MALICIOUS — 22504888c0ad49344fe9d1319e67bf409893016dc61a879f57a8c8622c8f196e
MALICIOUS — 22504888c0ad49344fe9d1319e67bf409893016dc61a879f57a8c8622c8f196e is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100). 2 of 54 detection engines flagged it.
Identification
- SHA-256:
22504888c0ad49344fe9d1319e67bf409893016dc61a879f57a8c8622c8f196e - SHA-1:
61f1d4656d49fe41b93227d6b8d173e01402ad52 - MD5:
52b3f03f19b9d64a3fca17b3fd5b58e8 - ssdeep:
1536:KEu1MB4yCa+AfQ8/zwJHi/JoidsRqb0DYZG9zEcLZHNbCHrCelA2MAem6J4x:w1NMr/0JHi/Joi3gDYZG9zEcJNbCHrCo - TLSH:
T181381B2F73457E5B48E0A511DFFD26E4B68E816BD43140BED022E78C982CD71784AC6A - Submitted as: 22504888c0ad49344fe9d1319e67bf409893016dc61a879f57a8c8622c8f196e
- File type: html · Size: 79905 bytes
- Verdict: malicious (91/100)
Detections (2 of 54 engines)
- Microsoft Defender: TrojanClicker:JS/Faceliker.N
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 91/100 is the fusion of 6 weighted signals:
- Microsoft Defender flagged TrojanClicker:JS/Faceliker.N (rule
TrojanClicker:JS/Faceliker.N) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - Obfuscated powershell script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, https://genk-eus.blogspot.com/favicon.ico, https://genk-eus.blogspot.com/search/label/my%2Bcomputer - static signal, weight 0.35, confidence 0.60
- Extracted generic config (7 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
278 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- www.bing.com
- assets.msn.com
- fe3cr.delivery.mp.microsoft.com
- settings-win.data.microsoft.com
- v10.events.data.microsoft.com
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.facebook.com/2008/fbml
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- https://genk-eus.blogspot.com/favicon.ico
- https://genk-eus.blogspot.com/search/label/my%2Bcomputer
- https://genk-eus.blogspot.com/feeds/posts/default
- https://genk-eus.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/8203792947886703493/posts/default
- https://plus.google.com/u/0/112907905286669677891/about
- https://plus.google.com/u/0/112907905286669677891/posts
- http://genk.eus.vn/
- https://www.facebook.com/Eus.vn
- https://lh6.googleusercontent.com/-_4kZHLjqO6A/ULGjxN4gGLI/AAAAAAAAKCs/BzXRCu1enaE/s369/bg-body.gif
- https://lh5.googleusercontent.com/-V6xvhwsqsG4/T7cHn8ByR5I/AAAAAAAAJg4/imuiQq8PMbA/s40/Icon_Quote.png
- https://lh6.googleusercontent.com/-j1NI0_WrRkw/T40ylNRk6nI/AAAAAAAAJKI/9O-JgaIV6EQ/s16/rss_alt_16x16.png
- https://lh3.googleusercontent.com/-Xla9rTS02Fk/T40ylpqblSI/AAAAAAAAJKQ/lrZW0zK6P_Q/s16/user_12x16.png
- https://lh3.googleusercontent.com/-Eykx0WAEb5s/T40ykWBI9ZI/AAAAAAAAJJ8/RCI6gP0CLLE/s16/clock_16x16.png
- https://lh5.googleusercontent.com/-86PFRyHe9As/T40ykYuiLZI/AAAAAAAAJKA/Yj8luErnfqI/s16/comment_alt1_stroke_16x12.png
- https://lh5.googleusercontent.com/-KexZaDYhr7I/T40ylY1OYCI/AAAAAAAAJKU/bfYTe2-C70c/s16/tag_fill_16x16.png
- https://lh5.googleusercontent.com/-j4sA50AKFhw/ULhcCvbSX3I/AAAAAAAAKEw/2KyrIDJyFmc/s210/left.png
- https://lh6.googleusercontent.com/-UeiVpMnAE40/ULhcCtvn4tI/AAAAAAAAKEs/P1LrOch5M9o/s210/left-hover.png
- https://lh5.googleusercontent.com/-1KKaGeacsXM/ULhcDQE7cCI/AAAAAAAAKE4/U18lhJaeDTM/s210/right.png
Embedded domains
- www.w3.org
- www.google.com
- www.facebook.com
- www.blogger.com
- genk-eus.blogspot.com
- www.aol.com
- www.infoseek.com
- www.excite.com
- www.hotbot.com
- www.lycos.com
- www.magellan.com
- www.looksmart.com
- www.cnet.com
- www.voila.com
- www.google.fr
- www.yahoo.fr
- www.yahoo.com
- www.alltheweb.com
- www.msn.com
- www.netscape.com
- www.nomade.com
- plus.google.com
- lh6.googleusercontent.com
- lh5.googleusercontent.com
- lh3.googleusercontent.com
Embedded IP addresses
- 52.182.143.212
- 4.144.132.114
- 52.123.252.227
- 4.230.171.124
- 135.232.92.97
- 4.144.132.223
- 48.211.4.16
- 4.150.223.99
- 74.178.240.61
- 4.150.223.109
- 162.159.142.9
- 72.145.35.102
- 52.148.114.188
- 52.110.12.49
- 52.110.12.22
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report