SUSPICIOUS — 5024aadf8eb810c53c2a63fd3750167bfd0fd99e19e5224f75225d3c15db1dbe
SUSPICIOUS — 5024aadf8eb810c53c2a63fd3750167bfd0fd99e19e5224f75225d3c15db1dbe is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 0 of 50 detection engines flagged it.
Identification
- SHA-256:
5024aadf8eb810c53c2a63fd3750167bfd0fd99e19e5224f75225d3c15db1dbe - SHA-1:
9d8d1f8b62fd4194e6077e444bed5c70e3e97114 - MD5:
8e6552a2a1988a2ae0e8ed7cb3e46d89 - ssdeep:
768:/zvqHMveUURRDhhJGOXrAs4y0yHbnUcUbmDamq/bvpshaGh:/zvqHMvTiRDhhJGOXrAs4y0yHybArh - TLSH:
T1DD35CD2AD302A4CF276EDA27F854806CD41CE8CEDA3F89F592524D4D242EC651D1BBD8 - Submitted as: 5024aadf8eb810c53c2a63fd3750167bfd0fd99e19e5224f75225d3c15db1dbe
- File type: script · Size: 61542 bytes
- Verdict: suspicious (54/100)
Detections (0 of 50 engines)
No engine flagged this sample.
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated powershell script: dynamic-exec, defense-evasion (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: http://www.toshas.ro/, http://www.toshas.ro/index.php?route=common/home, http://www.toshas.ro/image/data/Bitmap - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd
- http://www.w3.org/1999/xhtml
- http://www.toshas.ro/
- http://www.toshas.ro/index.php?route=common/home
- http://www.toshas.ro/image/data/Bitmap
- http://www.toshas.ro/index.php?route=account/login
- https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.css
- http://www.toshas.ro/index.php?route=account/wishlist
- http://www.toshas.ro/index.php?route=account/account
- http://www.toshas.ro/index.php?route=checkout/cart
- http://www.toshas.ro/index.php?route=checkout/checkout
- http://www.toshas.ro/imprimate-tipizate
- http://www.toshas.ro/imprimate-tipizate/imprimate-tipizate-fiscale
- http://www.toshas.ro/imprimate-tipizate/imprimate-tipizate-medicale
- http://www.toshas.ro/imprimate-tipizate/imprimate-tipizate-paza-si-protectie
- http://www.toshas.ro/imprimate-tipizate/imprimate-tipizate-transportatori
- http://www.toshas.ro/imprimate-tipizate/imprimate-tipizate-scolare
- http://www.toshas.ro/imprimate-tipizate/imprimate-tipizate-protectia-muncii
- http://www.toshas.ro/imprimate-tipizate/imprimate-tipizate-asociatii-de-proprietari
- http://www.toshas.ro/imprimate-tipizate/imprimate-tipizate-speciale
- http://www.toshas.ro/imprimate-tipizate/imprimate-tipizate-hotel-si-restaurant
- http://www.toshas.ro/consumabile
- http://www.toshas.ro/consumabile/consumabile-originale
- http://www.toshas.ro/consumabile/consumabile-compatibile
- http://www.toshas.ro/medii-si-accesorii-pc
Embedded domains
- www.w3.org
- google-analytics.com
- cdn.jsdelivr.net
- www.toshas.ro
- www.anpc.gov.ro
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report