MALICIOUS — 15ea3e15f10facea0c990d2fafff6c4f2a191060e80572d236f4eb95a0918c40
MALICIOUS — 15ea3e15f10facea0c990d2fafff6c4f2a191060e80572d236f4eb95a0918c40 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (83/100), attributed to the FKLR family. 2 of 53 detection engines flagged it.
Identification
- SHA-256:
15ea3e15f10facea0c990d2fafff6c4f2a191060e80572d236f4eb95a0918c40 - SHA-1:
729742f9b3aed141ca3a40705e4822053ef17baf - MD5:
d7c7be5167297374347800d291ee9923 - ssdeep:
1536:Puzj9+SvQQcmNVNIxN9NkN+N4NVNsNaNPfxQ:PuH9+SvamNVNIxN9NkN+N4NVNsNaNPy - TLSH:
T1D439A316A1F4BD4F428554CE6090564D8CA5ACFFB413B0EE9AE49F87489CFA2F439423 - Submitted as: 15ea3e15f10facea0c990d2fafff6c4f2a191060e80572d236f4eb95a0918c40
- File type: html · Size: 85380 bytes
- Verdict: malicious (83/100) · Family: FKLR
Detections (2 of 53 engines)
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): Trojan.Agent.FKLR
Why this verdict
The malicious score of 83/100 is the fusion of 5 weighted signals:
- Memory forensics: 2 finding(s), e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85 - Obfuscated javascript script: dynamic-exec (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 23 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://1.bp.blogspot.com/-KpoNbnShwJE/YSMnc1wdzdI/AAAAAAAADjE/RZ66JAxEOecHB3h8z7tHcF4Pkca53T4MgCLcBGAsYHQ/s0/og.jpg, https://www.gojek.com/id-id/, https://cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js - static signal, weight 0.35, confidence 0.60
- Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
277 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
Embedded URLs
- https://1.bp.blogspot.com/-KpoNbnShwJE/YSMnc1wdzdI/AAAAAAAADjE/RZ66JAxEOecHB3h8z7tHcF4Pkca53T4MgCLcBGAsYHQ/s0/og.jpg
- https://www.gojek.com/id-id/
- https://cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js
- https://cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js
- https://cdn.jsdelivr.cc/npm/sweetalert2@10.16.0/dist/sweetalert2.all.min.js
- https://cdn.jsdelivr.cc/npm/lazyload@2.0.0-rc.2/lazyload.min.js
- https://cdn.jsdelivr.cc/npm/popper.js@1.16.1/dist/umd/popper.min.js
- https://cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css
- https://1.bp.blogspot.com/-7cJsPLx_WPA/YSMlCAOxqmI/AAAAAAAADh8/3kbxmbZZLpQ2-dt9393upBWSuCmXTarcwCLcBGAsYHQ/s16000/gojek_favicon.png
- https://www.googletagmanager.com/gtag/js?id=G-L70C2DTQEK
- https://1.bp.blogspot.com/-InRDYG0DmGI/YSMlCEHQb3I/AAAAAAAADiA/GNrqRAwRtMQ3ShPAmCWWeRa3hBTJktG6ACLcBGAsYHQ/s16000/left.jpg
- https://1.bp.blogspot.com/-JeUUXd97x3M/YAqO3Tit9zI/AAAAAAAAAkA/30Uau3Asv6c0GK8aK2hCwwbrVTVL_mQYgCLcBGAsYHQ/s0/cdx.png
- https://1.bp.blogspot.com/-Ix4hNk4nCXY/YSMlCM1yJNI/AAAAAAAADiE/UI3mHHInR_UYtEnI4Skldss0fBG5g-iGwCLcBGAsYHQ/s16000/show.jpg
- https://1.bp.blogspot.com/-_1UZh3EYpLI/YSMlC5TXBlI/AAAAAAAADiI/LdgmP9qfhOYx9C4tWRmF4QSyaU_nHQJnACLcBGAsYHQ/s16000/show2.jpg
- https://1.bp.blogspot.com/-tgdyzabxuJ4/YKpjmQ_UJKI/AAAAAAAABfk/VqO0bIY6vq0EZ9BvCyHwfUT8owQt7dzWwCLcBGAsYHQ/s16000/United-States_outbox.png
- https://1.bp.blogspot.com/-qa0pVWCHod8/YKuuSNzx7AI/AAAAAAAABqs/yJdB27ONsJEzhlpBTPMLPxBQxPd3jXqTgCLcBGAsYHQ/s16000/box1.png
- https://1.bp.blogspot.com/-5zjHRLCnfiM/YKuuSHUdAhI/AAAAAAAABqk/kHKLfdfBULgUaOTvFw0xJ7v8k-H5SyPtQCLcBGAsYHQ/s16000/box2.png
- https://1.bp.blogspot.com/-RC32duKA6Wo/YKpjmBkVOEI/AAAAAAAABfg/PraKjCk35xQl-wrsLztkUt-VUrh547z7wCLcBGAsYHQ/s16000/United-States_inbox.png
- https://1.bp.blogspot.com/-320k2STjtp8/YKuuSNbYMSI/AAAAAAAABqo/e3KsK79zMmcBJSPl5x8b5JZUjfiJDEYLgCLcBGAsYHQ/s16000/box3.png
- https://uprimp.com/bnr.php?section=General&pub=593174&format=300x50&ga=g
- https://1.bp.blogspot.com/-tVjvIwUotpY/YSCMttK2BxI/AAAAAAAADUU/EQpzpqnxaBEuZzQ6-qPXZCOHwz1uVw4nwCLcBGAsYHQ/s16000/163141900_143237741032942_4717551879772381985_n.jpg
- https://1.bp.blogspot.com/-hJX2j9nKM_A/YSCKWwuQ3XI/AAAAAAAADT0/7wL58ebDnxYkCcKPrwva4TVdFaOPsWpygCLcBGAsYHQ/s16000/42697470_114546366180450_7865351554507735040_n.jpg
- https://1.bp.blogspot.com/-pv4tuM7MnBY/YSCKWJ--ufI/AAAAAAAADTo/Ru4bUnid5KEZ3KdQNOW8wsbqrRO6SdWPgCLcBGAsYHQ/s16000/157925570_133306992030166_7501703254048777350_n.jpg
- https://1.bp.blogspot.com/-dT5wwkCSCfg/YSCKTy6fu-I/AAAAAAAADTM/PciVvbNxnAk4xCPEpLLCT_toY8mIfC6uwCLcBGAsYHQ/s16000/138989172_105009138235849_4374181406714721079_n.jpg
- https://1.bp.blogspot.com/--mL2ydz3KU0/YSCKVrLKWtI/AAAAAAAADTk/i4SaUxDRq1Ihf07IYN10DYQxVAdXseE-QCLcBGAsYHQ/s16000/156277595_139223594748184_3542805083792692225_n.jpg
Embedded domains
- 1.bp.blogspot.com
- www.gojek.com
- cdn.jsdelivr.cc
- www.googletagmanager.com
- c.top
- benfly.net
- uprimp.com
- v.gapis.xyz
- www.w3.org
- hm.baidu.com
Embedded IP addresses
- 41.17.79.44
- 52.123.252.197
- 20.42.65.90
- 4.230.171.124
- 4.247.188.224
- 20.247.184.142
- 74.179.77.204
- 20.165.94.54
- 20.42.73.30
- 20.112.250.133
- 52.123.129.14
- 52.123.128.14
- 162.159.142.9
- 203.26.79.13
- 172.178.240.161
- 52.123.252.232
- 135.233.95.80
- 52.148.114.188
- 20.184.175.4
- 51.116.246.106
- 72.145.35.100
- 40.84.97.4
- 52.110.12.54
- 52.110.12.26
More FKLR samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report