MALICIOUS — 41ba75e2cc662312208ca104eef866c115cc51002681493a13354d43f1f496cc
MALICIOUS — 41ba75e2cc662312208ca104eef866c115cc51002681493a13354d43f1f496cc is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the Group10 family. 2 of 54 detection engines flagged it.
Identification
- SHA-256:
41ba75e2cc662312208ca104eef866c115cc51002681493a13354d43f1f496cc - SHA-1:
2d521c4b61023289cc93ca0ee76ba99ddd23227e - MD5:
b13c80141f29c17e92a8490941a1e14a - ssdeep:
768:8pu8Ytg0Mg+MY5c3VGha0RC4+Wx/9SLida2Y:IuFg0Mg+MY5gTh4+m9SLida2Y - TLSH:
T10E2DC92713556EA248E1094DE9240C54E038FE9F9A377CE58546EF87FC0E960CCBA89D - Submitted as: 41ba75e2cc662312208ca104eef866c115cc51002681493a13354d43f1f496cc
- File type: html · Size: 29153 bytes
- Verdict: malicious (92/100) · Family: Group10
Detections (2 of 54 engines)
- YARA: ESET research: IIS_Group10
- Microsoft Defender: Trojan:HTML/Redirector.SLYA!MTB
Why this verdict
The malicious score of 92/100 is the fusion of 6 weighted signals:
- YARA: ESET research flagged IIS_Group10 (rule
IIS_Group10) - engine signal, weight 0.70, confidence 0.70 - Microsoft Defender flagged Trojan:HTML/Redirector.SLYA!MTB (rule
Trojan:HTML/Redirector.SLYA!MTB) - engine signal, weight 0.55, confidence 0.85 - Obfuscated powershell script: dynamic-exec (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: http://www.changshun-sh.cn/wp-content/themes/dt-the7/set-cookie.php?devicePixelRatio=, http://www.changshun-sh.cn/wp-content/plugins/sitepress-multilingual-cms/res/css/language-selector.css?v=3.1.5, http://gmpg.org/xfn/11 - static signal, weight 0.35, confidence 0.60
- Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
281 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- edge.microsoft.com
- time.windows.com
- settings-win.data.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
Embedded URLs
- http://www.changshun-sh.cn/wp-content/themes/dt-the7/set-cookie.php?devicePixelRatio=
- http://www.changshun-sh.cn/wp-content/plugins/sitepress-multilingual-cms/res/css/language-selector.css?v=3.1.5
- http://gmpg.org/xfn/11
- http://www.changshun-sh.cn/xmlrpc.php
- http://www.changshun-sh.cn/wp-content/themes/dt-the7/html5.js
- http://www.changshun-sh.cn/wp-content/themes/dt-the7/js/plugins/validator/validationEngine.jquery.css?ver=4.0.33
- http://www.changshun-sh.cn/wp-content/plugins/formcraft3/assets/css/form.css?ver=3.2.4
- http://www.changshun-sh.cn/wp-content/plugins/formcraft3/assets/css/common-elements.css?ver=3.2.4
- http://www.changshun-sh.cn/wp-content/plugins/revslider/public/assets/css/settings.css?ver=5.2.6
- http://www.changshun-sh.cn/wp-content/plugins/wp-job-manager/assets/css/frontend.css?ver=4.0.33
- http://www.changshun-sh.cn/wp-content/plugins/masterslider/public/assets/css/masterslider.main.css?ver=2.0.1
- http://www.changshun-sh.cn/wp-content/plugins/masterslider/assets/custom.css?ver=1.0
- http://www.changshun-sh.cn/wp-content/themes/dt-the7/css/main.css?ver=4.2.2
- http://www.changshun-sh.cn/wp-content/themes/dt-the7/css/font-awesome.min.css?ver=4.2.2
- http://www.changshun-sh.cn/wp-content/uploads/wp-less/dt-the7/css/custom-da06e74323.css?ver=4.2.2
- http://www.changshun-sh.cn/wp-content/themes/dt-the7/css/media.css?ver=4.2.2
- http://www.changshun-sh.cn/wp-content/themes/dt-the7/royalslider/royalslider.css?ver=4.2.2
- http://www.changshun-sh.cn/wp-content/themes/dt-the7/style.css?ver=4.2.2
- http://www.changshun-sh.cn/wp-includes/js/jquery/jquery.js?ver=1.11.1
- http://www.changshun-sh.cn/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1
- http://www.changshun-sh.cn/wp-content/plugins/revslider/public/assets/js/jquery.themepunch.tools.min.js?ver=5.2.6
- http://www.changshun-sh.cn/wp-content/plugins/revslider/public/assets/js/jquery.themepunch.revolution.min.js?ver=5.2.6
- http://www.changshun-sh.cn/wp-content/themes/dt-the7/js/modernizr.js?ver=4.2.2
- http://www.changshun-sh.cn/wp-content/themes/dt-the7/js/svg-icons.js?ver=4.2.2
- http://www.changshun-sh.cn/
Embedded domains
- www.changshun-sh.cn
- gmpg.org
- dev.3dunion.cn
- beian.miit.gov.cn
- chrome.360.cn
- www.firefox.com.cn
- ie.sogou.com
- www.maxthon.cn
- liulanqi.baidu.com
- www.theworld.cn
- windows.microsoft.com
- www.google.com
- support.apple.com
- www.opera.com
- wp-rocket.me
Embedded IP addresses
- 4.1.3.1
- 52.178.17.3
- 52.253.84.76
- 4.230.171.124
- 85.210.193.152
- 52.110.12.16
- 52.148.114.188
- 52.110.12.48
- 72.153.5.137
More Group10 samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report