MALICIOUS — 502fed293876707fee98db2e8a4c1c9cc5663aec731bc96c05c4f2306896861d

MALICIOUS — 502fed293876707fee98db2e8a4c1c9cc5663aec731bc96c05c4f2306896861d is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 3 of 50 detection engines flagged it.

Identification

• SHA-256: 502fed293876707fee98db2e8a4c1c9cc5663aec731bc96c05c4f2306896861d
• SHA-1: c324d8b1ba3eff28aca589b12f00a69eac7355f6
• MD5: 42058cd67e7a67619f17fb08d5ab8bbe
• ssdeep: 768:FnQzJZcpD3gGIZwZghU2axpNWNW3MeYg4XxK2kfXzrg:tQcpD3qhU5pWNW8eYBXxCo
• TLSH: T18F31B7BA6723238F14D049666BBC0EC895C6C597F433C2A0E366FF489434DB0965A85B
• Submitted as: 502fed293876707fee98db2e8a4c1c9cc5663aec731bc96c05c4f2306896861d
• File type: html · Size: 42078 bytes
• Verdict: malicious (93/100)

Detections (3 of 50 engines)

• ClamAV (daily): Html.Exploit.Agent-6598769-0
• Microsoft Defender: TrojanClicker:JS/Faceliker.A
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 93/100 is the fusion of 3 weighted signals:

• ClamAV (daily) flagged Html.Exploit.Agent-6598769-0 (rule Html.Exploit.Agent-6598769-0) - engine signal, weight 0.90, confidence 0.95
• Obfuscated javascript script: dynamic-exec (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://tattoosideas2012.blogspot.com/favicon.ico, http://tattoosideas2012.blogspot.com/search/label/bird%20tattoos - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
• http://tattoosideas2012.blogspot.com/favicon.ico
• http://tattoosideas2012.blogspot.com/search/label/bird%20tattoos
• http://tattoosideas2012.blogspot.com/feeds/posts/default
• http://tattoosideas2012.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/7469498980622600545/posts/default
• https://www.blogger.com/profile/05849612809198582323
• http://ajax.googleapis.com/ajax/libs/jquery/1.6.2/jquery.min.js
• https://www.blogger.com/dyn-css/authorization.css?targetBlogID=7469498980622600545&amp
• https://apis.google.com/js/plusone.js
• http://tattoosideas2012.blogspot.com/
• http://ads.clicksor.com/newServing/showAd.php
• http://www.yesadvertising.com
• http://tattoosideas2012.blogspot.com/2009/08/female-tattoos-for-back-body-tattoo.html
• https://lh6.googleusercontent.com/proxy/rwzXW_8yWUMSL9R-UD3cu0wegbNVijmLalovz7r-bIcRJbYyRa4s8Io-MKlFmzNwrZYAqFaQRvQmozvAlsFPRPaaiRtt8o-FN07B0bu53Gspn2hi9DVQ3y9aVUKQw7XLIsmbuPAz5__d=w72-h72-p-k-no-nu
• http://tattoosideas2012.blogspot.com/2010/03/peaches-geldof-tattoo-designs.html
• http://2.bp.blogspot.com/_HaDcoElLdc0/S7XBelecY4I/AAAAAAAABZg/9aTfN3TTJxk/w72-h72-p-k-no-nu/peaches_geldof+tattoos+on+their+wrist.jpg
• http://tattoosideas2012.blogspot.com/2011/10/pyramid-tattoo.html
• https://lh5.googleusercontent.com/proxy/yXxcCdob6p5AkvK1cshrJDIsb-um0D5wM-DkvgVw5A5sgtFpuIN3kaW79Ne3Wkv4kqkaRxnesa-OLSyOOH9xl5sxkv6CD8Knw97yQYfl_ffhrCPuKTN0=w72-h72-p-k-no-nu
• http://tattoosideas2012.blogspot.com/2009/12/birdman-tattoos-tattoo-artist.html
• https://lh4.googleusercontent.com/proxy/eTDrgrxYyQi6lPvWwaYVkaJaEXcJSMPu0ggZw3TMV9tf81K8vcKGX-02ewTf1yxTRMIOuaLsS5hc6AfSGd-ILE4NFgPA3PUt0KCo4ymf16YLR19LJvr0IXcwcxzeBb61SAbVxVRfJj1VW5SmSHYaXX4c_AEV70Q=w72-h72-p-k-no-nu

Embedded domains

• www.w3.org
• www.google.com
• www.blogger.com
• tattoosideas2012.blogspot.com
• ajax.googleapis.com
• blogspot.com
• apis.google.com
• pagead2.googlesyndication.com
• ads.clicksor.com
• www.yesadvertising.com
• lh6.googleusercontent.com
• 2.bp.blogspot.com
• lh5.googleusercontent.com
• lh4.googleusercontent.com
• lh3.googleusercontent.com
• 4.bp.blogspot.com
• schema.org
• art-tattoo-galery.blogspot.com
• i23.photobucket.com
• resources.blogblog.com
• www.blogblog.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report