SUSPICIOUS — 502bff5a470ef6f0a1c0fd2d131b04607891d07a12ed0362e34322d99b8b3a5a
SUSPICIOUS — 502bff5a470ef6f0a1c0fd2d131b04607891d07a12ed0362e34322d99b8b3a5a is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
502bff5a470ef6f0a1c0fd2d131b04607891d07a12ed0362e34322d99b8b3a5a - SHA-1:
7947ffbe08ac600a8f05747ea4c8643523db2b94 - MD5:
7b4b3981403986be83f91e4c6aba214e - ssdeep:
3072:NFsSv3r9sZF3G4k5QhLpOatVr4MEffNbYaaLStRXcxWUu/v66sbsGon4G59t9Fc+:r5y3G4k5QhL8atVEfNbYaaLStRsxWUu3 - TLSH:
T1BB3F0835254D3A1F36E098585ACF3F7860CE9DDFB4500599A0AD8EC8FC18C36625A89B - Submitted as: 502bff5a470ef6f0a1c0fd2d131b04607891d07a12ed0362e34322d99b8b3a5a
- File type: html · Size: 159118 bytes
- Verdict: suspicious (54/100)
Detections (2 of 50 engines)
- Microsoft Defender: flagged
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7503578905661784, http://html5shiv.googlecode.com/svn/trunk/html5.js - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7503578905661784
- http://html5shiv.googlecode.com/svn/trunk/html5.js
- https://sdnegeri2banarangemawang.blogspot.com/favicon.ico
- https://sdnegeri2banarangemawang.blogspot.com/2011/03/tuanku-imam-bonjol-dari-sumatera-barat.html
- https://sdnegeri2banarangemawang.blogspot.com/feeds/posts/default
- https://sdnegeri2banarangemawang.blogspot.com/feeds/posts/default?alt=rss
- http://www.blogger.com/feeds/5478769952362096298/posts/default
- http://www.blogger.com/openid-server.g
- https://sdnegeri2banarangemawang.blogspot.com/
- https://plus.google.com/ID
- http://css3-mediaqueries-js.googlecode.com/svn/trunk/css3-mediaqueries.js
- http://img1.blogblog.com/img/openid16-rounded.gif
- https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
- https://www.blogger.com/dyn-css/authorization.css?targetBlogID=5478769952362096298&
- https://www.facebook.com/KelasBuAsih
- https://plus.google.com/u/0/116138281881391977339
- http://data-vocabulary.org/Breadcrumb
- https://sdnegeri2banarangemawang.blogspot.com/search/label/Materi%20IPS%20Semester%202
- https://sdnegeri2banarangemawang.blogspot.com/search/label/Pahlawan%20Nasional
- http://schema.org/BlogPosting
- http://data-vocabulary.org/Review
- http://twitter.com/share
- http://www.addtoany.com/share_save
- https://sdnegeri2banarangemawang.blogspot.com/2011/03/perlawanan-rakyat-banjarmasin.html
Embedded domains
- www.blogger.com
- pagead2.googlesyndication.com
- html5shiv.googlecode.com
- sdnegeri2banarangemawang.blogspot.com
- plus.google.com
- css3-mediaqueries-js.googlecode.com
- themes.googleusercontent.com
- 4.bp.blogspot.com
- 2.bp.blogspot.com
- 3.bp.blogspot.com
- img1.blogblog.com
- ajax.googleapis.com
- blogspot.com
- html-scripts.googlecode.com
- connect.facebook.net
- www.facebook.com
- gmail.com
- data-vocabulary.org
- schema.org
- twitter.com
- platform.twitter.com
- www.addtoany.com
- static.addtoany.com
- 1.bp.blogspot.com
- n.whatwg.org
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report