SUSPICIOUS — codeMirror.plugin.js

SUSPICIOUS — codeMirror.plugin.js is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 0 of 50 detection engines flagged it.

Identification

• SHA-256: 534519d5ab2b0875fba6b331b82a687226ed16515ec9b9a3ab27d870d94d835f
• SHA-1: 1bab198daf607166c8a314928de2588c73e8c70d
• MD5: 5ac6a0436cd1082c05b8b451b7fcf833
• ssdeep: 1536:5UAnXZOoclJN/ieeUji3ZPWdaOsHxnZWe4wzwQBT8RDM1RAF:5UAnXZK/KvuMOEXlT8RD2y
• TLSH: T1493DD69A65B53CEF4A4B58CD3C81252F790F15E2B48038C02BDD5F4618A2DB1E83799E
• Submitted as: codeMirror.plugin.js
• File type: script · Size: 131357 bytes
• Verdict: suspicious (54/100)

Detections (0 of 50 engines)

No engine flagged this sample.

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec, defense-evasion (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://codemirror.net/LICENSE - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://codemirror.net/LICENSE

Embedded domains

• codemirror.net
• completion.to
• data.to
• pos.ch
• hints.style.top
• box.top
• pos.top
• data.from.ch
• cursor.ch
• editor.top
• cur.ch
• start.ch
• this.pos.to
• result.to
• result.from.ch
• result.to.ch
• this.pos.from.ch
• cur.to
• cursor.to
• where.ch
• found.ch
• match.from.ch
• match.to
• match.to.ch
• sel.anchor.ch

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report