SUSPICIOUS — 45dd7edf04577179e87f47377b659cc405d6880c126ee772a110dc97249daa42
SUSPICIOUS — 45dd7edf04577179e87f47377b659cc405d6880c126ee772a110dc97249daa42 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 53 detection engines flagged it.
Identification
- SHA-256:
45dd7edf04577179e87f47377b659cc405d6880c126ee772a110dc97249daa42 - SHA-1:
330b5b3204e4cd7d98345540bc41da0914107506 - MD5:
8122bb33ab12d243d6b44396803d3f15 - ssdeep:
1536:CBzM92SJzQ3eN1N6xNENoNVNmN7NJNbNfHxQ9:CBY92SJeeN1N6xNENoNVNmN7NJNbNfi - TLSH:
T11439A21AA1F47D4F424554CE6094165D8CA6ACFF7023B0ED9AE88F87489CFA2F439463 - Submitted as: 45dd7edf04577179e87f47377b659cc405d6880c126ee772a110dc97249daa42
- File type: html · Size: 85595 bytes
- Verdict: suspicious (54/100)
Detections (1 of 53 engines)
- Emsisoft (Emergency Kit): Trojan.Agent.FKLR
Why this verdict
The suspicious score of 54/100 is the fusion of 4 weighted signals:
- Obfuscated javascript script: dynamic-exec (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 27 external host(s) at runtime (28 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://1.bp.blogspot.com/-SZcUKF0Cna0/YX2225-cauI/AAAAAAAABEo/tJT-oVKiR8wh6O7cie92jeJDM2LOojkSQCNcBGAsYHQ/s16000/og.jpg, https://www.jne.co.id/, https://cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js - static signal, weight 0.35, confidence 0.60
- Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
277 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- c.pki.goog
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- settings-win.data.microsoft.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
Embedded URLs
- https://1.bp.blogspot.com/-SZcUKF0Cna0/YX2225-cauI/AAAAAAAABEo/tJT-oVKiR8wh6O7cie92jeJDM2LOojkSQCNcBGAsYHQ/s16000/og.jpg
- https://www.jne.co.id/
- https://cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js
- https://cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js
- https://cdn.jsdelivr.cc/npm/sweetalert2@10.16.0/dist/sweetalert2.all.min.js
- https://cdn.jsdelivr.cc/npm/lazyload@2.0.0-rc.2/lazyload.min.js
- https://cdn.jsdelivr.cc/npm/popper.js@1.16.1/dist/umd/popper.min.js
- https://cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css
- https://1.bp.blogspot.com/-DIj-31T4Ihs/YX2223xEeHI/AAAAAAAABE0/5i1TNQBaPzY9mGlc94X726607pY-SGxYACNcBGAsYHQ/s16000/favicon.ico
- https://www.googletagmanager.com/gtag/js?id=G-YNHLB4HNRF
- https://1.bp.blogspot.com/-pIzMR1oiYoY/YX2228NNBgI/AAAAAAAABEw/iEyBryhpBYQpO9r55GqvGT7AQP2OIF6KgCNcBGAsYHQ/s16000/heaa.jpg
- https://1.bp.blogspot.com/-l-0nCcMzhW0/YX222yTzovI/AAAAAAAABEs/6Bix1LHI7Vkf28-_Mu5vUH_J1gcz1azOgCNcBGAsYHQ/s16000/hebb.jpg
- https://1.bp.blogspot.com/-6yMKu34NZ5s/YX222y2XeaI/AAAAAAAABE4/SHoYqTH257gfOuChPYos4xnWAjzs--8sACNcBGAsYHQ/s16000/img.jpg
- https://1.bp.blogspot.com/-1yWV413X2Wk/YX222y7D5mI/AAAAAAAABE8/kwm__yCgMQAgPVFp3Rxs-umR6D7RiM5hgCNcBGAsYHQ/s16000/logo.jpg
- https://1.bp.blogspot.com/-tgdyzabxuJ4/YKpjmQ_UJKI/AAAAAAAABfk/VqO0bIY6vq0EZ9BvCyHwfUT8owQt7dzWwCLcBGAsYHQ/s16000/United-States_outbox.png
- https://1.bp.blogspot.com/-0txA7_j4j7U/YOljJ3X_nAI/AAAAAAAACM0/SLeI287PqMINCf-zv3NZqN_1wpPnnqfqQCLcBGAsYHQ/s16000/box1.png
- https://1.bp.blogspot.com/-6RBY_FwbBKs/YOljJxa5dbI/AAAAAAAACMw/_C9L75FtOBcH3_C7YpfPJIiUlSv0OLwBQCLcBGAsYHQ/s16000/box2.png
- https://1.bp.blogspot.com/-RC32duKA6Wo/YKpjmBkVOEI/AAAAAAAABfg/PraKjCk35xQl-wrsLztkUt-VUrh547z7wCLcBGAsYHQ/s16000/United-States_inbox.png
- https://1.bp.blogspot.com/-yTXh4bzpmdo/YOljKmROY2I/AAAAAAAACM4/GPtpik1-snUZn4UGa2HcasabC_9183b_ACLcBGAsYHQ/s16000/box3.png
- https://uprimp.com/bnr.php?section=General&pub=593174&format=300x50&ga=g
- https://1.bp.blogspot.com/-t9zKYGIohvo/YX25MHy3sJI/AAAAAAAABFU/Nox2veobzooh_D7Ky88JEwsiokJHyZnKgCNcBGAsYHQ/s16000/%25E6%259C%25AA%25E6%25A0%2587%25E9%25A2%2598-54.jpg
- https://1.bp.blogspot.com/-nNvaqCjnM4Y/YX25kAtqneI/AAAAAAAABFc/KHzMPwX_mfgFq1JumWZBJyapNcPSzc_BwCNcBGAsYHQ/s16000/%25E6%259C%25AA%25E6%25A0%2587%25E9%25A2%2598-66.jpg
- https://1.bp.blogspot.com/-SArZhhwQ8qU/YHgCqWpdtOI/AAAAAAAABB0/u2tun92dFTc8ntZRZYhIOTSbiPPHUQgUQCLcBGAsYHQ/s16000/58.jpg
- https://1.bp.blogspot.com/--vRcWnTl9Uw/YX26EA87FQI/AAAAAAAABFk/gJwhoOdmknAwQOvziRY89RR6kyW44wOwgCNcBGAsYHQ/s16000/%25E6%259C%25AA%25E6%25A0%2587%25E9%25A2%2598-77.jpg
- https://1.bp.blogspot.com/-MMfkWQscwu8/YHgClhb8W-I/AAAAAAAAA_8/R9Dwskp0oeo3fxUWxdY6_To_ytfyqnIxgCLcBGAsYHQ/s16000/30.jpg
Embedded domains
- 1.bp.blogspot.com
- cdn.jsdelivr.cc
- www.googletagmanager.com
- c.top
- benfly.net
- uprimp.com
- v.gapis.xyz
- www.w3.org
- hm.baidu.com
- www.jne.co.id
Embedded IP addresses
- 41.17.79.44
- 57.154.63.210
- 51.132.193.104
- 4.230.171.124
- 52.253.84.76
- 20.42.179.204
- 135.233.95.144
- 135.232.92.97
- 20.76.201.171
- 52.123.129.14
- 52.123.128.14
- 4.150.223.97
- 203.26.79.13
- 135.232.92.34
- 135.233.45.221
- 52.110.12.48
- 52.110.12.18
- 52.148.114.188
- 72.153.5.140
- 48.192.143.121
- 4.150.223.101
- 20.184.175.16
- 57.155.101.212
- 51.11.192.48
- 52.168.117.169
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report