SUSPICIOUS — 54b42d5c52e78ee91dfc574d2893c0137f40a9d30bcd45c9bc48bd578729d337
SUSPICIOUS — 54b42d5c52e78ee91dfc574d2893c0137f40a9d30bcd45c9bc48bd578729d337 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 53 detection engines flagged it.
Identification
- SHA-256:
54b42d5c52e78ee91dfc574d2893c0137f40a9d30bcd45c9bc48bd578729d337 - SHA-1:
b74a6eeb3db96a2bc8647c43b83910c520f96894 - MD5:
480d60488e980625e69743770b6126be - ssdeep:
1536:ZZzV9jSU4QzVNAN+xNXNPN9NsNGNQNRNZCxS9:ZZ59jSUhVNAN+xNXNPN9NsNGNQNRNZV - TLSH:
T1CD39A416A1F47D4F874594CE6090124D8DA6ADFF7422B0ED9AE48F87489CFA2F439423 - Submitted as: 54b42d5c52e78ee91dfc574d2893c0137f40a9d30bcd45c9bc48bd578729d337
- File type: html · Size: 85884 bytes
- Verdict: suspicious (54/100)
Detections (1 of 53 engines)
- Emsisoft (Emergency Kit): Trojan.Agent.FKLR
Why this verdict
The suspicious score of 54/100 is the fusion of 4 weighted signals:
- Obfuscated javascript script: dynamic-exec (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 28 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://1.bp.blogspot.com/-WqlOW6n365U/YYPkQPuvuXI/AAAAAAAABA8/zAhX_e-SI1cKXL_CgwW8t-M2ywHXQfvsQCLcBGAsYHQ/s16000/og.jpg, https://www.discovery.co.za/portal/, https://cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js - static signal, weight 0.35, confidence 0.60
- Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
278 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- config.edge.skype.com
- v20.events.data.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
Embedded URLs
- https://1.bp.blogspot.com/-WqlOW6n365U/YYPkQPuvuXI/AAAAAAAABA8/zAhX_e-SI1cKXL_CgwW8t-M2ywHXQfvsQCLcBGAsYHQ/s16000/og.jpg
- https://www.discovery.co.za/portal/
- https://cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js
- https://cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js
- https://cdn.jsdelivr.cc/npm/sweetalert2@10.16.0/dist/sweetalert2.all.min.js
- https://cdn.jsdelivr.cc/npm/lazyload@2.0.0-rc.2/lazyload.min.js
- https://cdn.jsdelivr.cc/npm/popper.js@1.16.1/dist/umd/popper.min.js
- https://cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css
- https://1.bp.blogspot.com/-Sz1enxe0zrg/YYPkQEznXhI/AAAAAAAABAo/5AeC6zvQbw4lVw-tIZq7bOmmszrgaNKwgCLcBGAsYHQ/s16000/fav.jpg
- https://www.googletagmanager.com/gtag/js?id=G-T06SWM0SBQ
- https://1.bp.blogspot.com/-rjCx0vDYVtU/YYPkQKlt4II/AAAAAAAABAw/3mn4D9x_bQILJbXF-WAThaKtOJjqGUzegCLcBGAsYHQ/s16000/left.jpg
- https://1.bp.blogspot.com/-kYBg68zyAJA/YYPni8Y1WAI/AAAAAAAABCA/o5ulRkaFyOsYekZ_xW7t6eYeyuAknGa9wCLcBGAsYHQ/s16000/1.jpg
- https://1.bp.blogspot.com/-6HEMIM7U4Zo/YYPkQGXraqI/AAAAAAAABA4/2TJrfjDfutQu-SCMkAUYvFKSA2NhzysLQCLcBGAsYHQ/s16000/show.jpg
- https://1.bp.blogspot.com/-MTCJBdjllaM/YW6iolxHLyI/AAAAAAAAAHo/JH3jn7dj5EkbliaSeLNBiwQXDLl54bxfwCLcBGAsYHQ/s16000/boxfull.png
- https://1.bp.blogspot.com/-tgdyzabxuJ4/YKpjmQ_UJKI/AAAAAAAABfk/VqO0bIY6vq0EZ9BvCyHwfUT8owQt7dzWwCLcBGAsYHQ/s16000/United-States_outbox.png
- https://1.bp.blogspot.com/-pgu2tdFGKQo/YW6inlEH-zI/AAAAAAAAAHc/WvyToOkBSrw9kclRvyv2HGqLXd5wvr4nQCLcBGAsYHQ/s16000/box1.png
- https://1.bp.blogspot.com/-im5RGXrOoZg/YW6insUunkI/AAAAAAAAAHk/zBWw6-n0KXgYIpOt51J6V7w8DtIZTeG8gCLcBGAsYHQ/s16000/box2.png
- https://1.bp.blogspot.com/-RC32duKA6Wo/YKpjmBkVOEI/AAAAAAAABfg/PraKjCk35xQl-wrsLztkUt-VUrh547z7wCLcBGAsYHQ/s16000/United-States_inbox.png
- https://1.bp.blogspot.com/-wNXucDE4p1M/YW6inlgIWXI/AAAAAAAAAHg/zYIF2qqjzS4Z-pPxcV6EAlu8GkjXb5UuwCLcBGAsYHQ/s16000/box3.png
- https://uprimp.com/bnr.php?section=General&pub=593174&format=300x50&ga=g
- https://1.bp.blogspot.com/-N38gjX3j5bU/YYPTC72l7SI/AAAAAAAAA_Q/0caUQWG3I7QLYN4bZjKcjlbpAK4kRPkJACLcBGAsYHQ/%25E6%259C%25AA%25E6%25A0%2587%25E9%25A2%2598-7.jpg
- https://1.bp.blogspot.com/-EK9l9KwoUGI/YYPTC4dcurI/AAAAAAAAA_Y/BfEHh2e43zUjuXMvrIJ5DBtcuM1eXF-KQCLcBGAsYHQ/%25E6%259C%25AA%25E6%25A0%2587%25E9%25A2%2598-8.jpg
- https://1.bp.blogspot.com/-Bzmo2p_Y9zg/YYPTC2rnPWI/AAAAAAAAA_U/G8dshLJswi8oN1abNWSPW6IqMtVqrRTNgCLcBGAsYHQ/169586047_149037653833841_3393579957924664086_n.jpg
- https://1.bp.blogspot.com/-5LCFb5M9m2I/YUcWfQz4NeI/AAAAAAAAGTs/5SoTrqxIitcwWtjx6iX2jX81PvfIgxnwACLcBGAsYHQ/s0/%25E6%259C%25AA%25E6%25A0%2587%25E9%25A2%2598-13.jpg
- https://1.bp.blogspot.com/-9rg26YLYWuI/YUcWfKp8_6I/AAAAAAAAGTo/9q9_YpgHNdY2sCjqMddO_Ho8NMiNbBvGgCLcBGAsYHQ/s320/151655504_267686088055023_53510521785750382_n.jpg
Embedded domains
- 1.bp.blogspot.com
- www.discovery.co.za
- cdn.jsdelivr.cc
- www.googletagmanager.com
- c.top
- benfly.net
- uprimp.com
- v.gapis.xyz
- www.w3.org
- hm.baidu.com
Embedded IP addresses
- 41.17.79.44
- 52.123.252.233
- 20.184.175.8
- 20.247.184.142
- 57.155.104.224
- 4.230.171.124
- 104.46.162.229
- 74.178.240.61
- 74.179.77.164
- 135.233.95.144
- 20.76.201.171
- 52.123.128.14
- 52.123.129.14
- 40.99.133.242
- 172.178.240.161
- 20.42.65.84
- 20.42.65.89
- 52.123.252.247
- 52.123.252.216
- 74.178.232.29
- 92.223.78.30
- 203.26.79.13
- 52.148.114.188
- 4.247.188.224
- 52.182.143.212
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report