SUSPICIOUS — 3771cb9c615333a7230796d7df10fa643e9e7883bd90f6a0fbfb630ec5fe27c0

SUSPICIOUS — 3771cb9c615333a7230796d7df10fa643e9e7883bd90f6a0fbfb630ec5fe27c0 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: 3771cb9c615333a7230796d7df10fa643e9e7883bd90f6a0fbfb630ec5fe27c0
• SHA-1: c1240fb657d964b0cab9edda73e5b05d45724998
• MD5: 937c2dc7c31f55c647dd13cef545aac2
• ssdeep: 3072:dM9rCX7CeTsPqRcVhIVs2LQezvj40MZEPjLpUxAfYxslxNcl8CLcXmNRSxZszpZx:IocijXmNR6m
• TLSH: T1D63B3C9E7D48BD8D4D480011399D6DA831C76A1F94A380E997B6EF84DC2CCA16C5C8BF
• Submitted as: 3771cb9c615333a7230796d7df10fa643e9e7883bd90f6a0fbfb630ec5fe27c0
• File type: html · Size: 105507 bytes
• Verdict: suspicious (54/100)

Detections (2 of 50 engines)

• Microsoft Defender: TrojanClicker:JS/Faceliker.N
• Kaspersky (KVRT): Trojan.JS.FBook.bk

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://travinhngaymoi.blogspot.com/favicon.ico, http://travinhngaymoi.blogspot.com/feeds/posts/default - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
• https://plus.google.com/110103455382982674742
• http://travinhngaymoi.blogspot.com/favicon.ico
• http://travinhngaymoi.blogspot.com/2013/04/dich-vu-phat-to-roi-quan-1.html
• http://travinhngaymoi.blogspot.com/feeds/posts/default
• http://travinhngaymoi.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/7467538825771500967/posts/default
• http://travinhngaymoi.blogspot.com/feeds/5258574841778327817/comments/default
• http://toroidotphamoi.com/images/phat_to_roi_cao_oc_van_phong_3.jpg
• https://lh3.googleusercontent.com/proxy/z7dwZIiBexJ9lpLr38mU5N8Ewff4xFyi1JtjpkMdS6-US4mbscWaKEOIlOGwsAYVw2GbAHywQCnzhp1ukLo5HBMossXL5dS_uCTcRjplD9uPP0VS2eu4=w1200-h630-p-k-no-nu
• http://www.premiumbloggertemplates.com/
• http://www.bloggertipandtrick.net/
• http://creativecommons.org/licenses/by/3.0/
• http://www.facebook.com/plugins/like.php?href=
• https://www.facebook.com/yeuphache
• https://ajax.googleapis.com/ajax/libs/mootools/1.3.1/mootools-yui-compressed.js
• http://mootools.net/more
• http://mad4milk.net
• http://www.jondesign.net/
• http://3.bp.blogspot.com/-TAdAWREOzCM/Th6JBm6MRPI/AAAAAAAACSU/JiEd4HQeh5s/s000/background.jpg
• http://3.bp.blogspot.com/-k-wWcTVO3UA/Th6JCOrSdnI/AAAAAAAACSc/1IKLnAxiAKQ/s000/container-bg.png

Embedded domains

• www.w3.org
• www.google.com
• connect.facebook.net
• www.blogger.com
• plus.google.com
• travinhngaymoi.blogspot.com
• toroidotphamoi.com
• lh3.googleusercontent.com
• www.bloggertipandtrick.net
• www.premiumbloggertemplates.com
• creativecommons.org
• www.facebook.com
• lbox.style.top
• ajax.googleapis.com
• mootools.net
• mad4milk.net
• www.jondesign.net
• greengeckodesign.com
• this.btn.store
• entry.link
• posttitle.link
• readmorelink.link
• 3.bp.blogspot.com
• 4.bp.blogspot.com
• 1.bp.blogspot.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report