SUSPICIOUS — 502305ab78fcc27537609d5badcb9a5923ef375ddaed4ce1287d5069b8ee2ffb
SUSPICIOUS — 502305ab78fcc27537609d5badcb9a5923ef375ddaed4ce1287d5069b8ee2ffb is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
502305ab78fcc27537609d5badcb9a5923ef375ddaed4ce1287d5069b8ee2ffb - SHA-1:
750a23052b3d363f9eaeed91a129ec7cebe8d665 - MD5:
8a363660ba29249aa8d50618b29c6581 - ssdeep:
768:4sEBaggAQHzy/DZgy+Ei5x9MnjleYLXa7K38vgALFeCy4fMygpq67:4uB/EiMleYLK7PgALoCyYMygpx - TLSH:
T1C2313A2F39193A8F08E08256667E03D491C88677D53385FDE5F6EE44DC789202D1DCA6 - Submitted as: 502305ab78fcc27537609d5badcb9a5923ef375ddaed4ce1287d5069b8ee2ffb
- File type: html · Size: 42153 bytes
- Verdict: suspicious (54/100)
Detections (2 of 50 engines)
- Microsoft Defender: TrojanClicker:JS/Faceliker.E
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://hd-canliligtvizle.blogspot.com/favicon.ico, http://hd-canliligtvizle.blogspot.com/feeds/posts/default - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://hd-canliligtvizle.blogspot.com/favicon.ico
- http://hd-canliligtvizle.blogspot.com/2011/08/kurtlarn-mekan-2010-tr-altyaz-filmi.html
- http://hd-canliligtvizle.blogspot.com/feeds/posts/default
- http://hd-canliligtvizle.blogspot.com/feeds/posts/default?alt=rss
- https://draft.blogger.com/feeds/4254843182138907372/posts/default
- http://hd-canliligtvizle.blogspot.com/feeds/910344866539557413/comments/default
- http://www.divxdeposu.com/wp-content/uploads/2011/08/kurtlarin-mekani.jpg
- https://lh4.googleusercontent.com/proxy/atxqzIacIYb9GkD6kUTG4_XupuUdJrqc2-4YSMW83AnZXXX0OCySN7msBcv67im-RM2UflAZtBSzdhagkDMFRzdZvDHoyEvrSlFi_CjAYNonLX22jdji4JUGtwPo=w1200-h630-p-k-no-nu
- http://4.bp.blogspot.com/_v5IxGTiMTD8/S8LH7SKmeXI/AAAAAAAAA4Q/h6nNNJUlloA/s1600/bk_body.jpg
- http://2.bp.blogspot.com/_v5IxGTiMTD8/S8LH71DmYTI/AAAAAAAAA4Y/u9qGJcOWhQk/s1600/bk_colright.jpg
- http://4.bp.blogspot.com/_v5IxGTiMTD8/S8LH8FmflNI/AAAAAAAAA4g/hoorE_Um66A/s1600/bk_footer.jpg
- http://2.bp.blogspot.com/_v5IxGTiMTD8/S8LH8YxQNII/AAAAAAAAA4o/gIE1dMrJW_M/s1600/bk_search.jpg
- http://1.bp.blogspot.com/_v5IxGTiMTD8/S8LH872hY-I/AAAAAAAAA4w/nrWW1uFbYdo/s400/ico_rss.png
- http://1.bp.blogspot.com/_v5IxGTiMTD8/S8LIzYEnBAI/AAAAAAAAA44/8ac4TpvyWhI/s400/bk_separattor_horiz.jpg
- http://2.bp.blogspot.com/_v5IxGTiMTD8/S8LI0NARUcI/AAAAAAAAA5Q/TsTThDt3_xg/s400/bk_dotted_thick.png
- http://1.bp.blogspot.com/_v5IxGTiMTD8/S8LIz82xTmI/AAAAAAAAA5I/UZ3OICqNcOE/s400/bk_meta.jpg
- http://1.bp.blogspot.com/_v5IxGTiMTD8/S8LI0ryym5I/AAAAAAAAA5Y/yIAXt74UsSs/s400/ico_twitter.png
- http://4.bp.blogspot.com/_v5IxGTiMTD8/S8LK4Tc-G9I/AAAAAAAAA5w/5gnoA-n0L28/s400/ico_facebook.png
- http://3.bp.blogspot.com/_v5IxGTiMTD8/S8LK3gYQqXI/AAAAAAAAA5g/aVjfuXi32QI/s400/ico_flickr.png
- http://2.bp.blogspot.com/_v5IxGTiMTD8/S8LK4EWNeuI/AAAAAAAAA5o/S8PC6moGd-0/s400/ico_linkedin.png
Embedded domains
- www.w3.org
- www.google.com
- www.blogger.com
- hd-canliligtvizle.blogspot.com
- draft.blogger.com
- www.divxdeposu.com
- lh4.googleusercontent.com
- www.anshuldudeja.com
- 4.bp.blogspot.com
- 2.bp.blogspot.com
- 1.bp.blogspot.com
- 3.bp.blogspot.com
- ajax.googleapis.com
- btemplatescripts.googlecode.com
- blogspot.com
- apis.google.com
- pagead2.googlesyndication.com
- videozer.com
- videobb.com
- twitthis.com
- www.stumbleupon.com
- reddit.com
- digg.com
- del.icio.us
- www.facebook.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report