SUSPICIOUS — 5029f6bccf92fdb232b355e823b828a91be5b5e1557f5dfc0e9dcbacb7640dca

SUSPICIOUS — 5029f6bccf92fdb232b355e823b828a91be5b5e1557f5dfc0e9dcbacb7640dca is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: 5029f6bccf92fdb232b355e823b828a91be5b5e1557f5dfc0e9dcbacb7640dca
• SHA-1: 84c05286ab2ac75a9ce98dc8caa8d9694de589e7
• MD5: 05925b4acf391ea9a0b445a5fcc1cf94
• ssdeep: 3072:6/M9rCX7CeTsPqRcVhIVs2LQezvj40MZEPjLpUxAfYxslxNcl8CLcXmNRSxZszp2:6GocijXmNRV+
• TLSH: T1613C2B9F794DBD8D4D490010395D9E6871C76A9B94A280F883BAEF44DC28CB19C5CCAF
• Submitted as: 5029f6bccf92fdb232b355e823b828a91be5b5e1557f5dfc0e9dcbacb7640dca
• File type: html · Size: 117466 bytes
• Verdict: suspicious (54/100)

Detections (2 of 50 engines)

• Microsoft Defender: TrojanClicker:JS/Faceliker.N
• Kaspersky (KVRT): Trojan.JS.FBook.bk

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://travinhngaymoi.blogspot.com/favicon.ico, http://travinhngaymoi.blogspot.com/feeds/posts/default - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
• https://plus.google.com/110103455382982674742
• http://travinhngaymoi.blogspot.com/favicon.ico
• http://travinhngaymoi.blogspot.com/2014/09/sua-tam-thebol.html
• http://travinhngaymoi.blogspot.com/feeds/posts/default
• http://travinhngaymoi.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/7467538825771500967/posts/default
• http://travinhngaymoi.blogspot.com/feeds/6519605194835659055/comments/default
• http://2.bp.blogspot.com/-4RynI4YOboI/VCTvQnHYs5I/AAAAAAAACK0/lyW2KTs4QtQ/s1600/sua-tam-thebol-1.jpg
• http://2.bp.blogspot.com/-4RynI4YOboI/VCTvQnHYs5I/AAAAAAAACK0/lyW2KTs4QtQ/w1200-h630-p-k-no-nu/sua-tam-thebol-1.jpg
• http://www.premiumbloggertemplates.com/
• http://www.bloggertipandtrick.net/
• http://creativecommons.org/licenses/by/3.0/
• http://www.facebook.com/plugins/like.php?href=
• https://www.facebook.com/yeuphache
• https://ajax.googleapis.com/ajax/libs/mootools/1.3.1/mootools-yui-compressed.js
• http://mootools.net/more
• http://mad4milk.net
• http://www.jondesign.net/
• http://3.bp.blogspot.com/-TAdAWREOzCM/Th6JBm6MRPI/AAAAAAAACSU/JiEd4HQeh5s/s000/background.jpg
• http://3.bp.blogspot.com/-k-wWcTVO3UA/Th6JCOrSdnI/AAAAAAAACSc/1IKLnAxiAKQ/s000/container-bg.png

Embedded domains

• www.w3.org
• www.google.com
• connect.facebook.net
• www.blogger.com
• plus.google.com
• travinhngaymoi.blogspot.com
• 2.bp.blogspot.com
• www.bloggertipandtrick.net
• www.premiumbloggertemplates.com
• creativecommons.org
• www.facebook.com
• lbox.style.top
• ajax.googleapis.com
• mootools.net
• mad4milk.net
• www.jondesign.net
• greengeckodesign.com
• this.btn.store
• entry.link
• posttitle.link
• readmorelink.link
• 3.bp.blogspot.com
• 4.bp.blogspot.com
• 1.bp.blogspot.com
• p.info

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report