MALICIOUS — 2d1e0e116e7f6f5821165ccbf0786bf0827281f73e4d07a3378757fd62dc8b7d
MALICIOUS — 2d1e0e116e7f6f5821165ccbf0786bf0827281f73e4d07a3378757fd62dc8b7d is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100), attributed to the Redirector family. 2 of 54 detection engines flagged it.
Identification
- SHA-256:
2d1e0e116e7f6f5821165ccbf0786bf0827281f73e4d07a3378757fd62dc8b7d - SHA-1:
96dd74a98857627eef749f39207a602db4df248d - MD5:
caf412b33b57755dcd8391c787284699 - ssdeep:
12:lPghJAcLfjptDjePvteJQ/KiFttPOTHRRcOLFzqqJmMXWXGKkAbMbm:lP8JAcrePEJaxtgTHsqffX/obMi - TLSH:
T1FA112031B0798D1740E8048B559A77CBF0C5F82FD769B442DB44EF48002C2E08005352 - Submitted as: 2d1e0e116e7f6f5821165ccbf0786bf0827281f73e4d07a3378757fd62dc8b7d
- File type: html · Size: 728 bytes
- Verdict: malicious (89/100) · Family: Redirector
Detections (2 of 54 engines)
- Microsoft Defender: Trojan:HTML/Redirector.AXIB!MTB
- Emsisoft (Emergency Kit): Trojan.HTML.Redirector.FB
Why this verdict
The malicious score of 89/100 is the fusion of 5 weighted signals:
- Microsoft Defender flagged Trojan:HTML/Redirector.AXIB!MTB (rule
Trojan:HTML/Redirector.AXIB!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.HTML.Redirector.FB (rule
Trojan.HTML.Redirector.FB) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 2 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule
windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
281 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- edge.microsoft.com
- time.windows.com
- settings-win.data.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
Dropped files
- 4bebee08ebb80775022a36177ee57b1f82b9c711e9534835daa7d2cfd5a678bb -
4bebee08ebb80775022a36177ee57b1f82b9c711e9534835daa7d2cfd5a678bb
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded IP addresses
- 20.50.201.204
- 4.144.132.223
- 52.123.252.233
- 4.230.171.124
- 172.66.2.5
- 52.110.12.19
- 52.110.12.54
- 48.211.4.16
- 52.110.12.38
- 72.154.7.17
- 52.148.114.188
More Redirector samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report