SUSPICIOUS — 225e47c21368964397d358a1020d63be4d81449812ba226f7c09e62091b0778a
SUSPICIOUS — 225e47c21368964397d358a1020d63be4d81449812ba226f7c09e62091b0778a is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 53 detection engines flagged it.
Identification
- SHA-256:
225e47c21368964397d358a1020d63be4d81449812ba226f7c09e62091b0778a - SHA-1:
0b621e450c6727a27308f1061f21fa03f42a6452 - MD5:
5f2298fa0d9573ce2683a2bf42ba255b - ssdeep:
3072:XIRYZsvsYNxsRsDuVxI1XGbnD3r8AxH9d9HDNX1oBFIiD/F3fkvWDjDd:W8WDjB - TLSH:
T1F048310043176ECF8FD94C0DF5880DAE941DB6EF9A24A0F15A91EFDCA42AD71D4AB142 - Submitted as: 225e47c21368964397d358a1020d63be4d81449812ba226f7c09e62091b0778a
- File type: html · Size: 385587 bytes
- Verdict: suspicious (54/100)
Detections (1 of 53 engines)
- Microsoft Defender: Trojan:JS/Redirector.AD!AMTB
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec (layers: base64+concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://www.121signs.com/media/favicon/default/LOGO_121_1.png, https://www.121signs.com/js/blank.html, https://www.121signs.com/js/spacer.gif - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd
- http://www.w3.org/1999/xhtml
- https://www.121signs.com/media/favicon/default/LOGO_121_1.png
- https://www.121signs.com/js/blank.html
- https://www.121signs.com/js/spacer.gif
- https://www.121signs.com/js/calendar/calendar-win2k-1.css
- https://www.121signs.com/js/belvg/jquery/cloud-zoom/cloud-zoom.css
- https://www.121signs.com/js/belvg/jquery/fancybox/fancybox-2.1.5/jquery.fancybox.css
- https://www.121signs.com/js/belvg/jquery/fancybox/fancybox-2.1.5/helpers/jquery.fancybox-buttons.css
- https://www.121signs.com/js/belvg/jquery/fancybox/fancybox-2.1.5/helpers/jquery.fancybox-thumbs.css
- https://www.121signs.com/skin/frontend/default/default/css/styles.css
- https://www.121signs.com/skin/frontend/base/default/css/widgets.css
- https://www.121signs.com/skin/frontend/default/121signs/css/owl.carousel.css
- https://www.121signs.com/skin/frontend/default/121signs/css/signs.css
- https://www.121signs.com/skin/frontend/default/121signs/css/responsive.css
- https://www.121signs.com/skin/frontend/default/121signs/css/add.css
- https://www.121signs.com/skin/frontend/base/default/ced_sociallogin/google/css/button.css
- https://www.121signs.com/skin/frontend/base/default/ced_sociallogin/linkedin/css/button.css
- https://www.121signs.com/skin/frontend/default/121signs/ajaxminicart/ajaxcart.css
- https://www.121signs.com/skin/frontend/default/121signs/css/magestore/bannerslider/popup.css
- https://www.121signs.com/skin/frontend/default/121signs/css/mirasvit/searchautocomplete/amazon.css
- https://www.121signs.com/skin/frontend/default/121signs/css/mirasvit_searchindex.css
- https://www.121signs.com/skin/frontend/default/121signs/ves_vendors/checkout/styles.css
- https://www.121signs.com/skin/frontend/base/default/css/dailydeal.css
- https://www.121signs.com/skin/frontend/default/121signs/js/amasty/amconf/css/tooltipster.css
Embedded domains
- www.w3.org
- 121signs.com
- www.121signs.com
- google-analytics.com
- schema.org
- www.linkedin.com
- accounts.google.com
- 570485591896-p7ahfn2irt7jnqv1op5bhilbb0oi5i95.apps.googleusercontent.com
- what-is-121signs.com
- www.qoo10.sg
- www.chnservices.com.sg
- www.magentocommerce.com
- v2.zopim.com
- www.googleadservices.com
- googleads.g.doubleclick.net
- www.google-analytics.com
- 8words.xyz
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report