SUSPICIOUS — 1f31daf2bbffcc935a8d9748065a74b8df18e75246c5d0b0f062bd0189380806
SUSPICIOUS — 1f31daf2bbffcc935a8d9748065a74b8df18e75246c5d0b0f062bd0189380806 is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
1f31daf2bbffcc935a8d9748065a74b8df18e75246c5d0b0f062bd0189380806 - SHA-1:
5bc010b10e708406a49b2857eb0a64e8f60211ca - MD5:
c2ab1325d24f59230e64535ef6923985 - ssdeep:
384:ercvMyAL7khqI6o4i9yAxLIIzVvlWJRuv4ssGu:xMyAL7kUS9LDYbzGu - TLSH:
T1D826D8C27ECD6EC6D44501017BC4358A3D475D23A10020A961B8AF4BEEEDF561624EFB - Submitted as: 1f31daf2bbffcc935a8d9748065a74b8df18e75246c5d0b0f062bd0189380806
- File type: script · Size: 14983 bytes
- Verdict: suspicious (54/100)
Detections (2 of 53 engines)
- Microsoft Defender: Trojan:JS/Agent.AG!MSR
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://www.facebook.com/sharer/sharer.php?u=, http://twitter.com/intent/tweet?text=, http://pinterest.com/pin/create/button/?url= - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://www.facebook.com/sharer/sharer.php?u=
- https://plus.google.com/share?url=
- http://twitter.com/intent/tweet?text=
- http://pinterest.com/pin/create/button/?url=
- https://api.whatsapp.com/send?text=
- https://vk.com/share.php?url=
- https://www.linkedin.com/shareArticle?url=
Embedded domains
- www.facebook.com
- plus.google.com
- twitter.com
- pinterest.com
- api.whatsapp.com
- vk.com
- www.linkedin.com
- blog.hrssglobal.com
- crypto-earnup.blog.hrssglobal.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report