MALICIOUS — 592639ca63cbd85269321685cc40ba8c3f994e11132931e398d2069a8b5d5bd0

MALICIOUS — 592639ca63cbd85269321685cc40ba8c3f994e11132931e398d2069a8b5d5bd0 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100). 2 of 54 detection engines flagged it.

Identification

SHA-256: 592639ca63cbd85269321685cc40ba8c3f994e11132931e398d2069a8b5d5bd0
SHA-1: 26c9e40ac2853e968651c521652f495d92abb115
MD5: 9adb546ff60f462f07914830de9f3026
ssdeep: 1536:MIRIOITIwIgIpKZgNDyIwIGI5IrJ7SvIRIOITIwIgIiKZgNDfIwIGI5ITJ7SuXcl:hXc23xIR8vx5yL
TLSH: T1BC339445BA8B8C8BD1CB165E42920F84B489AC0E1092DFDBE0E48D2BDD5F750D26C5DB
Submitted as: 592639ca63cbd85269321685cc40ba8c3f994e11132931e398d2069a8b5d5bd0
File type: html · Size: 52124 bytes
Verdict: malicious (91/100)

Detections (2 of 54 engines)

Microsoft Defender: Trojan:HTML/Phish.B!atmn
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 91/100 is the fusion of 6 weighted signals:

Microsoft Defender flagged Trojan:HTML/Phish.B!atmn (rule Trojan:HTML/Phish.B!atmn) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
Obfuscated javascript script: dynamic-exec, defense-evasion (layers: char-code+concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 1 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://ogp.me/ns/fb#, https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js, http://twitter.com/share?url=https://fertodonneinstitute.weebly.com/1/post/2018/02/download-hibernate-plugins-for-netbeans.html - static signal, weight 0.35, confidence 0.60
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

280 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://ogp.me/ns/fb#
http://proyectosbeta.net/wp-content/uploads/2015/05/Instalar-plugin-de-Ruby-On-Rails-en-NetBeans-8_4.png
http://fertodonneinstitute.weebly.com/1/post/2018/02/download-hibernate-plugins-for-netbeans.html
https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
https://www.google.com/recaptcha/api.js
https://fertodonneinstitute.weebly.com/1/post/2018/02/download-hibernate-plugins-for-netbeans.html
http://twitter.com/share?url=https://fertodonneinstitute.weebly.com/1/post/2018/02/download-hibernate-plugins-for-netbeans.html
http://fertodonneinstitute.weebly.com/blog/download-hibernate-plugins-for-netbeans&is_mobile=&r=3&is_light=1
https://www.weebly.com/signup?utm_source=internal&utm_medium=footer
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

ogp.me
proyectosbeta.net
fertodonneinstitute.weebly.com
cdn2.editmysite.com
fonts.googleapis.com
cdn1.editmysite.com
ajax.googleapis.com
www.weebly.com
www.google.com
developers.oracle.com
twitter.com
google-analytics.com
test.name
ec.editmysite.com
connect.facebook.net
tter.com

Embedded IP addresses

52.168.117.174
4.230.171.124
40.84.85.40
20.247.184.197
74.178.76.54
74.179.77.204
51.132.193.104
20.184.175.11
52.110.12.15
72.145.35.111
52.148.114.188
52.110.12.11
52.110.12.10

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report