MALICIOUS — 408b898746466386582c11ca4a988c3da20df8f0cc4a8a4b6ce3f2897cc1e973

MALICIOUS — 408b898746466386582c11ca4a988c3da20df8f0cc4a8a4b6ce3f2897cc1e973 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: 408b898746466386582c11ca4a988c3da20df8f0cc4a8a4b6ce3f2897cc1e973
• SHA-1: e6db10a50bdee8cce25b388eda4be9433acafbe2
• MD5: 0830fb60639e25668e55ec2955da212b
• ssdeep: 12288:WgGm3J9nLYWAVZQHmx9nLYWAVZQTToK9nLYWAVZQM:ZJ9LYWAr9LYWAS9LYWAv
• TLSH: T10D527D7EB851D488182E8743B119FF80DA7E12668D07334564BBAFCEEC39450AF611DA
• Submitted as: 408b898746466386582c11ca4a988c3da20df8f0cc4a8a4b6ce3f2897cc1e973
• File type: html · Size: 959399 bytes
• Verdict: malicious (96/100)

Detections (3 of 54 engines)

• ClamAV (daily): Win.Trojan.Agent-36393
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic
• Microsoft Defender: Virus:VBS/Ramnit.B

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Agent-36393 (rule Win.Trojan.Agent-36393) - engine signal, weight 0.90, confidence 0.95
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• Obfuscated vbscript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/3822632116-css_bundle_v2.css, https://aimvidiyal.blogspot.com/favicon.ico, http://aimvidiyal.blogspot.com/ - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://www.blogger.com/static/v1/widgets/3822632116-css_bundle_v2.css
• https://aimvidiyal.blogspot.com/favicon.ico
• http://aimvidiyal.blogspot.com/
• https://aimvidiyal.blogspot.com/feeds/posts/default
• https://aimvidiyal.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/5024367665445027793/posts/default
• https://www.blogger.com/profile/15233122214959168257
• https://www.blogger.com/static/v1/jsbin/403901366-ieretrofit.js
• https://www.istockphoto.com/googleimages.php?id=11394138&amp
• https://www.blogger.com/dyn-css/authorization.css?targetBlogID=5024367665445027793&amp
• https://apis.google.com/js/plusone.js
• http://schema.org/Blog
• https://aimvidiyal.blogspot.com/
• https://aimvidiyal.blogspot.com/p/my-side.html
• https://aimvidiyal.blogspot.com/p/blog-page.html
• https://aimvidiyal.blogspot.com/p/blog-page_19.html
• http://schema.org/BlogPosting
• https://aimvidiyal.blogspot.com/2015/11/all-in-one.html
• http://www.w3.org/1999/xhtml
• http://purl.org/dc/elements/1.1/
• http://schema.org/Person
• http://aimvidiyal.blogspot.com/2015/11/all-in-one.html
• https://aimvidiyal.blogspot.com/2015/11/all-in-one.html#comment-form
• https://www.blogger.com/post-edit.g?blogID=5024367665445027793&postID=3453628347967635495&from=pencil
• https://resources.blogblog.com/img/icon18_edit_allbkg.gif

Embedded domains

• www.blogger.com
• aimvidiyal.blogspot.com
• themes.googleusercontent.com
• www.istockphoto.com
• www.blogblog.com
• blogspot.com
• apis.google.com
• pagead2.googlesyndication.com
• schema.org
• www.w3.org
• purl.org
• this.ua
• this.name
• document.store
• resources.blogblog.com

Embedded IP addresses

• 6.0.4.12
• 6.2.2.0
• 6.0.4.11
• 6.0.4.25
• 6.2.2.1
• 6.0.3.8
• 6.0.3.42
• 6.2.2.2

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report