SUSPICIOUS — jquery.favicon.run.js

SUSPICIOUS — jquery.favicon.run.js is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (49/100). 0 of 53 detection engines flagged it.

Identification

SHA-256: 420b64795e81ef22f1bfb134daf41ef3e9556d398d8069234bfe6ded8b0952f6
SHA-1: 3b40b27f42c9a78622ae4efe0764baec67f448fc
MD5: 2f1187c8bf3bebd1f8f423c5ca23eec6
ssdeep: 3:2LGXaSh1YjQNORRANGJZHpaFL8jcp3fn:2LGVh1YjQN+RAU7paxZp3fn
TLSH: T16B0B124021183374C2380130804813E60652B0343D2B23C51F5C03729C485A1380584C
Submitted as: jquery.favicon.run.js
File type: script · Size: 94 bytes
Verdict: suspicious (49/100)

Detections (0 of 53 engines)

No engine flagged this sample.

Why this verdict

The suspicious score of 49/100 is the fusion of 3 weighted signals:

Contacted 30 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://school-shop.su/4.gif - static signal, weight 0.35, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

290 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://school-shop.su/4.gif
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787729641&P2=404&P3=2&P4=hDGE3q7zOTe7euYpfSXl0q1%2feitfAH7AjWynq0dfbev27R9yHq12uVkSdDRMFnnL%2bWHUOTlj%2ff2RFrwqQyvOVQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787729662&P2=404&P3=2&P4=KYVYp%2fjjU5RvMC%2fqDfk%2b8eAlHeU3TSUZhqgYW0ajIzvY3LpJZ2fRYWn58R0TUXkMmrdi9hHC1NzF836amYC1cg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787126406&P2=404&P3=2&P4=ZrC2ax0prQi%2b6N1%2fs%2fBxs5Z9VAeKpDadWVHdKczpQO03o8zepOdYdzCCkitgkN34njfGJybpcGLmCzVeyDoJrg%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787125939&P2=404&P3=2&P4=Y9R6bH5pOoj6HRLcpKr%2bwzzG3l1fOGUn4IDGx5sdy%2f8V3uQ6adJ4O7v9%2fbdbD1UK3Nt7V52qQED99M7Z7SLRSg%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

school-shop.su

Embedded IP addresses

203.26.79.13
172.215.188.232
52.168.112.66
52.123.252.232
57.155.101.212
52.230.60.54
4.230.171.124
135.233.95.80
135.233.95.144
74.178.240.51
92.223.78.30
51.105.71.136
52.123.128.14
20.76.201.171
52.123.129.14
40.103.64.242
4.150.223.104
135.234.160.245
52.123.252.227
52.123.252.220
52.148.114.188
52.110.12.1
52.110.12.47
20.184.175.19
48.200.63.27

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report