SUSPICIOUS — 11be6882a8aa4693e20ff9b51fad85722dc718cba02bd50d47fe9f335ce08140
SUSPICIOUS — 11be6882a8aa4693e20ff9b51fad85722dc718cba02bd50d47fe9f335ce08140 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
11be6882a8aa4693e20ff9b51fad85722dc718cba02bd50d47fe9f335ce08140 - SHA-1:
5c3d6101498367a7e4c74f8dedf13070a076ecde - MD5:
8a264e5100373e7ce669926ec11a136e - ssdeep:
3072:F1yl1WomKUH3t/ILG9lE/sMq/mBTZWFz/:Bvn - TLSH:
T1363DB5197F297D5F50A0D55A78AC2E84C293972FEA3380F6E1337B969524C286C4EC13 - Submitted as: 11be6882a8aa4693e20ff9b51fad85722dc718cba02bd50d47fe9f335ce08140
- File type: html · Size: 135667 bytes
- Verdict: suspicious (54/100)
Detections (2 of 53 engines)
- Microsoft Defender: TrojanClicker:JS/Faceliker!pz
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://quangngaisale.blogspot.com/favicon.ico, http://quangngaisale.blogspot.com/search/label/C%C3%B4ng%20ngh%E1%BB%87 - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.facebook.com/2008/fbml
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://quangngaisale.blogspot.com/favicon.ico
- http://quangngaisale.blogspot.com/search/label/C%C3%B4ng%20ngh%E1%BB%87
- http://quangngaisale.blogspot.com/feeds/posts/default
- http://quangngaisale.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/3715979499786893690/posts/default
- https://www.blogger.com/profile/04478853395127244847
- http://quangngaisale.blogspot.com
- https://lh6.googleusercontent.com/-_4kZHLjqO6A/ULGjxN4gGLI/AAAAAAAAKCs/BzXRCu1enaE/s369/bg-body.gif
- https://lh5.googleusercontent.com/-V6xvhwsqsG4/T7cHn8ByR5I/AAAAAAAAJg4/imuiQq8PMbA/s40/Icon_Quote.png
- https://lh6.googleusercontent.com/-j1NI0_WrRkw/T40ylNRk6nI/AAAAAAAAJKI/9O-JgaIV6EQ/s16/rss_alt_16x16.png
- https://lh3.googleusercontent.com/-Xla9rTS02Fk/T40ylpqblSI/AAAAAAAAJKQ/lrZW0zK6P_Q/s16/user_12x16.png
- https://lh3.googleusercontent.com/-Eykx0WAEb5s/T40ykWBI9ZI/AAAAAAAAJJ8/RCI6gP0CLLE/s16/clock_16x16.png
- https://lh5.googleusercontent.com/-86PFRyHe9As/T40ykYuiLZI/AAAAAAAAJKA/Yj8luErnfqI/s16/comment_alt1_stroke_16x12.png
- https://lh5.googleusercontent.com/-KexZaDYhr7I/T40ylY1OYCI/AAAAAAAAJKU/bfYTe2-C70c/s16/tag_fill_16x16.png
- http://lh6.ggpht.com/-GDMurKK2tec/T5JCD6hoKoI/AAAAAAAABAc/COHOItBlFWk/author.png
- https://lh5.googleusercontent.com/-j4sA50AKFhw/ULhcCvbSX3I/AAAAAAAAKEw/2KyrIDJyFmc/s210/left.png
- https://lh6.googleusercontent.com/-UeiVpMnAE40/ULhcCtvn4tI/AAAAAAAAKEs/P1LrOch5M9o/s210/left-hover.png
- https://lh5.googleusercontent.com/-1KKaGeacsXM/ULhcDQE7cCI/AAAAAAAAKE4/U18lhJaeDTM/s210/right.png
- https://lh4.googleusercontent.com/-o4YPaBDHpN4/ULhcCi7pWfI/AAAAAAAAKE0/o96Dm00cJlQ/s210/right-hover.png
Embedded domains
- www.w3.org
- www.google.com
- www.facebook.com
- www.blogger.com
- ads.lfstmedia.com
- quangngaisale.blogspot.com
- lh6.googleusercontent.com
- lh5.googleusercontent.com
- lh3.googleusercontent.com
- lh6.ggpht.com
- lh4.googleusercontent.com
- 1.bp.blogspot.com
- 3.bp.blogspot.com
- www.techprevue.com
- ajax.googleapis.com
- tintuctv.googlecode.com
- blogspot.com
- apis.google.com
- pagead2.googlesyndication.com
- icons.iconarchive.com
- iloveicons.ru
- cdn3.iconfinder.com
- cdn4.iconfinder.com
- 4.bp.blogspot.com
- demooaxe.blogspot.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report