SUSPICIOUS — 305e70e676c1c6166f2d5ae656bd3383b6e281327f3c3fefbb80220d57f07853
SUSPICIOUS — 305e70e676c1c6166f2d5ae656bd3383b6e281327f3c3fefbb80220d57f07853 is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
305e70e676c1c6166f2d5ae656bd3383b6e281327f3c3fefbb80220d57f07853 - SHA-1:
430782cc6272cc5d5a683e531939030d515d0ab8 - MD5:
f65b61ef1d58cf2359e5e7ee15600dfb - ssdeep:
3072:xRcyzSM8lyfkeiS2SiNmkkXV6VV4uqlDLeo3:xRcGl8lneuSiNmkkXyV4uWH - TLSH:
T17E3D4BE7B90FAF6DC949614B3DCAFD0A7B034915FA96E0C4F1F9CA4858B0C91142C4A6 - Submitted as: 305e70e676c1c6166f2d5ae656bd3383b6e281327f3c3fefbb80220d57f07853
- File type: script · Size: 124765 bytes
- Verdict: suspicious (54/100)
Detections (2 of 53 engines)
- Microsoft Defender: Trojan:JS/Agent.AG!MSR
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://layerslider.kreaturamedia.com/, https://layerslider.kreaturamedia.com/licensing/ - static signal, weight 0.35, confidence 0.60
Dynamic analysis (windows)
1185 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- searchapp.bundleassets.example
- inference.location.live.net
- desktop-hsgcbep
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 250.255.255.239.in-addr.arpa
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- 23.40.52.209
- 23.11.37.157
- 20.190.167.150
- 20.190.167.65
- 23.33.238.135
- 150.171.22.17
Embedded URLs
- https://layerslider.kreaturamedia.com/
- https://layerslider.kreaturamedia.com/licensing/
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- layerslider.kreaturamedia.com
- this.ca
- h.ca
- v.to
- y.to
- i.to
- u.to
- s.ca
- www.w3.org
- t.style.top
- alliancehp.org
Embedded IP addresses
- 52.168.117.171
- 172.172.255.218
- 48.211.4.16
- 20.247.184.197
- 4.230.171.124
- 20.231.239.246
- 20.165.94.63
- 74.178.76.54
- 57.155.101.212
- 162.159.36.2
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report