MALICIOUS — 11baf37c2515f9bce728e372ce984a67c837fe791d32f81ab0644a8a56acfef0

MALICIOUS — 11baf37c2515f9bce728e372ce984a67c837fe791d32f81ab0644a8a56acfef0 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 11baf37c2515f9bce728e372ce984a67c837fe791d32f81ab0644a8a56acfef0
• SHA-1: 674c7cb233efabde9c613f066ed8948e9b96502b
• MD5: 5f94424776338de8870ac51071f2972d
• ssdeep: 768:cRMggOriWNcaSoagGLYPfXZ8Rkv+SVwd8OJmHaF2WD:cRMX/pYPfCRp98OJmHaz
• TLSH: T1A733B85B7A51AACB14E09002655D8AC9A0C6C357E93352F9E2B3FF4CC42CD74A94DC87
• Submitted as: 11baf37c2515f9bce728e372ce984a67c837fe791d32f81ab0644a8a56acfef0
• File type: html · Size: 49362 bytes
• Verdict: malicious (93/100)

Detections (3 of 53 engines)

• ClamAV (daily): Html.Exploit.Agent-6598769-0
• Microsoft Defender: TrojanClicker:JS/Faceliker.A
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 93/100 is the fusion of 3 weighted signals:

• ClamAV (daily) flagged Html.Exploit.Agent-6598769-0 (rule Html.Exploit.Agent-6598769-0) - engine signal, weight 0.90, confidence 0.95
• Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css, http://ashleygagafakes.blogspot.com/favicon.ico, http://ashleygagafakes.blogspot.com/feeds/posts/default - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css
• http://ashleygagafakes.blogspot.com/favicon.ico
• http://ashleygagafakes.blogspot.com/2011/12/20111225.html
• http://ashleygagafakes.blogspot.com/feeds/posts/default
• http://ashleygagafakes.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/8325603593962565300/posts/default
• http://ashleygagafakes.blogspot.com/feeds/4659136032503018998/comments/default
• https://www.blogger.com/static/v1/jsbin/403901366-ieretrofit.js
• http://1.bp.blogspot.com/-BxDh8V1HSfk/TvMPA3y0z5I/AAAAAAAAW5g/9m_2cu2JosQ/s400/bc0118.jpg
• http://1.bp.blogspot.com/-BxDh8V1HSfk/TvMPA3y0z5I/AAAAAAAAW5g/9m_2cu2JosQ/w1200-h630-p-k-no-nu/bc0118.jpg
• http://ajax.googleapis.com/ajax/libs/jquery/1.6.2/jquery.min.js
• https://www.blogger.com/dyn-css/authorization.css?targetBlogID=8325603593962565300&amp
• https://apis.google.com/js/plusone.js
• http://ashleygagafakes.blogspot.com/
• http://scripts.chitika.net/eminimalls/amm.js
• http://adserver.juicyads.com/adshow.php?adzone=174460
• http://schema.org/BlogPosting
• http://1.bp.blogspot.com/-BxDh8V1HSfk/TvMPA3y0z5I/AAAAAAAAW5g/9m_2cu2JosQ/s72-c/bc0118.jpg
• http://1.bp.blogspot.com/-BxDh8V1HSfk/TvMPA3y0z5I/AAAAAAAAW5g/9m_2cu2JosQ/s1600/bc0118.jpg
• http://1.bp.blogspot.com/-b5qonV3_ag4/TvMO3DrbCaI/AAAAAAAAW44/69sZWQLoDVI/s1600/bc0121.jpg
• http://1.bp.blogspot.com/-b5qonV3_ag4/TvMO3DrbCaI/AAAAAAAAW44/69sZWQLoDVI/s400/bc0121.jpg

Embedded domains

• www.w3.org
• www.google.com
• www.blogger.com
• ashleygagafakes.blogspot.com
• 1.bp.blogspot.com
• tinachen.org
• www.blogblog.com
• ajax.googleapis.com
• blogspot.com
• apis.google.com
• pagead2.googlesyndication.com
• scripts.chitika.net
• adserver.juicyads.com
• schema.org
• 2.bp.blogspot.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report