MALICIOUS — 377eee2585353391620cad0ff14f072675cd1a525cf613a89671701ed87bf8bb

MALICIOUS — 377eee2585353391620cad0ff14f072675cd1a525cf613a89671701ed87bf8bb is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 377eee2585353391620cad0ff14f072675cd1a525cf613a89671701ed87bf8bb
• SHA-1: 5570b8fbb16fce3eac87251a1574ddb3bdcbb3c8
• MD5: 5705ae3c38c5627e4a6151f7a764d178
• ssdeep: 384:1LneuoMfsjeUpelRVXIoULaUjP62ndllwlTQvhWd:1L4HjeUpejViZ22nO
• TLSH: T19C29CA19A9312F870854015A26AC86A930DED56B833352F990F7EB40FD2DEB0BA55CC6
• Submitted as: 377eee2585353391620cad0ff14f072675cd1a525cf613a89671701ed87bf8bb
• File type: html · Size: 19848 bytes
• Verdict: malicious (93/100)

Detections (4 of 50 engines)

• ClamAV (daily): Html.Exploit.Agent-6598769-0
• Microsoft Defender: TrojanClicker:JS/Faceliker.AR
• Emsisoft (Emergency Kit): Trojan.Script.613694
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 93/100 is the fusion of 3 weighted signals:

• ClamAV (daily) flagged Html.Exploit.Agent-6598769-0 (rule Html.Exploit.Agent-6598769-0) - engine signal, weight 0.90, confidence 0.95
• Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: http://ajax.googleapis.com/ajax/libs/jquery/1.5.2/jquery.min.js, https://www.blogger.com/static/v1/widgets/3822632116-css_bundle_v2.css, http://howtowhitenteethz.blogspot.com/favicon.ico - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• http://ajax.googleapis.com/ajax/libs/jquery/1.5.2/jquery.min.js
• https://www.blogger.com/static/v1/widgets/3822632116-css_bundle_v2.css
• http://howtowhitenteethz.blogspot.com/favicon.ico
• http://howtowhitenteethz.blogspot.com/2013/06/
• http://howtowhitenteethz.blogspot.com/feeds/posts/default
• http://howtowhitenteethz.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/8256804082922131263/posts/default
• https://www.blogger.com/static/v1/jsbin/403901366-ieretrofit.js
• https://www.blogger.com/dyn-css/authorization.css?targetBlogID=8256804082922131263&amp
• http://www.facebook.com/plugins/like.php?href=https://www.facebook.com/mysabunace&layout=button_count&show_faces=false&
• https://apis.google.com/js/plusone.js
• https://www.blogger.com/static/v1/widgets/745028019-widgets.js
• http://howtowhitenteethz.blogspot.com/
• http://howtowhitenteethz.blogspot.com/search
• https://www.blogger.com
• https://www.blogger.com/static/v1/jsbin/1671149202-lbx.js
• https://www.blogger.com/static/v1/v-css/4076883957-lightbox_bundle.css

Embedded domains

• www.w3.org
• www.google.com
• ajax.googleapis.com
• www.blogger.com
• howtowhitenteethz.blogspot.com
• www.blogblog.com
• blogspot.com
• www.facebook.com
• apis.google.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report