MALICIOUS — 3f7207c0fa5781776880058c9f0182c26bbbfc2d7a7d255f4b8c8b0b36d4bea0
MALICIOUS — 3f7207c0fa5781776880058c9f0182c26bbbfc2d7a7d255f4b8c8b0b36d4bea0 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (83/100), attributed to the MS06014 family. 2 of 53 detection engines flagged it.
Identification
- SHA-256:
3f7207c0fa5781776880058c9f0182c26bbbfc2d7a7d255f4b8c8b0b36d4bea0 - SHA-1:
5545d47dffeab1b6f220fd6fcaa1a2ae0403a120 - MD5:
5c1044918b538945cb3bcfff335fd2dd - ssdeep:
1536:KOxIpMTPlXBBTPCLyuagSb211+W1EPwWTSN:BLlXBBgN - TLSH:
T16E35100D48AE26A904D7A6DF3AC498D386858DDF0BFDF3B2444D4F1A5402D64AC1EF89 - Submitted as: 3f7207c0fa5781776880058c9f0182c26bbbfc2d7a7d255f4b8c8b0b36d4bea0
- File type: html · Size: 59766 bytes
- Verdict: malicious (83/100) · Family: MS06014
Detections (2 of 53 engines)
- Microsoft Defender: Exploit:VBS/MS06014.B
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 83/100 is the fusion of 5 weighted signals:
- Memory forensics: 2 finding(s), e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85 - Obfuscated vbscript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 22 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: http://bia2fun.com/url/Telegram/join.js, http://bandarabbasi.rozfa.ir/tag/%D8%AF%D8%A7%D9%86%D9%84%D9%88%D8%AF+%D8%A2%D9%87%D9%86%DA%AF%D9%87%D8%A7%DB%8C+%D9%82%D8%AF%DB%8C%D9%85%DB%8C+%D8%A7%D8%B2+%DA%A9%D8%A7%D9%85%D8%B1%D8%A7%D9%86+%D9%88+%D9%87%D9%88%D9%85%D9%86, http://rozblog.com/temp/skin/ahangfa/images/rate.png - static signal, weight 0.35, confidence 0.60
- Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
278 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
Embedded URLs
- http://bia2fun.com/url/Telegram/join.js
- http://bandarabbasi.rozfa.ir/tag/%D8%AF%D8%A7%D9%86%D9%84%D9%88%D8%AF+%D8%A2%D9%87%D9%86%DA%AF%D9%87%D8%A7%DB%8C+%D9%82%D8%AF%DB%8C%D9%85%DB%8C+%D8%A7%D8%B2+%DA%A9%D8%A7%D9%85%D8%B1%D8%A7%D9%86+%D9%88+%D9%87%D9%88%D9%85%D9%86
- http://rozblog.com/temp/skin/ahangfa/images/rate.png
- http://bandarabbasi.rozfa.ir/rss.xml
- http://rozblog.com/temp/skin/ahangfa/script.js
- http://rozblog.com/temp/skin/ahangfa/preloader.js
- http://rozblog.com/temp/skin/ahangfa/style.css
- http://rozblog.com/temp/skin/ahangfa/ie.css
- http://google.com/search
- http://bandarabbasi.rozfa.ir/
- http://rozblog.com/temp/skin/ahangfa/images/home.png
- http://bandarabbasi.rozfa.ir/forum
- http://bandarabbasi.rozfa.ir/register
- http://bandarabbasi.rozfa.ir/archive
- http://bandarabbasi.rozfa.ir/contact
- http://lordiran.mepanel.ir/rb.php?row=4&cols=2&cat=0&bsize=468*60
- http://bandarabbasi.rozfa.ir/user/bandarabbasi.gif
- http://rozblog.com/temp/skin/ahangfa/images/arrow_2.gif
- http://bandarabbasi.rozfa.ir/archive/1390
- http://bandarabbasi.rozfa.ir/archive/1389
- http://cooldl.net/
- http://www.ebrahimkalate.rzb.ir/
- http://rozblog.com/temp/skin/ahangfa/images/Blackdown.gif
- http://rozblog.com/temp/skin/ahangfa/images/Blackpause.gif
- http://rozblog.com/temp/skin/ahangfa/images/Blackup.gif
Embedded domains
- bia2fun.com
- bandarabbasi.rozfa.ir
- rozblog.com
- ebrahimkalate.rzb.ir
- lordiran.mepanel.ir
- gempop.ir
- gemup.ir
- www.online-vakil.ir
- www.vakilmashhad.ir
- www.tefm.ir
- www.toosdownload.ir
- dllup.ir
- www.bia2fun.com
- www.bia2fa.ir
- cooldl.net
- www.ebrahimkalate.rzb.ir
- www.tak3da-download.tk
- ebrahimkalate.r98.ir
- www.googletagmanager.com
- google.com
- aefd.nelreports.net
Embedded IP addresses
- 4.150.223.111
- 52.123.252.215
- 4.230.171.124
- 172.215.188.225
- 20.247.184.197
- 74.179.77.204
- 20.42.73.30
- 74.178.240.51
- 52.123.128.14
- 20.112.250.133
- 20.184.175.4
- 135.233.45.223
- 203.26.79.13
- 74.179.71.159
- 162.159.142.9
- 52.148.114.188
- 4.150.223.115
- 4.150.223.96
- 72.154.7.113
- 135.233.95.144
- 52.110.12.16
- 52.110.12.51
More MS06014 samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report