SUSPICIOUS — 377930b3c2c1888be16d34657bac4329ecea4ec0a90bc2b50ec00fe42237e031

SUSPICIOUS — 377930b3c2c1888be16d34657bac4329ecea4ec0a90bc2b50ec00fe42237e031 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 3 of 50 detection engines flagged it.

Identification

• SHA-256: 377930b3c2c1888be16d34657bac4329ecea4ec0a90bc2b50ec00fe42237e031
• SHA-1: 5ef504561c099a608ca8ac20ad55e97c00f68fe0
• MD5: 55068ee3f027f64195b1e521d7d8256d
• ssdeep: 3072:PLQ4SPZD3UcjvG8rMZcXmNRS72vE7bGvy9cdwAx8Cw15Up:MJvXmNRiC
• TLSH: T1B541F71A3E3A794A44F2D14379DC4BE851A5471AB637C6F4E073EB80E438F24689D81B
• Submitted as: 377930b3c2c1888be16d34657bac4329ecea4ec0a90bc2b50ec00fe42237e031
• File type: html · Size: 182559 bytes
• Verdict: suspicious (54/100)

Detections (3 of 50 engines)

• Microsoft Defender: TrojanClicker:JS/Faceliker.U
• Emsisoft (Emergency Kit): JS:Trojan.Cryxos.5402
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://fonts.googleapis.com/css?family=Oswald, http://fonts.googleapis.com/css?family=Bitter - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
• http://fonts.googleapis.com/css?family=Oswald
• http://fonts.googleapis.com/css?family=Bitter
• http://xathu-net.blogspot.com/favicon.ico
• http://xathu-net.blogspot.com/search/label/Keksmiz%206143
• http://xathu-net.blogspot.com/feeds/posts/default
• http://xathu-net.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/3207181585681718496/posts/default
• https://www.blogger.com/profile/01373257163736742445
• http://www.premiumbloggertemplates.com/
• http://www.bloggertipandtrick.net/
• http://www.premiumbloggertemplates.com/funnygames-blogger-template/
• http://creativecommons.org/licenses/by/3.0/
• http://3.bp.blogspot.com/-7RkYXopseJw/VCKTiw2nWDI/AAAAAAAAOd4/9t3f4LGAhQg/s000/background.png
• http://3.bp.blogspot.com/-oOYjcD4OdD8/VCKRqclwGMI/AAAAAAAAOcA/hEWjJC1RIo8/s1600/main-bg.png
• http://1.bp.blogspot.com/-gp2_t1TIwok/U-Iyyeu03aI/AAAAAAAAMuw/MJtQbFTf-jo/s1600/meta-separator.png
• http://2.bp.blogspot.com/-6zWGEaGjaYM/VCKRtNypTEI/AAAAAAAAOcg/HEuChU9obTo/s1600/widget-list.png
• http://4.bp.blogspot.com/-GOH4hi9uZxw/VCKRpGdu0MI/AAAAAAAAOb8/6N71aWtEgDY/s1600/footer-widgets-bg.png
• http://2.bp.blogspot.com/-_Y8xmAmYiOM/VCKRssiKXjI/AAAAAAAAOcc/X080vYQrlOs/s1600/search.png
• https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js
• http://jquery.com

Embedded domains

• www.w3.org
• www.google.com
• www.blogger.com
• fonts.googleapis.com
• xathu-net.blogspot.com
• www.bloggertipandtrick.net
• www.premiumbloggertemplates.com
• creativecommons.org
• 3.bp.blogspot.com
• 1.bp.blogspot.com
• 2.bp.blogspot.com
• 4.bp.blogspot.com
• ajax.googleapis.com
• jquery.org
• e.fn.live
• jquery.com
• github.com
• www.opensource.org
• www.gnu.org
• users.tpg.com.au
• jquery.malsup.com
• malsup.com
• entry.link
• posttitle.link
• readmorelink.link

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report