MALICIOUS — 3f7841aaf292f50b747ea9969a05044b7a6c25e68ff50e10a4751be7a66a3780
MALICIOUS — 3f7841aaf292f50b747ea9969a05044b7a6c25e68ff50e10a4751be7a66a3780 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (70/100). 0 of 54 detection engines flagged it.
Identification
- SHA-256:
3f7841aaf292f50b747ea9969a05044b7a6c25e68ff50e10a4751be7a66a3780 - SHA-1:
e0b5b25e27aa4626a40ef6fdc2b401695a072383 - MD5:
59774f48d66073a1d78cee95099c9ba3 - ssdeep:
1536:55jv/WvSFQv7W75wWLZofNMbh5Otk+z+GhqqGY00bVoqDGPtuInkInTECC4gzlf:X/WvSFQv7W75wWLZofNMbh5Otk+z+GhD - TLSH:
T1FF38684957A2788F55D8844AF26C08FC8844FEDFAD21BCE08B45DB4BE454D6188BF1CA - Submitted as: 3f7841aaf292f50b747ea9969a05044b7a6c25e68ff50e10a4751be7a66a3780
- File type: html · Size: 78879 bytes
- Verdict: malicious (70/100)
Detections (0 of 54 engines)
No engine flagged this sample.
Why this verdict
The malicious score of 70/100 is the fusion of 5 weighted signals:
- Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 3 external host(s) and 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://madhattersl.com/skin/frontend/tv_themevast_package/default/favicon.ico, https://fonts.googleapis.com/css?family=Roboto:400, https://fonts.googleapis.com/css?family=Lato:300 - static signal, weight 0.35, confidence 0.60
- Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
276 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
Embedded URLs
- http://www.w3.org/1999/xhtml
- https://madhattersl.com/skin/frontend/tv_themevast_package/default/favicon.ico
- https://fonts.googleapis.com/css?family=Roboto:400
- https://fonts.googleapis.com/css?family=Lato:300
- https://fonts.googleapis.com/css?family=Montserrat:400
- https://fonts.googleapis.com/css?family=Lato:400
- https://madhattersl.com/js/blank.html
- https://madhattersl.com/js/spacer.gif
- https://connect.facebook.net/en_US/fbevents.js
- https://www.facebook.com/tr?id=151707075238576&ev=PageView&noscript=1
- https://madhattersl.com/js/calendar/calendar-win2k-1.css
- https://madhattersl.com/skin/frontend/tv_themevast_package/default/css/font-awesome.css
- https://madhattersl.com/skin/frontend/tv_themevast_package/default/css/jquery.fullPage.css
- https://madhattersl.com/skin/frontend/tv_themevast_package/default/css/animate.css
- https://madhattersl.com/skin/frontend/tv_themevast_package/default/css/styles.css
- https://madhattersl.com/skin/frontend/base/default/css/widgets.css
- https://madhattersl.com/skin/frontend/base/default/css/flexibleforms/flexibleforms.css
- https://madhattersl.com/skin/frontend/tv_themevast_package/default/themevast/plugin/css/owl.carousel.css
- https://madhattersl.com/skin/frontend/tv_themevast_package/default/css/print.css
- https://madhattersl.com/js/prototype/prototype.js
- https://madhattersl.com/js/lib/ccard.js
- https://madhattersl.com/js/prototype/validation.js
- https://madhattersl.com/js/scriptaculous/builder.js
- https://madhattersl.com/js/scriptaculous/effects.js
- https://madhattersl.com/js/scriptaculous/dragdrop.js
Embedded domains
- www.w3.org
- madhattersl.com
- fonts.googleapis.com
- www.gstatic.com
- connect.facebook.net
- www.facebook.com
- www.google-analytics.com
- dynarch.com
- www.dynarch.com
- gnu.org
- schema.org
- madhatterstl.com
- www.google.com
- www.csia.org
- www.ncsg.org
- www.nadca.com
- www.ductcleanersnetwork.org
- biggreenegg.com
- www.napoleongrills.com
- www.traegergrills.com
- www.weber.com
- www.googleadservices.com
- googleads.g.doubleclick.net
- google.com
Embedded IP addresses
- 4.150.223.102
- 52.123.252.216
- 52.123.252.241
- 4.230.171.124
- 57.154.63.210
- 20.247.184.197
- 52.123.252.239
- 20.165.94.46
- 135.232.92.137
- 20.184.175.10
- 74.178.76.54
- 20.165.94.63
- 203.26.79.13
- 20.236.44.162
- 40.104.4.2
- 40.99.134.18
- 162.159.142.9
- 52.123.128.14
- 135.233.45.222
- 52.148.114.188
- 52.110.12.11
- 52.110.12.32
- 74.179.77.204
- 20.42.65.85
- 4.207.44.71
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report