SUSPICIOUS — 31e11345d340663174e1f290a0af454738babe38367d9f699acea44a1caca04a

SUSPICIOUS — 31e11345d340663174e1f290a0af454738babe38367d9f699acea44a1caca04a is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: 31e11345d340663174e1f290a0af454738babe38367d9f699acea44a1caca04a
• SHA-1: 0f7a199bbe297a0632d416e29dd4608efa742af9
• MD5: 16a7aa0caaa72575e8371a1ac980f259
• ssdeep: 3072:iJc8VnIZ6x8/72S4BhYld0pQOHyLEdayTB:iJcinI0x8iS20SNHyLEd1
• TLSH: T1B83B3BEB794F6E5CDD4D510B3D8ABD0ABB039909BAA3E4C1E2F9CF4454B0CD1141886A
• Submitted as: 31e11345d340663174e1f290a0af454738babe38367d9f699acea44a1caca04a
• File type: script · Size: 106552 bytes
• Verdict: suspicious (54/100)

Detections (2 of 50 engines)

• Microsoft Defender: Trojan:JS/Agent.AG!MSR
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec, defense-evasion (layers: char-code+concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: http://labs.skinkers.com/touchSwipe/, http://plugins.jquery.com/project/touchSwipe, http://greensock.com - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.github.com/mattbryson
• https://github.com/mattbryson/TouchSwipe-Jquery-Plugin
• http://labs.skinkers.com/touchSwipe/
• http://plugins.jquery.com/project/touchSwipe
• http://greensock.com
• http://greensock.com/standard-license
• http://www.w3.org/1999/xhtml
• http://www.w3.org/2000/svg
• http://www.greensock.com/club/

Embedded domains

• www.github.com
• github.com
• labs.skinkers.com
• plugins.jquery.com
• be.top
• bd.top
• console.info
• greensock.com
• d.to
• www.w3.org
• e.to
• www.greensock.com
• b.style.top
• coralprintpack.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report