SUSPICIOUS — 377ce045b606528792fa9c62d83b65548c553bac2db61dd43217e553810b7c6c
SUSPICIOUS — 377ce045b606528792fa9c62d83b65548c553bac2db61dd43217e553810b7c6c is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
377ce045b606528792fa9c62d83b65548c553bac2db61dd43217e553810b7c6c - SHA-1:
36bcbccdbc80de309af9963ad6266b2b0266c93e - MD5:
51d767150edb4259d843cdbfeecab266 - ssdeep:
3072:ds7gKXwFLmlJQJhcACEz/5yaTPuA0xDdY6w0Jkseu+3HOIZVu7o0aJXBxe7B1PnS:Vmlkh7CED4aTPuA0xTaR - TLSH:
T14044C79A3352DFC7CCF5185132AC8DD448C15FAF9C7100E6DE6B8E89A94C5A1A0C94BB - Submitted as: 377ce045b606528792fa9c62d83b65548c553bac2db61dd43217e553810b7c6c
- File type: html · Size: 248659 bytes
- Verdict: suspicious (54/100)
Detections (2 of 50 engines)
- Microsoft Defender: TrojanClicker:JS/Faceliker.M
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://sellnow24h.blogspot.com/favicon.ico, http://sellnow24h.blogspot.com/ - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://sellnow24h.blogspot.com/favicon.ico
- http://sellnow24h.blogspot.com/
- http://sellnow24h.blogspot.com/feeds/posts/default
- http://sellnow24h.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/6929342414105417173/posts/default
- https://www.blogger.com/profile/13870555073258578387
- http://www.theme-junkie.com
- http://www.gnu.org/licenses/gpl.html
- http://3.bp.blogspot.com/-YMEFqN6JEEQ/T9eq9nhfTzI/AAAAAAAAAd8/B5lXqf9WM_s/s1600/search.png
- http://4.bp.blogspot.com/-Jl1LloaWNOo/T9erHOw73NI/AAAAAAAAAeE/mpa_P-grG_Y/s1600/bg-header.png
- http://3.bp.blogspot.com/-pVTHEVEGgnk/T856c6_u2xI/AAAAAAAAAdc/xHsvlTgTn70/s1600/basnetgnewstubelogo.png
- http://1.bp.blogspot.com/-gtcd4Px_C8c/T9erT6vwHJI/AAAAAAAAAeM/og6azyjPCUM/s1600/slash.png
- http://3.bp.blogspot.com/-sVgaIJj7dSg/T9ered4NjSI/AAAAAAAAAeU/deqi8auNXtQ/s1600/dot-gray.gif
- http://3.bp.blogspot.com/-_iRkULYJ1wA/T9erozTPppI/AAAAAAAAAec/lsqwKrrNMOE/s1600/comment.png
- http://1.bp.blogspot.com/-YS8GuwuETYY/T9er72dXLII/AAAAAAAAAek/JR2uaexj_Vs/s1600/tag.gif
- http://1.bp.blogspot.com/-Jq6wAJjELQ4/T9esGSAjjtI/AAAAAAAAAes/pXtmS5dKk5c/s1600/icon_home.png
- http://1.bp.blogspot.com/-fMHugrTA8_E/T9esULmsGtI/AAAAAAAAAe0/YUppLXTJUUg/s1600/graybg.png
- http://1.bp.blogspot.com/-5HbHqlRqYCU/T9esef7FpgI/AAAAAAAAAe8/mfy_gWpdjag/s1600/buzz.png
- http://4.bp.blogspot.com/-7GrmeUl-q6c/T9esnGQ-66I/AAAAAAAAAfE/zMhMBPdCVu8/s1600/twitter.png
- http://4.bp.blogspot.com/-W5GrlwJ0bY4/T9eszSDl4yI/AAAAAAAAAfM/tQTULgori_c/s1600/facebook.png
Embedded domains
- www.w3.org
- www.google.com
- www.blogger.com
- sellnow24h.blogspot.com
- www.theme-junkie.com
- www.gnu.org
- 3.bp.blogspot.com
- 4.bp.blogspot.com
- 1.bp.blogspot.com
- monotype.com
- www.freshthemes.com
- nguyenhuytap.googlecode.com
- basnetg.googlecode.com
- entry.link
- pttitle.link
- javascriptkit.com
- adfoc.us
- blogspot.com
- 2.bp.blogspot.com
- www.blogblog.com
- qaungvietmkt.blogspot.com
- quangvietmkt.blogspot.com
- demobuivansum.blogspot.com
- bloggertrix.com
- www.quangvietmkt.blogspot.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report