MALICIOUS — 17944587501425d33890b410ec014eb9f4c5f01699c82999916101d5e493d243

MALICIOUS — 17944587501425d33890b410ec014eb9f4c5f01699c82999916101d5e493d243 is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100). 2 of 54 detection engines flagged it.

Identification

• SHA-256: 17944587501425d33890b410ec014eb9f4c5f01699c82999916101d5e493d243
• SHA-1: e52f28e91d5d509be2d888348e66c1d56c7ba8cf
• MD5: f1abbf385a6a6d41e3fdc32a3866a609
• ssdeep: 3072:tJfFYoDU0xVqvUejbs7dCYdInBwD0aLr:tJfFYkUYgUawBCYdKBO0q
• TLSH: T1DE3C3CEB789F9E9DC90D614B3D8ABD06BB035909B9A3E4C5F1F9CF4454B0CD0281885A
• Submitted as: 17944587501425d33890b410ec014eb9f4c5f01699c82999916101d5e493d243
• File type: script · Size: 112361 bytes
• Verdict: malicious (87/100)

Detections (2 of 54 engines)

• Microsoft Defender: Trojan:JS/Agent.AG!MSR
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 87/100 is the fusion of 4 weighted signals:

• Microsoft Defender flagged Trojan:JS/Agent.AG!MSR (rule Trojan:JS/Agent.AG!MSR) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• Obfuscated javascript script: dynamic-exec, defense-evasion (layers: char-code+concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: http://labs.skinkers.com/touchSwipe/, http://plugins.jquery.com/project/touchSwipe, http://greensock.com - static signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

1228 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• desktop-hsgcbep._dosvc._tcp.local
• desktop-hsgcbep(1)._dosvc._tcp.local
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• 23.40.52.209
• 162.159.142.9 US · San Francisco · AS13335 Cloudflare, Inc.
• 23.11.37.157
• 40.126.14.162
• 20.184.175.22 US · AS8075 MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US
• 40.84.85.40 US · Boydton · AS8075 Microsoft Corporation
• 4.144.132.114 SG · Singapore · AS8075 Microsoft Corporation
• 23.33.238.135
• 23.198.40.44

Embedded URLs

• http://www.github.com/mattbryson
• https://github.com/mattbryson/TouchSwipe-Jquery-Plugin
• http://labs.skinkers.com/touchSwipe/
• http://plugins.jquery.com/project/touchSwipe
• http://greensock.com
• http://greensock.com/standard-license
• http://www.w3.org/1999/xhtml
• http://www.w3.org/2000/svg
• http://greensock.com/club/
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• www.github.com
• github.com
• labs.skinkers.com
• plugins.jquery.com
• be.top
• bd.top
• console.info
• greensock.com
• d.to
• f.to
• www.w3.org
• b.to
• s.top
• t.style.top
• n.style.top

Embedded IP addresses

• 4.247.188.233
• 51.132.193.105
• 72.154.7.104
• 52.123.128.14
• 162.159.142.9
• 20.184.175.22
• 40.84.85.40
• 4.144.132.114
• 52.110.12.49
• 4.230.171.124
• 104.18.33.89
• 135.232.92.97
• 135.233.95.144
• 74.178.240.61

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report