MALICIOUS — 3f7e70ef30d0f961888eaefda415bd82a2889a5af6a807f457a6a3d3ead67422

MALICIOUS — 3f7e70ef30d0f961888eaefda415bd82a2889a5af6a807f457a6a3d3ead67422 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the TrojanClicker family. 3 of 54 detection engines flagged it.

Identification

SHA-256: 3f7e70ef30d0f961888eaefda415bd82a2889a5af6a807f457a6a3d3ead67422
SHA-1: e37bcc6749c6b64eff3f0824bd724d02326bf1d1
MD5: eefa1567a3f2af39f973b9c70d7178db
ssdeep: 1536:B2ZIil6rOXJLl4oroNk+NkV2/JZJnFAJlJlOp4IdfM3NCJKFvg56uTw6eaUDDkAa:ctNroNk+NkV2/JZJnFAH3ubdfIwsFw1j
TLSH: T15B37FA1ABE646F8608446951A6ED06D811CAE6AFE43383C5F0B6DFCEDC2CC70D44859E
Submitted as: 3f7e70ef30d0f961888eaefda415bd82a2889a5af6a807f457a6a3d3ead67422
File type: html · Size: 76560 bytes
Verdict: malicious (99/100) · Family: TrojanClicker

Detections (3 of 54 engines)

ClamAV (daily): Html.Exploit.Agent-6598769-0
Microsoft Defender: TrojanClicker:JS/Faceliker.A
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Html.Exploit.Agent-6598769-0 (rule Html.Exploit.Agent-6598769-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged TrojanClicker:JS/Faceliker.A (rule TrojanClicker:JS/Faceliker.A) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://videosproividoshd.blogspot.com/favicon.ico, http://videosproividoshd.blogspot.com/search/label/de%20hern%C3%83%C2%83%C3%82%C2%83%C3%83%C2%82%C3%82%C2%83%C3%83%C2%83%C3%82%C2%82%C3%83%C2%82%C3%82%C2%83%C3%83%C2%83%C3%82%C2%83%C3%83%C2%82%C3%82%C2%82%C3%83%C2%83%C3%82%C2%82%C3%83%C2%82%C3%82%C2%83%C3%83%C2%83%C3%82%C2%83%C3%83%C2%82%C3%82%C2%83%C3%83%C2%83%C3%82%C2%82%C3%83%C2%82%C3%82%C2%82%C3%83%C2%83%C3%82%C2%83%C3%83%C2%82%C3%82%C2%82%C3%83 - static signal, weight 0.35, confidence 0.60
Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

276 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/1999/xhtml
http://www.google.com/2005/gml/b
http://www.google.com/2005/gml/data
http://www.google.com/2005/gml/expr
https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
http://videosproividoshd.blogspot.com/favicon.ico
http://videosproividoshd.blogspot.com/search/label/de%20hern%C3%83%C2%83%C3%82%C2%83%C3%83%C2%82%C3%82%C2%83%C3%83%C2%83%C3%82%C2%82%C3%83%C2%82%C3%82%C2%83%C3%83%C2%83%C3%82%C2%83%C3%83%C2%82%C3%82%C2%82%C3%83%C2%83%C3%82%C2%82%C3%83%C2%82%C3%82%C2%83%C3%83%C2%83%C3%82%C2%83%C3%83%C2%82%C3%82%C2%83%C3%83%C2%83%C3%82%C2%82%C3%83%C2%82%C3%82%C2%82%C3%83%C2%83%C3%82%C2%83%C3%83%C2%82%C3%82%C2%82%C3%83
http://videosproividoshd.blogspot.com/feeds/posts/default
http://videosproividoshd.blogspot.com/feeds/posts/default?alt=rss
https://www.blogger.com/feeds/7716987968396810295/posts/default
https://www.blogger.com/profile/17592494680757167734
https://plus.google.com/ID/about
https://plus.google.com/ID/posts
http://bloggersviet.blogspot.com
http://duytemplates.tintucmoivn.com
http://creativecommons.org/licenses/by/3.0/
http://4.bp.blogspot.com/-ClgF7y4S6Qg/UVACskc3hsI/AAAAAAAAI8I/H7ip0-FdzRg/s1600/soc-icons.png
http://4.bp.blogspot.com/-bOlZ-I_xOfE/UIUTO4jvD8I/AAAAAAAAGHA/vbP2W8aKL3g/s1600/navdiv.png
http://2.bp.blogspot.com/-6p_AqXL70hQ/UQWPHMObw9I/AAAAAAAABZ0/f2UWIvjFkSQ/s1600/footerli.png
http://1.bp.blogspot.com/-6d-gKg5n314/UIgXL0CgRSI/AAAAAAAAGLw/d-1HsICc-ZE/s1600/scroll-top.png
http://4.bp.blogspot.com/-NTKXiugkHrs/UIeVQmEzDjI/AAAAAAAAGJ4/G92p5n8hgvY/s1600/downarrow-dark.png
http://4.bp.blogspot.com/-8JN3CC3DRqI/UIeVS92mK7I/AAAAAAAAGKI/1yWTcqwwoeY/s1600/rightarrow.png
http://3.bp.blogspot.com/-b87ofiAYLYE/UIeVRhW86hI/AAAAAAAAGKA/GDeFH3RWDBs/s1600/downarrow.png
http://3.bp.blogspot.com/-4wYNIaBoIuk/UIgHYfRe7SI/AAAAAAAAGLE/nm7NGyr6TzQ/s1600/uparrow.png
http://4.bp.blogspot.com/--Nv4pocoHaw/UNsHBB0Tx_I/AAAAAAAAFio/1Apz3KeMEPM/s1600/button-play.png

Embedded domains

www.w3.org
www.google.com
www.blogger.com
videosproividoshd.blogspot.com
plus.google.com
bloggersviet.blogspot.com
duytemplates.tintucmoivn.com
creativecommons.org
4.bp.blogspot.com
2.bp.blogspot.com
1.bp.blogspot.com
3.bp.blogspot.com
ajax.googleapis.com
blogspot.com
vi-vn.facebook.com
twitter.com
www.facebook.com
feedjit.com
widgets.amung.us
www.tintucmoivn.com
apis.google.com
melodiamp3.net
c1.popads.net
c2.popads.net
hot3x.us

Embedded IP addresses

4.207.44.64
4.144.132.114
4.230.171.124
52.110.12.25
52.110.12.42
20.184.175.7
40.79.141.155
48.211.4.16
184.84.165.136
52.110.12.3
52.148.114.188
72.145.35.106
52.110.12.37

More TrojanClicker samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report