first.border.radius.top
• post.first.padding.top
• pager.border.radius.top
• pager.space.top
• themes.googleusercontent.com
• www.istockphoto.com
• google-analytics.com
• blogspot.com
• apis.google.com
• pagead2.googlesyndication.com
• 3.bp.blogspot.com
• img196.imageshack.us
• video.ak.facebook.com

More Autolike samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report