SUSPICIOUS — 502dbd9dd39156c61ed89a554b78ed57c42a9e97aac3fa7d013d4abdac960029
SUSPICIOUS — 502dbd9dd39156c61ed89a554b78ed57c42a9e97aac3fa7d013d4abdac960029 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
502dbd9dd39156c61ed89a554b78ed57c42a9e97aac3fa7d013d4abdac960029 - SHA-1:
290067c8d389e3869ee0522315a0618a12e3e5f0 - MD5:
dec688d1d4674a51c1f1fd846924bcdf - ssdeep:
768:HSVT0EipBz4/pRtPBrVginh+PdY5J/WBcBYKRQ15Mx2/eN:ETupBz4/pRtP5nQF5KtRq54 - TLSH:
T143356285230C36DE30648217837C45ACD985C26BFA3752F6D8AFF64498B8D60696FC86 - Submitted as: 502dbd9dd39156c61ed89a554b78ed57c42a9e97aac3fa7d013d4abdac960029
- File type: html · Size: 57571 bytes
- Verdict: suspicious (54/100)
Detections (2 of 50 engines)
- Microsoft Defender: Trojan:JS/Iframeinject.AH
- Kaspersky (KVRT): Trojan-Downloader.JS.Iframe.dfw
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://vivid-ipad-wallpaper-news.blogspot.com/favicon.ico, http://vivid-ipad-wallpaper-news.blogspot.com/feeds/posts/default - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://vivid-ipad-wallpaper-news.blogspot.com/favicon.ico
- http://vivid-ipad-wallpaper-news.blogspot.com/2011/09/tribal-de-angeles-tattoos-gallery.html
- http://vivid-ipad-wallpaper-news.blogspot.com/feeds/posts/default
- http://vivid-ipad-wallpaper-news.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/5901162346652143810/posts/default
- http://vivid-ipad-wallpaper-news.blogspot.com/feeds/8762058664039987531/comments/default
- http://mangorevolution.com/wp-content/uploads/2011/06/Cherry-Blossom-Tattoos4.jpg
- https://lh5.googleusercontent.com/proxy/n8loSEviXrC72pJ6YcC8LbDxFJgNg2lARanqsGRdQx1eBPXXsWw_bdX_ZhUobRKw3vIKB-R3K3X_Uvf_1dJTEqa_QhU3rGRjrZdYQkdEZ5hP8QFKXzS0JAQSVX7GjzNJz04iTfw=w1200-h630-p-k-no-nu
- https://www.blogger.com/dyn-css/authorization.css?targetBlogID=5901162346652143810&
- https://apis.google.com/js/plusone.js
- http://vivid-ipad-wallpaper-news.blogspot.com/
- http://www.instablogsimages.com/images/2009/05/14/cherry-blossom-tattoo_rqKYj_22979.jpg
- http://s3-ak.buzzfed.com/static/imagebuzz/terminal01/2009/5/19/1/the-most-ironic-tattoo-22613-1242710935-2.jpg
- http://japanese.tattoospicture.us/wp-content/uploads/2011/05/Lily-Tattoos-Lily-Flower-Tattoo-Art-11.jpg
- http://www.designsoftattoos.com/wp-content/uploads/2009/06/flower_on_side_tattoo1.jpg
- http://lh6.ggpht.com/_E8Ve0YsQSWU/SLA1PvPreBI/AAAAAAAAAFQ/4341R5s8RlE/sunflower_in_kids_hands.jpg
- http://img402.imageshack.us/img402/2763/40086073.jpg
- http://npotash.files.wordpress.com/2011/05/p1010006.jpg
- http://www.tattoos-4designs.com/wp-content/uploads/2011/06/arm-tattoos-for-girls2.jpg
- http://www.masterofink.com/hearts-tattoos/hearts-tattoos-215403_0286.jpg
Embedded domains
- www.w3.org
- www.google.com
- www.blogger.com
- vivid-ipad-wallpaper-news.blogspot.com
- mangorevolution.com
- lh5.googleusercontent.com
- blogspot.com
- apis.google.com
- pagead2.googlesyndication.com
- www.instablogsimages.com
- s3-ak.buzzfed.com
- japanese.tattoospicture.us
- www.designsoftattoos.com
- lh6.ggpht.com
- img402.imageshack.us
- npotash.files.wordpress.com
- www.tattoos-4designs.com
- www.masterofink.com
- tattoostyle-s.com
- farm4.static.flickr.com
- fc05.deviantart.net
- 1.bp.blogspot.com
- tattoonews.genia.us
- www.funnypictures.net.au
- www.ustattoostudios.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report