SUSPICIOUS — 32319409744622768bdaef899a4d829dba00a2cc555b70d6395c3eef96b0fd49
SUSPICIOUS — 32319409744622768bdaef899a4d829dba00a2cc555b70d6395c3eef96b0fd49 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 0 of 53 detection engines flagged it.
Identification
- SHA-256:
32319409744622768bdaef899a4d829dba00a2cc555b70d6395c3eef96b0fd49 - SHA-1:
99ac4fb052ab4b14c65dc5bd086c1fa47949378b - MD5:
e7f1870d28452071156d46b235ea4109 - ssdeep:
1536:Y0JaD28Xa7kAIWoJWrlm92SSaA3o9P6fTMVusHPddHWymG/TD:Y+aDvXa7kbWoJWrlE2SSaA3o9P6f4Vu0 - TLSH:
T1D736830E0A19A6DF0DA1094E756CBC9E48D3D7F38BF607F9889D9F8DE40CE641845A02 - Submitted as: 32319409744622768bdaef899a4d829dba00a2cc555b70d6395c3eef96b0fd49
- File type: html · Size: 67719 bytes
- Verdict: suspicious (54/100)
Detections (0 of 53 engines)
No engine flagged this sample.
Why this verdict
The suspicious score of 54/100 is the fusion of 4 weighted signals:
- Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 19 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: http://rozblog.com/temp/rang/like.png, http://serahi.rozblog.com/, http://serahi.rozblog.com/post/39 - static signal, weight 0.35, confidence 0.60
- Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
276 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
Embedded URLs
- http://rozblog.com/temp/rang/like.png
- http://serahi.rozblog.com/
- http://serahi.rozblog.com/post/39
- http://www.rozblog.com/theme/rozblog_v4/favi1.ico
- https://rozup.ir/view/2975050/Hormoz.js
- http://hormozdl.ir/
- http://hormozmusic.ir/code/popup
- http://rozblog.com/ads.php
- http://rozblog.com/temp/news_v3/responsiv/1.png
- http://rozblog.com/editor/Rb_editor/images/smileys/003.gif
- http://rozblog.com/editor/Rb_editor/images/smileys/004.gif
- http://serahi.rozblog.com/cat/1
- http://serahi.rozblog.com/cat/6
- http://serahi.rozblog.com/tag/%D9%85%D9%8A%D8%A7%D9%86%D8%A8%D8%B1
- http://serahi.rozblog.com/tag/%D9%83%D9%84%D9%8A%D8%AF
- http://serahi.rozblog.com/tag/%D9%88%D9%8A%D9%86%D8%AF%D9%88%D8%B2
- http://serahi.rozblog.com/post/92
- http://serahi.rozblog.com/post/91
- http://serahi.rozblog.com/post/90
- http://serahi.rozblog.com/post/89
- http://serahi.rozblog.com/post/88
- http://serahi.rozblog.com/post/85
- http://serahi.rozblog.com/post/84
- http://serahi.rozblog.com/post/83
- http://serahi.rozblog.com/post/82
Embedded domains
- rozblog.com
- serahi.rozblog.com
- www.rozblog.com
- rozup.ir
- hormozdl.ir
- hormozmusic.ir
- fawzdl.rozblog.com
- dosootdl.rozblog.com
- awlandl.rozblog.com
- rustydl.rozblog.com
- rustidl.rozblog.com
- payiiz.rozblog.com
- 26dey.rozblog.com
- 23mehr.rozblog.com
- sarzaminam.rozblog.com
- tavalodam.rozblog.com
- timi.rozblog.com
- esfandd.rozblog.com
- jangel.rozblog.com
- taraik.rozblog.com
- maghas.rozblog.com
- shabo.rozblog.com
- asemn.rozblog.com
- nerfhibana.rozblog.com
- iyes.rozblog.com
Embedded IP addresses
- 4.150.223.106
- 20.247.185.124
- 4.230.171.124
- 20.42.179.204
- 172.215.188.225
- 20.165.94.63
- 20.42.65.85
- 74.178.240.51
- 20.76.201.171
- 52.123.129.14
- 135.233.95.80
- 135.234.160.244
- 203.26.79.13
- 52.148.114.188
- 162.159.142.9
- 72.153.5.133
- 48.200.63.27
- 52.110.12.53
- 52.110.12.52
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report