SUSPICIOUS — 230aa3a4c565e56eea3490bf5fe262b42cd93dac14b81a09770348fe5a6fac6c
SUSPICIOUS — 230aa3a4c565e56eea3490bf5fe262b42cd93dac14b81a09770348fe5a6fac6c is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 53 detection engines flagged it.
Identification
- SHA-256:
230aa3a4c565e56eea3490bf5fe262b42cd93dac14b81a09770348fe5a6fac6c - SHA-1:
f250ce102d9ea46a13241fd64a0f3eb61a9a0f26 - MD5:
ad84ec22eeb2687bc775960577df9fce - ssdeep:
1536:LC/yZy3wwYuwMTKCHCXqpXM0b9CnGWd7YvNKLgeAqxWsloOJsQ6imslH+qsQV5mZ:yYufKCHCXqpTNeHr5o+ep3y7vBTX+9iy - TLSH:
T18D38B8215CEAAC5184C40988F2650C458C19FD4FA82273E6CF299F4B64ADF3195BE9CF - Submitted as: 230aa3a4c565e56eea3490bf5fe262b42cd93dac14b81a09770348fe5a6fac6c
- File type: html · Size: 78031 bytes
- Verdict: suspicious (54/100)
Detections (1 of 53 engines)
- Microsoft Defender: Trojan:JS/Redirector.AYLB!MTB
Why this verdict
The suspicious score of 54/100 is the fusion of 4 weighted signals:
- Obfuscated javascript script: dynamic-exec (layers: char-code) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 27 external host(s) and 28 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://fonts.googleapis.com/css?family=Roboto:300, https://noithatgiahung.org/wp-content/themes/thientrieu/css/bootstrap.min.css, https://noithatgiahung.org/wp-content/themes/thientrieu/font-awesome/css/font-awesome.min.css - static signal, weight 0.35, confidence 0.60
- Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
279 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- settings-win.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
Embedded URLs
- https://fonts.googleapis.com/css?family=Roboto:300
- https://noithatgiahung.org/wp-content/themes/thientrieu/css/bootstrap.min.css
- https://noithatgiahung.org/wp-content/themes/thientrieu/font-awesome/css/font-awesome.min.css
- https://noithatgiahung.org/wp-content/themes/thientrieu/css/slick.css
- https://noithatgiahung.org/wp-content/themes/thientrieu/css/common.css
- https://noithatgiahung.org/wp-content/themes/thientrieu/css/format.css
- https://yoast.com/wordpress/plugins/seo/
- https://noithatgiahung.org/
- https://noithatgiahung.org/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=4.5
- https://noithatgiahung.org/wp-content/plugins/wp-live-chat-support/css/wplcstyle.css?ver=7.1.06
- https://noithatgiahung.org/wp-content/plugins/wp-live-chat-support/images/iconRetina.png
- https://noithatgiahung.org/wp-content/plugins/wp-live-chat-support/images/iconCloseRetina.png
- https://noithatgiahung.org/wp-content/plugins/wp-live-chat-support/images/bg/cloudy.jpg
- https://noithatgiahung.org/wp-content/plugins/wp-live-chat-support/css/themes/theme-default.css?ver=7.1.06
- https://noithatgiahung.org/wp-content/plugins/wp-live-chat-support/css/themes/position-bottom-right.css?ver=7.1.06
- https://noithatgiahung.org/wp-content/plugins/wp-responsive-menu/css/wprmenu.css?ver=4.6.21
- https://noithatgiahung.org/wp-includes/js/jquery/jquery.js?ver=1.12.4
- https://noithatgiahung.org/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
- https://noithatgiahung.org/wp-content/plugins/wp-live-chat-support/js/wplc_server.js?ver=7.1.06
- https://noithatgiahung.org/wp-content/plugins/wp-live-chat-support/js/wplc_u.js?ver=7.1.06
- https://noithatgiahung.org/wp-content/plugins/wp-live-chat-support/js/md5.js?ver=7.1.06
- https://noithatgiahung.org/wp-content/plugins/wp-live-chat-support/js/themes/classic.js?ver=7.1.06
- https://noithatgiahung.org/wp-content/plugins/wp-live-chat-support/js/jquery-cookie.js?ver=4.6.21
- https://noithatgiahung.org/wp-content/plugins/wp-responsive-menu/js/jquery.transit.min.js?ver=4.6.21
- https://noithatgiahung.org/wp-content/plugins/wp-responsive-menu/js/jquery.sidr.js?ver=4.6.21
Embedded domains
- fonts.googleapis.com
- noithatgiahung.org
- yoast.com
- schema.org
- s.w.org
- api.w.org
- static.zotabox.com
- css.digestcolect.com
- embed.tawk.to
- gmail.com
- connect.facebook.net
Embedded IP addresses
- 20.184.175.23
- 4.247.188.224
- 52.230.60.54
- 4.230.171.124
- 40.84.97.4
- 135.232.92.137
- 20.165.94.46
- 74.178.76.54
- 4.150.223.114
- 74.178.76.128
- 203.26.79.13
- 52.123.128.14
- 20.231.239.246
- 172.178.240.162
- 172.66.2.5
- 52.148.114.188
- 162.159.142.9
- 92.223.78.30
- 72.145.35.106
- 4.209.250.170
- 51.104.15.252
- 20.42.73.24
- 20.184.175.8
- 52.168.117.174
- 20.184.175.12
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report