SUSPICIOUS — 55f6c87be93ec4f136c34dcf5d252536b25995ed8a853767de141f38a907b5f4

SUSPICIOUS — 55f6c87be93ec4f136c34dcf5d252536b25995ed8a853767de141f38a907b5f4 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 53 detection engines flagged it.

Identification

• SHA-256: 55f6c87be93ec4f136c34dcf5d252536b25995ed8a853767de141f38a907b5f4
• SHA-1: 30bd5639178e258a644310b6cae00e87184ab6b3
• MD5: 22bbfef3c1845b17578283c9319f69ce
• ssdeep: 1536:3oIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7S477:3C7TCC8twAn9/9YD0Sj6a3L
• TLSH: T1F43B390D7EB92D815B9E8E8386866C0178CDFB4E4C21DD82B6BCEB81754B740114D9AF
• Submitted as: 55f6c87be93ec4f136c34dcf5d252536b25995ed8a853767de141f38a907b5f4
• File type: html · Size: 105409 bytes
• Verdict: suspicious (54/100)

Detections (1 of 53 engines)

• Microsoft Defender: Trojan:Script/Wacatac.B!ml

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: http://ogp.me/ns/fb#, http://pozitive.org/images/stati/windows/znachki-stola.jpg, http://lib.zabspu.ru/citforum/open_source/fonts/theory/images/ris335.jpg - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://ogp.me/ns/fb#
• http://pozitive.org/images/stati/windows/znachki-stola.jpg
• http://all.goromi.ru/wp-content/uploads/2014/03/shrift-1.jpg
• http://lib.zabspu.ru/citforum/open_source/fonts/theory/images/ris335.jpg
• http://festival.1september.ru/files/articles/62/6293/629336/presentation/13.JPG
• http://gdzbook.ru/_ld/0/37.jpg
• http://www.zil-bychok.ru/wp-content/uploads/2012/03/image27.png
• http://book-kniga.ru/wp-content/uploads/2011/09/33356294.jpg
• http://video.alport.lg.ua/components/com_cinema/img_detail/p/poster_walk_remember.jpg
• http://5.uzl-school.ru/raznovozrastnaya-doshkolnaya-gruppa/rabota-s-roditelyami-doshkolnikov/%D0%93%D0%B4%D0%B5%20%D0%B2%D1%81%D1%82%D1%80%D0%B5%D1%87%D0%B0%D1%82%D1%8C%20%D0%94%D0%B5%D0%BD%D1%8C%20%D0%9F%D0%BE%D0%B1%D0%B5%D0%B4%D1%8B%209%20%D0%BC%D0%B0%D1%8F%20%D0%BA%D0%BE%D0%BD%D1%81%D1%83%D0%BB%D1%8C%D1%82%D0%B0%D1%86%D0%B8%D1%8F%20%D0%B4%D0%BB%D1%8F%20%D1%80%D0%BE%D0%B4%D0%B8%D1%82%D0%B5%D0%BB%D0%B5%D0%B9.png
• http://www.mam-club.org/wp-content/uploads/2014/03/detskaya_podelka_153wc-233x300.jpg
• http://itsturbabit640.weebly.com/
• https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
• http://itsturbabit640.weebly.com/blog/znachki-yarlichki-dlya-windows-vista
• http://itsturbabit640.weebly.com/blog/znachki-yarlichki-dlya-windows-vista#comments
• https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js
• http://itsturbabit640.weebly.com/1/post/2016/12/znachki-yarlichki-dlya-windows-vista.html
• http://twitter.com/share?url=http://itsturbabit640.weebly.com/1/post/2016/12/znachki-yarlichki-dlya-windows-vista.html
• http://itsturbabit640.weebly.com/blog/okruglij-shrift-russkij
• http://itsturbabit640.weebly.com/blog/okruglij-shrift-russkij#comments
• http://itsturbabit640.weebly.com/1/post/2016/12/okruglij-shrift-russkij.html
• http://twitter.com/share?url=http://itsturbabit640.weebly.com/1/post/2016/12/okruglij-shrift-russkij.html
• http://itsturbabit640.weebly.com/blog/uchebnik-po-obzh-5-klass
• http://itsturbabit640.weebly.com/blog/uchebnik-po-obzh-5-klass#comments
• http://itsturbabit640.weebly.com/1/post/2016/12/uchebnik-po-obzh-5-klass.html

Embedded domains

• ogp.me
• pozitive.org
• all.goromi.ru
• lib.zabspu.ru
• festival.1september.ru
• gdzbook.ru
• www.zil-bychok.ru
• book-kniga.ru
• video.alport.lg.ua
• 5.uzl-school.ru
• www.mam-club.org
• itsturbabit640.weebly.com
• cdn2.editmysite.com
• fonts.googleapis.com
• cdn1.editmysite.com
• ajax.googleapis.com
• www.weebly.com
• twitter.com
• images.myshared.ru
• www.gadgetblog.ru
• 3dcorp.ru
• google-analytics.com
• test.name
• ec.editmysite.com
• connect.facebook.net

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report