SUSPICIOUS — 408cd699ceb86a7de6bb28c40850164393436d0d97a29dbb703eeba203ebcd71
SUSPICIOUS — 408cd699ceb86a7de6bb28c40850164393436d0d97a29dbb703eeba203ebcd71 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
408cd699ceb86a7de6bb28c40850164393436d0d97a29dbb703eeba203ebcd71 - SHA-1:
1b8157ad2429e688a69acd581e2b8b01ca506616 - MD5:
21ec455568b80afb3511e620888ea240 - ssdeep:
1536:vDIyDIBEI9920jgGHo6/OdiUxUFYa9rYMq/oD9k6uEVCJCEk+u2qL4cfz1b:vDIyDIS/6/TUxUFYa9rYMqAOurfz1b - TLSH:
T132364D1A7B483D9A14A99017E6AC158490CADB2FA97380FDE0E6DDC49C7CC347C5886F - Submitted as: 408cd699ceb86a7de6bb28c40850164393436d0d97a29dbb703eeba203ebcd71
- File type: html · Size: 63544 bytes
- Verdict: suspicious (54/100)
Detections (2 of 53 engines)
- Microsoft Defender: TrojanClicker:JS/Faceliker.M
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://phimlg.blogspot.com/, http://www.megastar.vn/images/avatar_bg_home.jpg - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://schema.org/Blog
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://phimlg.blogspot.com/
- http://www.megastar.vn/images/avatar_bg_home.jpg
- http://4.bp.blogspot.com/-0XuNaC__-Og/UBEpLCFMGaI/AAAAAAAAAbE/mzaRCoWJtuc/s1600/topbar_bg.png
- http://traidatmuidotcom.appspot.com/background/home2.gif
- http://cdn1.iconfinder.com/data/icons/splashyIcons/arrow_state_grey_expanded.png
- http://2.bp.blogspot.com/-X--re-h3x1g/UA9zZyuEIEI/AAAAAAAAAA4/Prmvahj2pp4/s1600/search.gif
- http://2.bp.blogspot.com/-RtYmrLdfySU/UCErZeiEE1I/AAAAAAAABOg/ev7jbRyq46M/s1600/bg_outer.gif
- http://1.bp.blogspot.com/-WQraah1OChk/T_5MKRddtLI/AAAAAAAAAVM/EW6MjtdQYLc/s1600/fade.gif
- http://3.bp.blogspot.com/-eQQogJsi2HU/TvockUWpDfI/AAAAAAAABzo/ZgtxD627uns/s1600/list_01.gif
- http://3.bp.blogspot.com/-j6juk1cMeG8/UrG5DcEtRaI/AAAAAAAAFz8/BptmjvyJNF0/s1600/logo.png
- http://2.bp.blogspot.com/-iP5PmayAB8Y/UA9z1D7gqXI/AAAAAAAAABA/wuW3OULW-20/s1600/loading.gif
- http://2.bp.blogspot.com/-CTkeRGuzIHc/T92LBSP2NZI/AAAAAAAAA4g/zsORj7q2eRQ/s1600/img-all.png
- http://4.bp.blogspot.com/-WmZK0suPHKY/UBLFJvoZMgI/AAAAAAAAAcc/wRSGcoSnl_A/s1600/outer.png
- http://1.bp.blogspot.com/-i4Ljjxe2LCA/UBLFQySR11I/AAAAAAAAAck/mwn2r7mw3bg/s1600/prev.png
- http://2.bp.blogspot.com/-skWY8tCLJzQ/UBLFY_1A9TI/AAAAAAAAAcs/xExpI4fBHxs/s1600/next.png
- http://4.bp.blogspot.com/-dEjKORHNr4Y/ULR_oyc-QZI/AAAAAAAAAiE/qg3ztvwOQHg/s1600/f_lb.png
- http://3.bp.blogspot.com/-NCoeUHH77NI/T_17-vYBCuI/AAAAAAAAAVI/w68X40lulXM/s1600/news.gif
- http://1.bp.blogspot.com/-qv2Mzr12QfY/UBQ65pfnxyI/AAAAAAAAAag/cwf1cj7G4Og/s1600/body-bg.png
- http://3.bp.blogspot.com/-KJUiqc0PLKs/T_-QLiU7OZI/AAAAAAAAAWc/SIzlZsusxiw/s1600/tonho.png
Embedded domains
- schema.org
- www.w3.org
- www.google.com
- www.blogger.com
- phimlg.blogspot.com
- www.aol.com
- www.infoseek.com
- www.excite.com
- www.hotbot.com
- www.lycos.com
- www.magellan.com
- www.looksmart.com
- www.cnet.com
- www.voila.com
- www.google.fr
- www.yahoo.fr
- www.yahoo.com
- www.alltheweb.com
- www.msn.com
- www.netscape.com
- www.nomade.com
- 4.bp.blogspot.com
- traidatmuidotcom.appspot.com
- cdn1.iconfinder.com
- 2.bp.blogspot.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report