MALICIOUS — 2ebf0dbdf84fe07db08daed5adb0ec57dac61b59ea1254028c1dc5ee6ad744ce
MALICIOUS — 2ebf0dbdf84fe07db08daed5adb0ec57dac61b59ea1254028c1dc5ee6ad744ce is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the FKLR family. 1 of 54 detection engines flagged it.
Identification
- SHA-256:
2ebf0dbdf84fe07db08daed5adb0ec57dac61b59ea1254028c1dc5ee6ad744ce - SHA-1:
4bf77b708657ecf87f91c7d3db6aad0ef528d783 - MD5:
adae3ad2f91c9d375cba92a18495d1ce - ssdeep:
1536:r8zt9gSb9Q45NjNNxNcNzNSNSNHENJNbNouxS9:r8Z9gSbH5NjNNxNcNzNSNSNkNJNbNoJ - TLSH:
T18639B516A1F07D8F468554DE6094124D8CA6ADFFB413B0ED9AE48F87489CFA2F439423 - Submitted as: 2ebf0dbdf84fe07db08daed5adb0ec57dac61b59ea1254028c1dc5ee6ad744ce
- File type: html · Size: 85719 bytes
- Verdict: malicious (84/100) · Family: FKLR
Detections (1 of 54 engines)
- Emsisoft (Emergency Kit): Trojan.Agent.FKLR
Why this verdict
The malicious score of 84/100 is the fusion of 6 weighted signals:
- Emsisoft (Emergency Kit) flagged Trojan.Agent.FKLR (rule
Trojan.Agent.FKLR) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 2 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://1.bp.blogspot.com/-fQlEHOoKJkQ/YX-XIrRaiAI/AAAAAAAAAzE/3H2H_M4Xa1wBo4AfAc17RS03j6zPjPb1ACLcBGAsYHQ/s16000/og.jpg, https://www.circlek.com/, https://cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js - static signal, weight 0.35, confidence 0.60
- Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule
windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
277 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- windows.msn.com
- officeclient.microsoft.com
- www.msn.com
- odc.officeapps.live.com
- www.bing.com
- assets.msn.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
- slscr.update.microsoft.com
Embedded URLs
- https://1.bp.blogspot.com/-fQlEHOoKJkQ/YX-XIrRaiAI/AAAAAAAAAzE/3H2H_M4Xa1wBo4AfAc17RS03j6zPjPb1ACLcBGAsYHQ/s16000/og.jpg
- https://www.circlek.com/
- https://cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js
- https://cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js
- https://cdn.jsdelivr.cc/npm/sweetalert2@10.16.0/dist/sweetalert2.all.min.js
- https://cdn.jsdelivr.cc/npm/lazyload@2.0.0-rc.2/lazyload.min.js
- https://cdn.jsdelivr.cc/npm/popper.js@1.16.1/dist/umd/popper.min.js
- https://cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css
- https://1.bp.blogspot.com/-_2itH_r81Qo/YX-XISvOGZI/AAAAAAAAAy4/BJWGAYit41kTQHcYFfg7ezP-MhZoVYp0wCLcBGAsYHQ/s16000/fav.jpg
- https://www.googletagmanager.com/gtag/js?id=G-W0J2TVL3LV
- https://1.bp.blogspot.com/-7bE_kUdm_VQ/YX-XIvzBcDI/AAAAAAAAAy8/mq0-Vhpp2gsKmPEUifsjWsPKgihE_jpfgCLcBGAsYHQ/s16000/left.jpg
- https://1.bp.blogspot.com/-Tm2it-vPKrI/YX-XIpEk-pI/AAAAAAAAAzA/REzTGBpUNu4ZNRK6bnwh3aGq4rU3PYnngCLcBGAsYHQ/s16000/right.png
- https://1.bp.blogspot.com/-8HERSPJPfd0/YX-XIt_HNcI/AAAAAAAAAzI/6MfOrnFGHLIxC1u3BflBBUnHQpnFPg60QCLcBGAsYHQ/s16000/show.jpg
- https://1.bp.blogspot.com/-sdrIjMdB42E/YXzz7k3cbTI/AAAAAAAAApI/AoH2V-TSri4w4bCEc_B-Gt-pgSZ0HQO4QCLcBGAsYHQ/s16000/fullbox.png
- https://1.bp.blogspot.com/-tgdyzabxuJ4/YKpjmQ_UJKI/AAAAAAAABfk/VqO0bIY6vq0EZ9BvCyHwfUT8owQt7dzWwCLcBGAsYHQ/s16000/United-States_outbox.png
- https://1.bp.blogspot.com/-Gwq-UiON6tU/YXTrNWgMF3I/AAAAAAAAAXw/tDKf2UUqPoEkyylRV19A8fG7CLex6sb0ACLcBGAsYHQ/s16000/box1.png
- https://1.bp.blogspot.com/-zRt0wp89dXE/YXTrNT22hJI/AAAAAAAAAX4/c8jAEO0Qv2Qg3SR-DGHSGeCl11SHfvhnwCLcBGAsYHQ/s16000/box2.png
- https://1.bp.blogspot.com/-RC32duKA6Wo/YKpjmBkVOEI/AAAAAAAABfg/PraKjCk35xQl-wrsLztkUt-VUrh547z7wCLcBGAsYHQ/s16000/United-States_inbox.png
- https://1.bp.blogspot.com/-CZkQappqtxo/YXTrNaN480I/AAAAAAAAAX0/FTT6L1y9uAgtQeucN6x0E4C_ocU5qz9lgCLcBGAsYHQ/s16000/box3.png
- https://uprimp.com/bnr.php?section=General&pub=593174&format=300x50&ga=g
- https://1.bp.blogspot.com/-PEYYgiOPS4k/YViMnS-3XuI/AAAAAAAAHWs/JyysNfovYMg7BuZkmzHwT-n91tRIrP8NACLcBGAsYHQ/s320/172595348_963489621135355_2188756810941249324_n.jpg
- https://1.bp.blogspot.com/-0W1vl-oU3Y4/YTJ_0DLHUbI/AAAAAAAAEoc/Jq5jfbkXhXYzq6FV4cgeAFLBY463EYMvQCLcBGAsYHQ/s0/%25E6%259C%25AA%25E6%25A0%2587%25E9%25A2%2598-12.jpg
- https://1.bp.blogspot.com/-w921ZRdMfdA/YST_2L4MWmI/AAAAAAAADsM/1lrVCNi8Xak5rM5CXX8h3e-8FbNYLs5NQCLcBGAsYHQ/s0/135382406_907637009774974_7715230973965600187_n.jpg
- https://1.bp.blogspot.com/-nthM23mLdAM/YST_2Le86vI/AAAAAAAADsQ/uMGXHrzP9pgJXPiCPW8IObBLXYkSTTncACLcBGAsYHQ/s320/120352328_690448981819916_5724200416659735601_n.jpg
- https://1.bp.blogspot.com/-2ltiaLOjXus/YTKAAN3uBaI/AAAAAAAAEok/WPgRSf6R3qIpC1NAgvCWVY0oTMZvaKeogCLcBGAsYHQ/s0/%25E6%259C%25AA%25E6%25A0%2587%25E9%25A2%2598-4.jpg
Embedded domains
- 1.bp.blogspot.com
- www.circlek.com
- cdn.jsdelivr.cc
- www.googletagmanager.com
- c.top
- benfly.net
- uprimp.com
- v.gapis.xyz
- www.w3.org
- hm.baidu.com
Embedded IP addresses
- 41.17.79.44
- 40.79.167.9
- 52.123.252.238
- 52.230.60.54
- 4.230.171.124
- 20.165.94.54
- 4.150.223.112
- 135.232.92.137
- 85.210.196.11
- 52.110.12.2
- 52.110.12.33
- 20.42.65.90
- 13.69.116.105
- 72.154.7.114
- 92.223.78.30
- 52.148.114.188
- 52.110.12.40
- 52.110.12.52
More FKLR samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report