SUSPICIOUS — 4087b9e32a456d132ca0eb9362b4a5b45ad8a74e3495e32ac81a23cb1c765219

SUSPICIOUS — 4087b9e32a456d132ca0eb9362b4a5b45ad8a74e3495e32ac81a23cb1c765219 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 53 detection engines flagged it.

Identification

• SHA-256: 4087b9e32a456d132ca0eb9362b4a5b45ad8a74e3495e32ac81a23cb1c765219
• SHA-1: be3a5abb59a878c8c8ba5ef444fea5f45c0aba81
• MD5: 24ad749696df572dbfe1a0109bc924ce
• ssdeep: 768:S7qYxOlxlhEq7XZgLiHHSffaDWzd+d3nE:S7qYxOlxlhE6ZgEHSffTz8ZnE
• TLSH: T1692EA42643097BCF1591150AA56218E8D449E0EFBF11A1E64FC6EF4C98BCEB0C07F6A5
• Submitted as: 4087b9e32a456d132ca0eb9362b4a5b45ad8a74e3495e32ac81a23cb1c765219
• File type: html · Size: 30309 bytes
• Verdict: suspicious (54/100)

Detections (1 of 53 engines)

• Microsoft Defender: flagged

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec, defense-evasion (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6, http://www.macromedia.com/go/getflashplayer, http://www.hntvsthn.com/Upload/image/1125947832_15887415449151n.jpg - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd
• http://www.w3.org/1999/xhtml
• http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6
• http://www.macromedia.com/go/getflashplayer
• http://www.hntvsthn.com/Upload/image/1125947832_15887415449151n.jpg
• http://www.hntvsthn.com/Upload/image/1125944912_15886838248811n.jpg
• http://www.hntvsthn.com/Upload/image/1125947892_15887439104961n.jpg
• http://www.hntvsthn.com/Upload/image/3b18-isyparf4250789.png
• http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6
• http://www.xinhuanet.com/politics/2020-05/11/1125966548_15891541355801n.jpg
• https://v.qq.com/x/page/u3034w77xxs.html?__t=1&ptag=1.qzone&_out=101
• http://www.ccdi.gov.cn/
• http://www.hnsjct.gov.cn/sitesources/hnsjct/page_pc/index.html
• http://www.cntv.cn/
• http://tv.cctv.com/cctv13/?spm=C28340.PsvRSVFIZBBB.E2PQtIunpEaz.19
• http://www.hnppb.gov.cn/html/1/525/index.html
• http://www.hnr.cn/hntv/wspd/
• http://hntv4.hnr.cn/
• http://www.people.com.cn/
• http://hntv2.hnr.cn/
• http://newpaper.dahe.cn/dhb
• http://www.dahe.cn/
• http://www.hnr.cn/hntv/mspd/
• http://newpaper.dahe.cn/hnrb
• http://www.hnep.gov.cn/index.htm

Embedded domains

• www.w3.org
• download.macromedia.com
• www.macromedia.com
• www.hntvsthn.com
• 126.com
• fpdownload.macromedia.com
• www.xinhuanet.com
• v.qq.com
• www.ccdi.gov.cn
• www.hnsjct.gov.cn
• www.cntv.cn
• tv.cctv.com
• www.hnppb.gov.cn
• www.hnr.cn
• hntv4.hnr.cn
• www.people.com.cn
• hntv2.hnr.cn
• newpaper.dahe.cn
• www.dahe.cn
• www.hnep.gov.cn
• nynct.henan.gov.cn
• www.hnly.gov.cn
• www.ifeng.com
• www.hnsl.gov.cn
• beian.miit.gov.cn

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report