MALICIOUS — 25366996789798f151c95435f009e6ee8e4eb3e0538b08ef52f6e6543d99a00e

MALICIOUS — 25366996789798f151c95435f009e6ee8e4eb3e0538b08ef52f6e6543d99a00e is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the Wacatac family. 2 of 54 detection engines flagged it.

Identification

SHA-256: 25366996789798f151c95435f009e6ee8e4eb3e0538b08ef52f6e6543d99a00e
SHA-1: ca72d19590e207f8f51357d8bbedb19d2159d076
MD5: 3696aee7aa37bec4fb230cde59ac869d
ssdeep: 384:Vy/DgohPzL/DvAN+DxVU1YoK/DyOfgQ44451UdbNzq/DyOfgyh98L0Qoy:3kXAN+7U17c344y1mc5y
TLSH: T19A2C290D51782C8F87992D5E64A1707D88AEE1FF50E7BADCA7C26F881861C50E03A177
Submitted as: 25366996789798f151c95435f009e6ee8e4eb3e0538b08ef52f6e6543d99a00e
File type: html · Size: 25626 bytes
Verdict: malicious (92/100) · Family: Wacatac

Detections (2 of 54 engines)

Microsoft Defender: Trojan:Script/Wacatac.B!ml
Kaspersky (KVRT): HEUR:Hoax.HTML.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 7 weighted signals:

Microsoft Defender flagged Trojan:Script/Wacatac.B!ml (rule Trojan:Script/Wacatac.B!ml) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Hoax.HTML.Phish.gen (rule HEUR:Hoax.HTML.Phish.gen) - engine signal, weight 0.55, confidence 0.85
Obfuscated javascript script: dynamic-exec, defense-evasion (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, https://code.jquery.com/jquery-3.1.1.min.js, https://code.jquery.com/jquery-3.3.1.js - static signal, weight 0.35, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

279 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
https://code.jquery.com/jquery-3.1.1.min.js
https://code.jquery.com/jquery-3.3.1.js
https://ow2.res.office365.com/owalanding/2020.1.16.01/images/favicon.ico?v=4
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
https://fonts.googleapis.com/css?family=Archivo+Narrow&display=swap
https://kit.fontawesome.com/585b051251.js
https://code.jquery.com/jquery-3.2.1.slim.min.js
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
http://farmtechsuppliesnorth.co.uk/wp-admin/includes/image-edt.php
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

ajax.googleapis.com
code.jquery.com
ow2.res.office365.com
maxcdn.bootstrapcdn.com
fonts.googleapis.com
kit.fontawesome.com
jamstockex.com
cdnjs.cloudflare.com
stackpath.bootstrapcdn.com
www.office.com
farmtechsuppliesnorth.co.uk
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.73.26
52.123.252.231
4.230.171.124
20.247.184.142
85.210.193.152
20.165.94.54
20.165.94.63
51.105.71.137
135.233.95.144
13.69.116.109
172.64.154.167
92.223.78.30
72.145.35.97
52.148.114.188
52.110.12.18
52.110.12.54

More Wacatac samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report