MALICIOUS — 4e3216ab0e94c1f72808978befacf972bb7e9c11f9f2249e84344b399d221ba7
MALICIOUS — 4e3216ab0e94c1f72808978befacf972bb7e9c11f9f2249e84344b399d221ba7 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100), attributed to the Wacatac family. 1 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
4e3216ab0e94c1f72808978befacf972bb7e9c11f9f2249e84344b399d221ba7 - SHA-1:
ad8c20ef2df1ea6c98978ef90caaf57b83ad63e9 - MD5:
6d375381c12989c0f5cbdfc60f8f5c97 - ssdeep:
1536:qFIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7S47Y:q57TjVYlG030mlBT65WaDKEOEYL - TLSH:
T16A3BF980B2916CC533874EE7E58B6C4658C1FF0F8975DC865DAC7B94F82FB902848896 - Submitted as: 4e3216ab0e94c1f72808978befacf972bb7e9c11f9f2249e84344b399d221ba7
- File type: html · Size: 104256 bytes
- Verdict: malicious (75/100) · Family: Wacatac
Detections (1 of 54 engines)
- Microsoft Defender: Trojan:Script/Wacatac.C!ml
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 3 weighted signals:
- Microsoft Defender flagged Trojan:Script/Wacatac.C!ml (rule
Trojan:Script/Wacatac.C!ml) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: http://ogp.me/ns/fb#, http://images.dmir.ru/dmir/images/professionalnyy-fotoapparat-canon-1d-mark-iii-9200842.jpg, http://images.dmir.ru/dmir/images/professionalnyy-fotoapparat-canon-1d-mark-iii-9200848.jpg - static signal, weight 0.35, confidence 0.60
Dynamic analysis (windows)
14482 behavior events · 1 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- wpad
- d.1.d.1.c.4.2.1.4.9.5.2.6.e.8.b.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa.
- 76.0.240.10.in-addr.arpa.
- 1.0.240.10.in-addr.arpa.
- 251.0.0.224.in-addr.arpa.
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
- 108.223.150.4.in-addr.arpa.
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
- 252.0.0.224.in-addr.arpa.
- nexusrules.officeapps.live.com
- 209.110.171.150.in-addr.arpa.
- update.googleapis.com
- desktop-hsgcbep
- self.events.data.microsoft.com
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
Dropped files
- c9755626dc83b13f603a7add12ae1e9e3970354b44c707f4ffab459f19ef7315 -
c9755626dc83b13f603a7add12ae1e9e3970354b44c707f4ffab459f19ef7315
Embedded URLs
- http://ogp.me/ns/fb#
- http://images.dmir.ru/dmir/images/professionalnyy-fotoapparat-canon-1d-mark-iii-9200842.jpg
- http://images.dmir.ru/dmir/images/professionalnyy-fotoapparat-canon-1d-mark-iii-9200848.jpg
- http://4.bp.blogspot.com/-LABx8exA1nQ/ThGLf-ka0uI/AAAAAAAAGhw/hCQtcl_DDCA/s1600/nikon-p500-r-fl-800.jpg
- http://2celeb.ru/files/images/sofiya-koppola-
- http://lichnosti.net/photos/3360/13164458944.jpg
- http://fs144.www.ex.ua/show/21605026/21605026.jpg?800
- http://bublik.tv/images/tscheslavie-poster.jpg
- http://godps3.ru/files/guest/190908_253019090.jpg
- http://900igr.net/datas/literatura/Urok-Tjoplyj-khleb/0010-010-Urok-Paustovskij-Tjoplyj-khleb.jpg
- https://i.ytimg.com/vi/qKDod1BKBpc/maxresdefault.jpg
- http://agriturbabit.weebly.com/
- https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
- http://agriturbabit.weebly.com/blog/shrifti-dlya-word-pushkin
- http://agriturbabit.weebly.com/blog/shrifti-dlya-word-pushkin#comments
- https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js
- http://agriturbabit.weebly.com/1/post/2016/12/shrifti-dlya-word-pushkin.html
- http://twitter.com/share?url=http://agriturbabit.weebly.com/1/post/2016/12/shrifti-dlya-word-pushkin.html
- http://agriturbabit.weebly.com/blog/nikon-kulpiks-r-500-instrukciya
- http://agriturbabit.weebly.com/blog/nikon-kulpiks-r-500-instrukciya#comments
- http://agriturbabit.weebly.com/1/post/2016/12/nikon-kulpiks-r-500-instrukciya.html
- http://twitter.com/share?url=http://agriturbabit.weebly.com/1/post/2016/12/nikon-kulpiks-r-500-instrukciya.html
- http://agriturbabit.weebly.com/blog/krestnij-otec-trilogiya-1901-1980-torrent
- http://agriturbabit.weebly.com/blog/krestnij-otec-trilogiya-1901-1980-torrent#comments
- http://agriturbabit.weebly.com/1/post/2016/12/krestnij-otec-trilogiya-1901-1980-torrent.html
Embedded domains
- ogp.me
- images.dmir.ru
- 4.bp.blogspot.com
- 2celeb.ru
- lichnosti.net
- fs144.www.ex.ua
- bublik.tv
- godps3.ru
- 900igr.net
- i.ytimg.com
- agriturbabit.weebly.com
- cdn2.editmysite.com
- fonts.googleapis.com
- cdn1.editmysite.com
- ajax.googleapis.com
- www.weebly.com
- twitter.com
- tvkultura.ru
- www.rd43.ru
- i32.fastpic.ru
- funkyimg.com
- qiqru.org
- hrliga.com
- images.myshared.ru
- www.katalog-notebookow.pl
Embedded IP addresses
- 11.6.27.201
- 11.5.2.1
- 74.178.76.44
- 72.145.35.97
- 4.150.223.108
- 172.172.255.217
- 203.26.79.13
- 4.150.223.113
- 20.42.179.192
- 20.89.1.12
- 52.148.114.188
- 40.79.167.9
- 57.155.101.212
- 72.154.7.104
- 20.42.65.84
- 72.145.35.96
- 72.145.35.103
- 52.123.252.248
- 4.207.44.72
- 52.178.17.232
- 4.207.44.70
- 4.150.223.100
- 13.69.109.130
- 57.154.63.210
- 172.178.240.161
More Wacatac samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report