MALICIOUS — 2551fe1bbdcb47e25739e51eae73a0635de36e106022b465cdf02e937f0e5129

MALICIOUS — 2551fe1bbdcb47e25739e51eae73a0635de36e106022b465cdf02e937f0e5129 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 2551fe1bbdcb47e25739e51eae73a0635de36e106022b465cdf02e937f0e5129
• SHA-1: 05c59935b6cb0a36ae85a6e10cbca9194fb80595
• MD5: fe31e003a172232cb8b8aefece624cbc
• ssdeep: 6144:ksMYod+X3oI+YosMYod+X3oI+Yd0sMYod+X3oI+YW:y5d+X305d+X3jC5d+X3c
• TLSH: T1EC48AF959071D18F0907A797A22F728CCF6FE4D1820B3B81555ABB8F092A540FF924E7
• Submitted as: 2551fe1bbdcb47e25739e51eae73a0635de36e106022b465cdf02e937f0e5129
• File type: html · Size: 353462 bytes
• Verdict: malicious (93/100)

Detections (4 of 53 engines)

• ClamAV (daily): Win.Trojan.Agent-36393
• Microsoft Defender: Virus:VBS/Ramnit.gen!A
• Emsisoft (Emergency Kit): Trojan.Dropper.VBS.Q
• Kaspersky (KVRT): Trojan-Dropper.VBS.Agent.bp

Why this verdict

The malicious score of 93/100 is the fusion of 3 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Agent-36393 (rule Win.Trojan.Agent-36393) - engine signal, weight 0.90, confidence 0.95
• Obfuscated vbscript script: dynamic-exec (layers: base64) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: http://zg7.com/, http://zg7.com/forum.php, http://zg7.com/template/jingyun_toutiao/zhanzhuaicn_img/common/bbs.ico - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd
• http://www.w3.org/1999/xhtml
• http://zg7.com/
• http://zg7.com/forum.php
• http://zg7.com/template/jingyun_toutiao/zhanzhuaicn_img/common/bbs.ico
• http://zg7.com/source/plugin/austgl_audio/player/APlayer.min.css
• http://zg7.com/source/plugin/austgl_audio/player/APlayer.min.js
• https://www.zg7.com/
• http://www.discuz.net
• http://beian.miit.gov.cn/
• http://www.comsenz.com
• http://wpa.qq.com/msgrd?V=3&amp
• http://zg7.com/home.php?mod=misc%26ac=sendmail%26rand=1636331406

Embedded domains

• www.w3.org
• zg7.com
• www.zg7.com
• www.discuz.net
• beian.miit.gov.cn
• www.comsenz.com
• wpa.qq.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report