SUSPICIOUS — 5077da3c0f0303027452df974dd8d4eaadbb7c7af2e1923bfb1c4d4729bde678
SUSPICIOUS — 5077da3c0f0303027452df974dd8d4eaadbb7c7af2e1923bfb1c4d4729bde678 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 53 detection engines flagged it.
Identification
- SHA-256:
5077da3c0f0303027452df974dd8d4eaadbb7c7af2e1923bfb1c4d4729bde678 - SHA-1:
9478c43694d9556f220f39ac7aaece6dfc513e6d - MD5:
5a1ab63944a71ed7d1d18109d227ad8e - ssdeep:
1536:cIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7S47Ti:G7TDiSOKV957BS2Og0M78NOea/nOL - TLSH:
T1413D5B4D67A2EDC4159CB762B1450D20ACC1DD4D0AA7EED1F1A8A782F85B3A0349CC6F - Submitted as: 5077da3c0f0303027452df974dd8d4eaadbb7c7af2e1923bfb1c4d4729bde678
- File type: html · Size: 126911 bytes
- Verdict: suspicious (54/100)
Detections (1 of 53 engines)
- Microsoft Defender: Trojan:Script/Phonzy.A!ml
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: http://ogp.me/ns/fb#, http://www.yurta.com.ua/images/house_25.jpg, http://s.pikabu.ru/images/big_size_comm/2013-10_2/13812596138091.jpg - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://ogp.me/ns/fb#
- http://www.yurta.com.ua/images/house_25.jpg
- http://s.pikabu.ru/images/big_size_comm/2013-10_2/13812596138091.jpg
- http://cf.ppt-online.org/files/slide/4/4XUVbfuDgSHGnwWv3ZCpc1sBOqL5PmtAIKxJzQ/slide-7.jpg
- http://vcegdaprazdnik.ru/uploads/posts/2012-05/1337075588_scenki-na-yubilej-zhenshhine.jpg
- http://media.music123.com/is/image/MMGS7/Storm-3.0-Virtual-Music-Synth-Workstation/706098000000000-00-750x750.jpg
- http://book-online.com.ua/images/page_img/3288/b_3288_doc2fb_image_03000034.png
- http://img.labirint.ru/images/comments_pic/1109/06labh2de1298933344.jpg
- http://photosflowery.ru/photo/b8/b81c00e111ef3fecbafafeb02be88a93.jpg
- http://otnn.ru/images/stories/virtuemart/product/01.jpg
- http://strategybackuper881.weebly.com/
- https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
- http://strategybackuper881.weebly.com/blog/proekt-moduljnogo-zdaniya
- http://strategybackuper881.weebly.com/blog/proekt-moduljnogo-zdaniya#comments
- https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js
- http://strategybackuper881.weebly.com/1/post/2016/12/proekt-moduljnogo-zdaniya.html
- http://twitter.com/share?url=http://strategybackuper881.weebly.com/1/post/2016/12/proekt-moduljnogo-zdaniya.html
- http://strategybackuper881.weebly.com/blog/3d-max-torrent-32-bit-2013
- http://strategybackuper881.weebly.com/blog/3d-max-torrent-32-bit-2013#comments
- http://strategybackuper881.weebly.com/1/post/2016/12/3d-max-torrent-32-bit-2013.html
- http://twitter.com/share?url=http://strategybackuper881.weebly.com/1/post/2016/12/3d-max-torrent-32-bit-2013.html
- http://strategybackuper881.weebly.com/blog/klyuch-k-igre-protivostoyanie-prinuzhdenie-k-miru-forum
- http://strategybackuper881.weebly.com/blog/klyuch-k-igre-protivostoyanie-prinuzhdenie-k-miru-forum#comments
- http://strategybackuper881.weebly.com/1/post/2016/12/klyuch-k-igre-protivostoyanie-prinuzhdenie-k-miru-forum.html
- http://twitter.com/share?url=http://strategybackuper881.weebly.com/1/post/2016/12/klyuch-k-igre-protivostoyanie-prinuzhdenie-k-miru-forum.html
Embedded domains
- ogp.me
- www.yurta.com.ua
- s.pikabu.ru
- cf.ppt-online.org
- vcegdaprazdnik.ru
- media.music123.com
- book-online.com.ua
- img.labirint.ru
- photosflowery.ru
- otnn.ru
- strategybackuper881.weebly.com
- cdn2.editmysite.com
- fonts.googleapis.com
- cdn1.editmysite.com
- ajax.googleapis.com
- www.weebly.com
- twitter.com
- arturia.com
- www.arturia.com
- google-analytics.com
- test.name
- ec.editmysite.com
- connect.facebook.net
- tter.com
File paths
- C:\Documents
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report