SUSPICIOUS — 54808d28c720599d8588557fc11bba5c90bdc65e8004483bf5f2c560a50d7f07
SUSPICIOUS — 54808d28c720599d8588557fc11bba5c90bdc65e8004483bf5f2c560a50d7f07 is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
54808d28c720599d8588557fc11bba5c90bdc65e8004483bf5f2c560a50d7f07 - SHA-1:
6b8fbc9f2b76cf014ea5aeda89a19daef9bea7af - MD5:
60a19de87353f8ff942c72c3e0a9572d - ssdeep:
768:2oBFw1wl+WRydWDRQgn8WI0fBQLrX84XCq4Mu:pAr20RCq4T - TLSH:
T1212FC69D7D48BF8CDC0E22E75ECCA9527A03A505AB81D8DDC2BDD348ACF8890195D817 - Submitted as: 54808d28c720599d8588557fc11bba5c90bdc65e8004483bf5f2c560a50d7f07
- File type: script · Size: 33640 bytes
- Verdict: suspicious (54/100)
Detections (2 of 50 engines)
- Microsoft Defender: Trojan:JS/Agent.AG!MSR
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec, defense-evasion (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: http://getbootstrap.com - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://getbootstrap.com
- https://github.com/twbs/bootstrap/blob/master/LICENSE
Embedded domains
- getbootstrap.com
- github.com
- e.to
- c.prototype.to
- c.to
- j.top
- b.top
- a.top
- k.top
- g.top
- e.top
- f.top
- d.offset.top
- groovevendor.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report