MALICIOUS — 5028e217d109fd32b34eaef56cd12bcc4773544ff8e12fed3da98a7922a58e05

MALICIOUS — 5028e217d109fd32b34eaef56cd12bcc4773544ff8e12fed3da98a7922a58e05 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 3 of 50 detection engines flagged it.

Identification

• SHA-256: 5028e217d109fd32b34eaef56cd12bcc4773544ff8e12fed3da98a7922a58e05
• SHA-1: 1fd4fd8f5f6577f325f6bfbf1bc904efefbd906f
• MD5: a347e11ed5639a8346dd02e3c65b3018
• ssdeep: 768:xsvr1eoeue2e/e1egbvoi3+Z+02HAcZa6ai+a7qa0Q1QTjNKVl7buHqEGxaqgajJ:KFTLeItbvIk0SU32zbKEsSAUtbXGCEpU
• TLSH: T17F2EFD04D1117FE350940746F9454CE8C021BADE78B3AD9186A2CBA5FA9EB208CF59DE
• Submitted as: 5028e217d109fd32b34eaef56cd12bcc4773544ff8e12fed3da98a7922a58e05
• File type: html · Size: 29796 bytes
• Verdict: malicious (93/100)

Detections (3 of 50 engines)

• ClamAV (daily): Js.Trojan.Agent-1553495-4663817-1
• Microsoft Defender: Trojan:JS/Redirector.QE
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 93/100 is the fusion of 3 weighted signals:

• ClamAV (daily) flagged Js.Trojan.Agent-1553495-4663817-1 (rule Js.Trojan.Agent-1553495-4663817-1) - engine signal, weight 0.90, confidence 0.95
• Obfuscated javascript script: dynamic-exec (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: http://gmpg.org/xfn/11, http://cade-ica.com.ar/cade/wp-content/themes/xero/style.css, http://cade-ica.com.ar/cade/wp-content/themes/xero/includes/css/colours/purple.css - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://gmpg.org/xfn/11
• http://cade-ica.com.ar/cade/wp-content/themes/xero/style.css
• http://cade-ica.com.ar/cade/wp-content/themes/xero/includes/css/colours/purple.css
• http://cade-ica.com.ar/cade/wp-content/themes/xero/includes/fancybox/jquery.fancybox.css
• http://cade-ica.com.ar/cade/wp-content/themes/xero/includes/js/jquery.min.js
• http://cade-ica.com.ar/cade/wp-content/themes/xero/includes/js/jquery.tools.min.js
• http://cade-ica.com.ar/cade/wp-content/themes/xero/includes/js/jquery.superfish.min.js
• http://cade-ica.com.ar/cade/wp-content/themes/xero/includes/fancybox/jquery.easing.pack.js
• http://cade-ica.com.ar/cade/wp-content/themes/xero/includes/fancybox/jquery.fancybox.pack.js
• http://cade-ica.com.ar/cade/wp-content/themes/xero/includes/js/xero.js
• http://cade-ica.com.ar/cade/wp-content/themes/xero/includes/js/xero.forms.js
• http://cade-ica.com.ar/cade/xmlrpc.php?rsd
• http://cade-ica.com.ar/cade/wp-includes/wlwmanifest.xml
• http://cade-ica.com.ar/cade/wp-admin/admin-ajax.php
• http://cade-ica.com.ar/cade/wp-content/themes/xero/includes/images/icons/favicon.ico
• http://isteko.by/js/jquery.min.php?c_utt=G91825&c_utm=
• http://isteko.by/js/jquery.min.php
• http://cade-ica.com.ar/cade
• http://cade-ica.com.ar/cade/wp-content/themes/xero/includes/images/global/xero_logo.png
• http://cade-ica.com.ar/cade/especialidades/
• http://cade-ica.com.ar/cade/endocrinologia/
• http://cade-ica.com.ar/cade/osteoporosis/
• http://cade-ica.com.ar/cade/endocrinologia/climaterio/
• http://cade-ica.com.ar/cade/hirsutismo/
• http://cade-ica.com.ar/cade/hipotiroidismo/

Embedded domains

• gmpg.org
• google-analytics.com
• maffei.portaldeturnos.com
• static.ak.connect.facebook.com
• cade-ica.com.ar
• isteko.by
• www.cade-ica.com.ar
• astk.com.ar
• www.vapix.com.ar

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report