SUSPICIOUS — 282b46086b107433df22398e4aed6774a7ab45d0489c0dbd000bf3f2fd270b88

SUSPICIOUS — 282b46086b107433df22398e4aed6774a7ab45d0489c0dbd000bf3f2fd270b88 is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 282b46086b107433df22398e4aed6774a7ab45d0489c0dbd000bf3f2fd270b88
• SHA-1: 0395735120ed86d8bd05d2d3f2c5869e014cbc67
• MD5: 5b6b95a5336a74ef78d1e7a1b427ea37
• ssdeep: 384:NkfJtGvWjT6uYvqhCz8wSEHESxtVAFPQcYpeib+9rOEKXWdYsnzu:NC7T6uYvn8wRxwyryVOEKXWxnzu
• TLSH: T1022C737315AD3E88D00F5227799DF03B2D725EAA71AFB884D27EE614DC24210D81D2B6
• Submitted as: 282b46086b107433df22398e4aed6774a7ab45d0489c0dbd000bf3f2fd270b88
• File type: script · Size: 25148 bytes
• Verdict: suspicious (54/100)

Detections (2 of 53 engines)

• Microsoft Defender: Trojan:JS/Agent.AG!MSR
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec, defense-evasion (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: http://opensource.org/licenses/MIT - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://opensource.org/licenses/MIT

Embedded domains

• vincentgarreau.com
• opensource.org
• github.com
• cc.ipasito.net

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report