MALICIOUS — 3f784118c0a53a7994d2322e3b2bccac5649a7dd5c128809daec401e049e4a85
MALICIOUS — 3f784118c0a53a7994d2322e3b2bccac5649a7dd5c128809daec401e049e4a85 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (70/100). 0 of 54 detection engines flagged it.
Identification
- SHA-256:
3f784118c0a53a7994d2322e3b2bccac5649a7dd5c128809daec401e049e4a85 - SHA-1:
91236209f50730bd9c2952f6a683462a960a5250 - MD5:
04ad5f8916cf6edb2dac96f5088b7156 - ssdeep:
3072:9F7k0xeZhm0rgrpkT3tKqvhSUGUT5Br765TLgb5drNO:9F7k0QZhm0rPbI - TLSH:
T12B3CFB6FB345395F04A546A075DC12EA10CB8ACFF43946EBE9A3EF88D86CC213954C16 - Submitted as: 3f784118c0a53a7994d2322e3b2bccac5649a7dd5c128809daec401e049e4a85
- File type: html · Size: 116072 bytes
- Verdict: malicious (70/100)
Detections (0 of 54 engines)
No engine flagged this sample.
Why this verdict
The malicious score of 70/100 is the fusion of 5 weighted signals:
- Obfuscated powershell script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 2 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css, http://html5shiv.googlecode.com/svn/trunk/html5.js, http://popikapakfotograflari.blogspot.com/favicon.ico - static signal, weight 0.35, confidence 0.60
- Extracted generic config (13 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
280 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- edge.microsoft.com
- time.windows.com
- settings-win.data.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css
- http://html5shiv.googlecode.com/svn/trunk/html5.js
- http://popikapakfotograflari.blogspot.com/favicon.ico
- http://popikapakfotograflari.blogspot.com/2012/08/islami-kapak-fotograflar-ve-resimleri.html
- http://popikapakfotograflari.blogspot.com/feeds/posts/default
- http://popikapakfotograflari.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/4910428751000843779/posts/default
- http://popikapakfotograflari.blogspot.com/feeds/3460050824274793307/comments/default
- https://www.blogger.com/static/v1/jsbin/403901366-ieretrofit.js
- http://3.bp.blogspot.com/-0T1WwVDqitA/UA7zJXKHSbI/AAAAAAAABB0/ETTOYH4oR54/s1600/islami+facebook+kapak+resimleri-kabe-mekke-ALLAH-din-dini-ramazan-ramadan-kapak-dini-kapaklar-download-face-kapaklar%C4%B1-facebook-facebook-cover-facebook-covers-facebook-kapak-facebook-kapaklar-facebook-kapaklar%C4%B1-fot.jpg
- http://3.bp.blogspot.com/-0T1WwVDqitA/UA7zJXKHSbI/AAAAAAAABB0/ETTOYH4oR54/w1200-h630-p-k-no-nu/islami+facebook+kapak+resimleri-kabe-mekke-ALLAH-din-dini-ramazan-ramadan-kapak-dini-kapaklar-download-face-kapaklar%C4%B1-facebook-facebook-cover-facebook-covers-facebook-kapak-facebook-kapaklar-facebook-kapaklar%C4%B1-fot.jpg
- http://fonts.googleapis.com/css?family=Fjalla+One
- https://www.blogger.com/static/v1/widgets/1535467126-widget_css_2_bundle.css
- http://fonts.googleapis.com/css?family=Raleway:300
- http://www.soratemplates.com
- https://lh6.googleusercontent.com/-6UyQr7E0nTU/UVRWwhvPScI/AAAAAAAAFUU/15cIvW74xwg/s50/quote.png
- http://2.bp.blogspot.com/-sGSqsoE7i34/VVCT0z3vJrI/AAAAAAAAFLk/LwLAU7SRpYI/s1600/border.png
- http://3.bp.blogspot.com/-ltyYh4ysBHI/U04MKlHc6pI/AAAAAAAADQo/PFxXaGZu9PQ/w200-h140-c/no-image.png
- http://3.bp.blogspot.com/-moj4-jk-UB0/U1qCkCPaGQI/AAAAAAAADTY/tixmak8NHV8/s1600/share.png
- http://4.bp.blogspot.com/-M_utSb-nN04/U6V8Gut9dJI/AAAAAAAAAjE/6g1X58pjjcg/s1600/single-share.png
- http://4.bp.blogspot.com/-R8OKVUsis3s/UgZEksy0V1I/AAAAAAAAAT4/QtN9sBHMZis/s1600/icon-search.png
Embedded domains
- www.w3.org
- www.google.com
- www.blogger.com
- html5shiv.googlecode.com
- popikapakfotograflari.blogspot.com
- 3.bp.blogspot.com
- fonts.googleapis.com
- netdna.bootstrapcdn.com
- www.soratemplates.com
- lh6.googleusercontent.com
- 2.bp.blogspot.com
- 4.bp.blogspot.com
- 1.bp.blogspot.com
- www.themecap.com
- ajax.googleapis.com
- entry.link
- blogspot.com
- connect.facebook.net
- apis.google.com
- pagead2.googlesyndication.com
- data-vocabulary.org
- schema.org
- motifiles.com
- hackorg.com
- a4.sphotos.ak.fbcdn.net
Embedded IP addresses
- 51.105.71.136
- 20.247.184.142
- 52.123.252.242
- 4.230.171.124
- 52.110.12.28
- 52.110.12.45
- 20.42.179.192
- 52.110.12.50
- 52.148.114.188
- 52.110.12.33
- 72.145.35.97
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report