MALICIOUS — 583bc7d29d7814163cf6b18d1b7e77dd4884fcde53b5eec29e04c4a471e389b3

MALICIOUS — 583bc7d29d7814163cf6b18d1b7e77dd4884fcde53b5eec29e04c4a471e389b3 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the Wacatac family. 1 of 54 detection engines flagged it.

Identification

SHA-256: 583bc7d29d7814163cf6b18d1b7e77dd4884fcde53b5eec29e04c4a471e389b3
SHA-1: 9a89e1491b9d0268fe4c5bbde9307f938d102581
MD5: 53347a0455ff789548b16be387a7b42f
ssdeep: 768:1IRIOITIwIgIiKZgNDfIwIGI5IVJ7S/7PKP2u/RLfGJc+ZkdRdhjNIz7C9tk8e0T:1IRIOITIwIgIiKZgNDfIwIGI5IVJ7S/A
TLSH: T100300B417799CF8B65D80BB09391DCC445D2EEC70611EC8487B89EB0BC5EBB055A8B8B
Submitted as: 583bc7d29d7814163cf6b18d1b7e77dd4884fcde53b5eec29e04c4a471e389b3
File type: html · Size: 39021 bytes
Verdict: malicious (84/100) · Family: Wacatac

Detections (1 of 54 engines)

Microsoft Defender: Trojan:Script/Wacatac.B!ml

Why this verdict

The malicious score of 84/100 is the fusion of 6 weighted signals:

Microsoft Defender flagged Trojan:Script/Wacatac.B!ml (rule Trojan:Script/Wacatac.B!ml) - engine signal, weight 0.55, confidence 0.85
Obfuscated javascript script: dynamic-exec (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://ogp.me/ns/fb#, http://cdn2.editmysite.com/images/site/footer/og-image-placeholder-blank.png, https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js - static signal, weight 0.35, confidence 0.60
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

280 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://ogp.me/ns/fb#
http://cdn2.editmysite.com/images/site/footer/og-image-placeholder-blank.png
http://belparus.weebly.com/1/post/2016/12/gruppa-znaki-pesnya-mama-skachatj.html
https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
https://www.google.com/recaptcha/api.js
https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js
http://twitter.com/share?url=http://belparus.weebly.com/1/post/2016/12/gruppa-znaki-pesnya-mama-skachatj.html
http://belparus.weebly.com/blog/gruppa-znaki-pesnya-mama-skachatj&is_mobile=&r=3&is_light=1
https://www.weebly.com/signup?utm_source=internal&utm_medium=footer
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

ogp.me
cdn2.editmysite.com
belparus.weebly.com
fonts.googleapis.com
cdn1.editmysite.com
ajax.googleapis.com
www.weebly.com
www.google.com
mail.ru
twitter.com
google-analytics.com
test.name
ec.editmysite.com
connect.facebook.net
tter.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.98
4.230.171.124
4.247.188.233
4.144.132.223
135.233.95.144
135.232.92.97
74.178.240.61
104.18.33.89
48.211.4.16
52.110.12.22
72.145.35.107
52.148.114.188
92.223.78.30
52.110.12.32
52.110.12.15

More Wacatac samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report