MALICIOUS — 2904992f60c19434db0d82e233024c57d94d51a4d9ae0b42997ab3ad8017a2b7

MALICIOUS — 2904992f60c19434db0d82e233024c57d94d51a4d9ae0b42997ab3ad8017a2b7 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the Wacatac family. 1 of 54 detection engines flagged it.

Identification

SHA-256: 2904992f60c19434db0d82e233024c57d94d51a4d9ae0b42997ab3ad8017a2b7
SHA-1: 52b5eee2f049fd5363487c819b75f3949109ce22
MD5: 4fd515847cd714e3061ec33b1ed2ff5c
ssdeep: 768:i7IRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZDE:i7IRIOITIwIgIiKZgNDfIwIGI5IVJ7S2
TLSH: T1E32FA68676DACCC695CC639071842D446CD7AD4F0A25ECC9806FAEA2F87FFD011A4897
Submitted as: 2904992f60c19434db0d82e233024c57d94d51a4d9ae0b42997ab3ad8017a2b7
File type: html · Size: 34614 bytes
Verdict: malicious (84/100) · Family: Wacatac

Detections (1 of 54 engines)

Microsoft Defender: Trojan:Script/Wacatac.B!ml

Why this verdict

The malicious score of 84/100 is the fusion of 6 weighted signals:

Microsoft Defender flagged Trojan:Script/Wacatac.B!ml (rule Trojan:Script/Wacatac.B!ml) - engine signal, weight 0.55, confidence 0.85
Obfuscated javascript script: dynamic-exec (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://ogp.me/ns/fb#, http://nsovetnik.ru/files/folder/20150205uvar.png, https://images.ua.prom.st/772956328_w450_h450_8_dsc112.jpg - static signal, weight 0.35, confidence 0.60
Extracted generic config (7 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

278 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://ogp.me/ns/fb#
http://nsovetnik.ru/files/folder/20150205uvar.png
https://images.ua.prom.st/772956328_w450_h450_8_dsc112.jpg
https://www.guard.np.gov.ua/files/com_news/1473777116524629001473777116.jpeg
http://airingprojects.weebly.com/1/post/2017/10/dogovor-ohrani-objekta-ukraina.html
https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
https://www.google.com/recaptcha/api.js
https://www.youtube.com/embed/YSMbr0SbfgY
https://www.youtube.com/embed/q-E1k9qhHvU
https://www.youtube.com/embed/mo3F2vLQzeE
http://twitter.com/share?url=http://airingprojects.weebly.com/1/post/2017/10/dogovor-ohrani-objekta-ukraina.html
http://airingprojects.weebly.com/blog/dogovor-ohrani-objekta-ukraina&is_mobile=&r=3&is_light=1
https://www.weebly.com/signup?utm_source=internal&utm_medium=footer
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

ogp.me
nsovetnik.ru
www.guard.np.gov.ua
airingprojects.weebly.com
cdn2.editmysite.com
fonts.googleapis.com
cdn1.editmysite.com
ajax.googleapis.com
www.weebly.com
www.google.com
www.youtube.com
twitter.com
google-analytics.com
test.name
ec.editmysite.com
connect.facebook.net
tter.com
images.ua.prom.st
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.65.85
4.230.171.124
40.84.85.40
52.230.59.222
20.165.94.63
20.184.175.21
74.178.76.54
172.64.154.167
20.42.65.89
57.154.63.210
4.150.223.100
52.148.114.188
72.145.35.109
52.110.12.42
52.110.12.56

More Wacatac samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report