SUSPICIOUS — 377f8295f4825a0a18bc6188f77b7097068ff8f1b886d0b2479c0c8e6778de8a

SUSPICIOUS — 377f8295f4825a0a18bc6188f77b7097068ff8f1b886d0b2479c0c8e6778de8a is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 50 detection engines flagged it.

Identification

• SHA-256: 377f8295f4825a0a18bc6188f77b7097068ff8f1b886d0b2479c0c8e6778de8a
• SHA-1: bb119f243a0c0f5d6017ad58b0214ea384cdfbe4
• MD5: 310c456f87245f64215a3a8ae2f66252
• ssdeep: 384:g+XQ64LhrSpjgwFfyTXUT8VVZdxDUS3jdBde0Cf8Q+GJKSSvaPYS+Z:ZXt8FS5p6rUT8h7DVRB4QQ+GJzFI
• TLSH: T1652DD8A15BAA14E9E4A40137E5888DF4E044F31F693883A7CE595F4B396CE309D4E387
• Submitted as: 377f8295f4825a0a18bc6188f77b7097068ff8f1b886d0b2479c0c8e6778de8a
• File type: html · Size: 27950 bytes
• Verdict: suspicious (54/100)

Detections (1 of 50 engines)

• Emsisoft (Emergency Kit): Trojan.GenericKD.71543566

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://gmpg.org/xfn/11, https://zz.bdstatic.com/linksubmit/push.js, http://push.zhanzhang.baidu.com/push.js - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gmpg.org/xfn/11
• https://zz.bdstatic.com/linksubmit/push.js
• http://push.zhanzhang.baidu.com/push.js
• https://sp0.baidu.com/9_Q4simg2RQJ8t7jm9iCKT-xh_/s.gif
• https://13838383438.com/ynvhktag/%e4%b8%8a%e6%b5%b7%e5%8d%83%e8%8a%b1%e7%bd%91koby
• https://13838383438.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
• https://13838383438.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
• https://api.w.org/
• http://schema.org/BreadcrumbList
• http://schema.org/ListItem
• http://wpdrizzle.com/
• https://13838383438.com/wp-content/themes/business-buzz/js/skip-link-focus-fix.min.js?ver=20130115
• https://13838383438.com/wp-content/themes/business-buzz/vendors/cycle2/js/jquery.cycle2.min.js?ver=2.1.6
• https://13838383438.com/wp-content/themes/business-buzz/vendors/sidr/js/jquery.sidr.min.js?ver=2.2.1
• https://13838383438.com/wp-content/themes/business-buzz/js/custom.min.js?ver=1.0.1
• https://13838383438.com/wp-includes/js/wp-embed.min.js?ver=5.8

Embedded domains

• gmpg.org
• zz.bdstatic.com
• push.zhanzhang.baidu.com
• sp0.baidu.com
• api.share.baidu.com
• 13838383438.com
• api.w.org
• schema.org
• wordpress.org
• wpdrizzle.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report