SUSPICIOUS — 1e3ea11a6df5aeaf1670546ce8aea1a569b1f082defa1a7169440aa1a63cf004

SUSPICIOUS — 1e3ea11a6df5aeaf1670546ce8aea1a569b1f082defa1a7169440aa1a63cf004 is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: 1e3ea11a6df5aeaf1670546ce8aea1a569b1f082defa1a7169440aa1a63cf004
• SHA-1: 2c2f66d0814633e3ae08656040ac31450b62f62b
• MD5: 7b5036d8f6f7f541f24065378505526d
• ssdeep: 384:leVk5QRqhaFKTWKWaTOqU5SEhy6ya0FmDj5OhSu0LSah4A5Pkssu:leVk5RhaFKTWKWauSEE6ya0FmDj51u0F
• TLSH: T1372B9697BC88FFED980C62219D9EB537762B0875382594CC43BCCB849CB84B40C1CA66
• Submitted as: 1e3ea11a6df5aeaf1670546ce8aea1a569b1f082defa1a7169440aa1a63cf004
• File type: script · Size: 22406 bytes
• Verdict: suspicious (54/100)

Detections (2 of 50 engines)

• Microsoft Defender: Trojan:JS/Agent.AG!MSR
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://wpbakery.com, http://go.wpbakery.com/licensing, https://assets.pinterest.com/js/pinit.js - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://wpbakery.com
• http://go.wpbakery.com/licensing
• https://apis.google.com/js/plusone.js
• https://assets.pinterest.com/js/pinit.js

Embedded domains

• wpbakery.com
• go.wpbakery.com
• apis.google.com
• assets.pinterest.com
• astidocg.it

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report