SUSPICIOUS — 502a54869bfba85d39a0a26b00a352a46696f98f39f2b0c9d298309d7a908422

SUSPICIOUS — 502a54869bfba85d39a0a26b00a352a46696f98f39f2b0c9d298309d7a908422 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 50 detection engines flagged it.

Identification

• SHA-256: 502a54869bfba85d39a0a26b00a352a46696f98f39f2b0c9d298309d7a908422
• SHA-1: 229f082185cf2b90a6f32cac48fbc549f80c33b3
• MD5: e2f4d24dee960fbba31c949080b15eca
• ssdeep: 384:ofRIjUDGO2G9kLL9j9F2Oznh1hCutgPziMKxvfxddCj1mWZWrFV:ofRIjUDGO2G9kLL9j9F2OzlgLKxrdCBU
• TLSH: T14E28A80FC67367DF4C414493E9A1B86EFCE4A8F657FD98B58E09460AA801D6078963C2
• Submitted as: 502a54869bfba85d39a0a26b00a352a46696f98f39f2b0c9d298309d7a908422
• File type: html · Size: 18014 bytes
• Verdict: suspicious (54/100)

Detections (1 of 50 engines)

• Emsisoft (Emergency Kit): Generic.HTML.Phishing.AV.5FF5871B

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js, https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js, https://oss.maxcdn.com/respond/1.4.2/respond.min.js - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js
• https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js
• https://oss.maxcdn.com/respond/1.4.2/respond.min.js
• https://top4top.io/
• https://top4top.io/downloadf-1183u670d1-rar.html
• https://connect.facebook.net/en_US/all.js#xfbml=1
• https://top4top.io/report-27364000.html
• https://top4top.io/process/71c32bd997a66b566cc62da4ad182232dbeb152e
• https://e.top4top.io/f_JjLs1Bffc3wKevOAIftCiA/1635448054/1183u670d1.rar
• http://download.top4top.io/upload-tool/
• http://top4top.io/call.html
• https://twitter.com/top4top_net
• https://t.me/zSupport
• https://twitter.com/top4top.io
• https://top4top.io
• https://cutt.us.com
• https://0i.is
• https://cutt.us

Embedded domains

• s.top4top.io
• ajax.googleapis.com
• oss.maxcdn.com
• top4top.io
• connect.facebook.net
• e.top4top.io
• download.top4top.io
• twitter.com
• t.me
• cutt.us.com
• cutt.us
• www.google-analytics.com
• 0i.is

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report