MALICIOUS — 225eee2ac7245a3c729b5b92bebca53664029fe89de193d23e6c647eec2d53fc
MALICIOUS — 225eee2ac7245a3c729b5b92bebca53664029fe89de193d23e6c647eec2d53fc is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Autolike family. 2 of 54 detection engines flagged it.
Identification
- SHA-256:
225eee2ac7245a3c729b5b92bebca53664029fe89de193d23e6c647eec2d53fc - SHA-1:
11cae70f8a87cebec008a7f1d17be7b7015dd1d6 - MD5:
8cca46aa8805b1315186520281975528 - ssdeep:
768:RcUFlRurp4J4du9FToKWOQe03EKWgjuiOiPi3iGiAi2iMiNiIIihiWi8iWivioic:RcURuSDtQD3Ecy04OqmsBSS0frYX - TLSH:
T19639E9AA3A657A4B0CF00415346C8AD920C7A767B53391F4E0FADF8CD86CE606D458E7 - Submitted as: 225eee2ac7245a3c729b5b92bebca53664029fe89de193d23e6c647eec2d53fc
- File type: html · Size: 85101 bytes
- Verdict: malicious (98/100) · Family: Autolike
Detections (2 of 54 engines)
- ClamAV (daily): Js.Malware.Autolike-1
- Microsoft Defender: TrojanClicker:JS/Faceliker.D
Why this verdict
The malicious score of 98/100 is the fusion of 6 weighted signals:
- ClamAV (daily) flagged Js.Malware.Autolike-1 (rule
Js.Malware.Autolike-1) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged TrojanClicker:JS/Faceliker.D (rule
TrojanClicker:JS/Faceliker.D) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css, http://code.jquery.com/jquery-1.4.2.min.js, http://coconut-pete.blogspot.com/favicon.ico - static signal, weight 0.35, confidence 0.60
- Extracted generic config (11 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
278 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- windows.msn.com
- odc.officeapps.live.com
- www.msn.com
- www.bing.com
- assets.msn.com
- fe3cr.delivery.mp.microsoft.com
- settings-win.data.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- f315f942a952dd7255f770f64f970bfd4c460c098395ecd94dc0bf1b101f2e57 -
f315f942a952dd7255f770f64f970bfd4c460c098395ecd94dc0bf1b101f2e57
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css
- http://code.jquery.com/jquery-1.4.2.min.js
- http://coconut-pete.blogspot.com/favicon.ico
- http://coconut-pete.blogspot.com/2010/11/brandy-alexander-cocktail.html
- http://coconut-pete.blogspot.com/feeds/posts/default
- http://coconut-pete.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/3168735442194454623/posts/default
- https://www.blogger.com/static/v1/jsbin/403901366-ieretrofit.js
- http://3.bp.blogspot.com/_rnM_rJ32r7A/TOKCtvcrLAI/AAAAAAAAATE/5oVfH8Hl7MI/s320/brandy-alexander-istock.jpg
- http://3.bp.blogspot.com/_rnM_rJ32r7A/TOKCtvcrLAI/AAAAAAAAATE/5oVfH8Hl7MI/w1200-h630-p-k-no-nu/brandy-alexander-istock.jpg
- http://themes.googleusercontent.com/image?id=0BwVBOzw_-hbMODkyZmM5YWEtOTA5YS00YmYwLThhNzMtMzVjZDAyY2MzZThh
- http://www.istockphoto.com/googleimages.php?id=5305090&platform=blogger
- http://lh5.ggpht.com/_u4gySN2ZgqE/TJ3dpjy9PaI/AAAAAAAABr0/PTUXIS8ykps/fblogo%5B3%5D.jpg
- https://www.blogger.com/dyn-css/authorization.css?targetBlogID=3168735442194454623&
- https://apis.google.com/js/plusone.js
- http://coconut-pete.blogspot.com/
- http://1.bp.blogspot.com/_rnM_rJ32r7A/TNWAZsCj7PI/AAAAAAAAAKE/xacDdTyQWVE/S1600-R/sssddf.jpg
- http://coconut-pete.blogspot.com/p/measurements.html
- http://coconut-pete.blogspot.com/p/blog-page.html
- http://www.facebook.com/sharer.php
- http://static.ak.fbcdn.net/connect.php/js/FB.Share
Embedded domains
- www.w3.org
- www.google.com
- www.blogger.com
- code.jquery.com
- coconut-pete.blogspot.com
- 3.bp.blogspot.com
- tinachen.org
- header.padding.top
- header.margin.top
- widget.padding.top
- widget.outer.margin.top
- date.header.border.radius.top
- date.space
- post.first.padding.top
- pager.border.radius.top
- pager.space.top
- themes.googleusercontent.com
- www.istockphoto.com
- lh5.ggpht.com
- blogspot.com
- apis.google.com
- pagead2.googlesyndication.com
- 1.bp.blogspot.com
- www.facebook.com
- static.ak.fbcdn.net
Embedded IP addresses
- 20.42.73.26
- 4.144.132.223
- 4.230.171.124
- 74.178.76.54
- 57.154.63.210
- 20.184.175.12
- 74.178.240.61
- 72.145.35.98
- 52.148.114.188
- 52.110.12.11
- 52.110.12.54
More Autolike samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report