SUSPICIOUS — 41f44fede9c7b298cbd7807dab5a32378909d747a837c3a8b64bcc603ef4e528

SUSPICIOUS — 41f44fede9c7b298cbd7807dab5a32378909d747a837c3a8b64bcc603ef4e528 is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 50 detection engines flagged it.

Identification

• SHA-256: 41f44fede9c7b298cbd7807dab5a32378909d747a837c3a8b64bcc603ef4e528
• SHA-1: a47426b94968566c41313689bec56637b3e4f362
• MD5: ec741206cf410f03c7e8de46995de3e3
• ssdeep: 192:lcCegpgkL+0o7lDv6HRP0BMHaC14s7EBurmr4RhXptYinL/IZiEs:lf/8uRsMHaK7EBuyEjXpqinMwEs
• TLSH: T1AA23868A3FD8A945850442772DC41058EFE19C1FA29234CD4568CFC9DEEEB2B78B8563
• Submitted as: 41f44fede9c7b298cbd7807dab5a32378909d747a837c3a8b64bcc603ef4e528
• File type: script · Size: 11018 bytes
• Verdict: suspicious (54/100)

Detections (1 of 50 engines)

• Microsoft Defender: Trojan:Script/Wacatac.B!ml

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://cleverjump.org/counter.js, https://semalt.com, https://semalt.com/?s= - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cleverjump.org/counter.js
• https://semalt.com
• https://semalt.com/?s=
• https://semalt.com/popups/popup_wow.php?lang=en

Embedded domains

• kickvox.com
• kindhunter.com
• cleverjump.org
• semalt.com
• sitesuites.net
• trustpilot.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report