SUSPICIOUS — 5024c1901471e94c01aa3f08afc28aca3ea04999fb944bf7bf452abbe6d9fa3b

SUSPICIOUS — 5024c1901471e94c01aa3f08afc28aca3ea04999fb944bf7bf452abbe6d9fa3b is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: 5024c1901471e94c01aa3f08afc28aca3ea04999fb944bf7bf452abbe6d9fa3b
• SHA-1: e1ac01bcc87379ab2ceefe096f0546b9bdc415a5
• MD5: 97db38e1e1423ccef6046b471efd4571
• ssdeep: 3072:RSV1eoPGz7Np1C+4/aAXt8hX1BpV6Xe6Hid+NbVIUuLsAABn2hWBibuWP+1QvT:noPwp1C+4/aAXt8EXewV5AA87
• TLSH: T1644A156AA3425AD6CC39F836FD9244D039952E8FD8B0A5A5ED838E48DF5C4D0714283F
• Submitted as: 5024c1901471e94c01aa3f08afc28aca3ea04999fb944bf7bf452abbe6d9fa3b
• File type: html · Size: 454599 bytes
• Verdict: suspicious (54/100)

Detections (2 of 50 engines)

• Microsoft Defender: Trojan:HTML/Redirector.FL!bit
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css, http://www.blogger.com/openid-server.g, http://rukhhuda.blogspot.com/ - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css
• http://www.blogger.com/openid-server.g
• http://rukhhuda.blogspot.com/
• http://rukhhuda.blogspot.com/2014/11/download-vocaloid-hatsune-miku.html
• http://rukhhuda.blogspot.com/feeds/posts/default
• http://rukhhuda.blogspot.com/feeds/posts/default?alt=rss
• http://www.blogger.com/feeds/4229675532737548359/posts/default
• https://plus.google.com/KODEGOOGLEPLUS/posts
• https://plus.google.com/u/0/+RukhHuda1/about
• https://plus.google.com/KODEGOOGLEPLUS
• https://www.blogger.com/static/v1/widgets/1535467126-widget_css_2_bundle.css
• http://rukhhuda.blogspot.com
• http://creativecommons.org/licenses/by/3.0/
• http://themes.googleusercontent.com/static/fonts/opensans/v8/cJZKeOuBrn4kERxqtaUH3T8E0i7KZn-EPnyo3HZu7kw.woff
• http://fonts.gstatic.com/s/robotoslab/v6/y7lebkjgREBJK96VQi37ZuL2WfuF7Qc3ANwCvwl0TnA.woff2
• http://fonts.gstatic.com/s/oswald/v9/pEobIV_lL25TKBpqVI_a2w.woff2
• http://1.bp.blogspot.com/-SL82Yj_MkdE/VCNlr5Q1nWI/AAAAAAAAGf8/xzhe3TPouok/s1600/anonim.png
• http://4.bp.blogspot.com/-jSUS8v5kwpQ/U8Z_6Ufr-PI/AAAAAAAAEYY/o4cQPKvt8vQ/s1600/loading.gif
• http://1.bp.blogspot.com/-htG7vy9vIAA/Tp0KrMUdoWI/AAAAAAAABAU/e7XkFtErqsU/s1600/grey.GIF
• https://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
• https://connect.facebook.net/en_US/all.js#xfbml=1

Embedded domains

• www.w3.org
• www.google.com
• www.blogger.com
• rukhhuda.blogspot.com
• c1.popads.net
• c2.popads.net
• plus.google.com
• netdna.bootstrapcdn.com
• creativecommons.org
• themes.googleusercontent.com
• fonts.gstatic.com
• a.ai
• 1.bp.blogspot.com
• 4.bp.blogspot.com
• g.link
• ajax.googleapis.com
• connect.facebook.net
• code.jquery.com
• blogspot.com
• www.google-analytics.com
• www.facebook.com
• iklanblogger.com
• data-vocabulary.org
• twitter.com
• platform.twitter.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report