MALICIOUS — 5a32552292040fdc6472ddd169f9f63c1059c2ec6f4df37fe523ae596a11ef03

MALICIOUS — 5a32552292040fdc6472ddd169f9f63c1059c2ec6f4df37fe523ae596a11ef03 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (74/100). 0 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 5a32552292040fdc6472ddd169f9f63c1059c2ec6f4df37fe523ae596a11ef03
SHA-1: d34f98028e4ab86b6c4db51ade2e5636d5cd386a
MD5: a3318a088b53ce15e0ff6e6c23fe9661
ssdeep: 3072:U0zWR2zMDDVm2811KxzKmcTWEnefOPfIthPTytrw5yOCaKSOXU:UKO9tYw5yOCe
TLSH: T19D3BFB1B7A997E4608809053BD9C0ED850C6825BE933C1F9E23AEFD4E87CD64640DDA7
Submitted as: 5a32552292040fdc6472ddd169f9f63c1059c2ec6f4df37fe523ae596a11ef03
File type: html · Size: 108185 bytes
Verdict: malicious (74/100)

Detections (0 of 54 engines)

No engine flagged this sample.

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 74/100 is the fusion of 6 weighted signals:

Obfuscated powershell script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 28 external host(s) and 9 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, https://borneosensasi.blogspot.com/favicon.ico, https://borneosensasi.blogspot.com/feeds/posts/default - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (15 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 4 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

15303 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
252.0.0.224.in-addr.arpa.
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
nexusrules.officeapps.live.com
settings-win.data.microsoft.com
11.196.210.85.in-addr.arpa.
146.109.171.150.in-addr.arpa.
c.pki.goog
desktop-hsgcbep
update.googleapis.com
self.events.data.microsoft.com
251.0.0.224.in-addr.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
1.0.240.10.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa

Embedded URLs

https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
https://borneosensasi.blogspot.com/favicon.ico
http://borneosensasi.blogspot.com/2014/01/awas-alat-curi-wi-fi.html
https://borneosensasi.blogspot.com/feeds/posts/default
https://borneosensasi.blogspot.com/feeds/posts/default?alt=rss
https://draft.blogger.com/feeds/3803711357305757037/posts/default
https://borneosensasi.blogspot.com/feeds/685554497458508382/comments/default
http://1-ps.googleusercontent.com/x/www.hmetro.com.my/w1.hmetro.com.my/myMetro/articles/AlatcuriWi-fi/xpix_frontpage
https://lh6.googleusercontent.com/proxy/AimiRTeTunPnr83PxUhqZsHqfBxn2zlYWeNPjdy5epVdOqLWwKj-UWqJLfjHU5SlgcFD1tkD2NZOPn8eNYi2PR035Nl0-rIXleFH5jyt1rn9hUH2qpDV7vCKLWOH7LNNSyuF9LRadeeeKr-zESJI8ncPb8bOHMRsHxt2P-0sPC2YQwlpd8Vu_TKlBQbihFqW16MHVKzKVw-rJZ6rF8tprFl98OEnk-1KFlo=w1200-h630-p-k-no-nu
http://mkr-site.blogspot.com
http://www.ivythemes.com
https://draft.blogger.com/dyn-css/authorization.css?targetBlogID=3803711357305757037&amp
https://borneosensasi.blogspot.com/
http://www.mobicow.com/referral/publisher?ref=5360
https://lh4.googleusercontent.com/proxy/iTRnT1vygrSDQgLRSAzS3-I5uSGXraM4b6g4_NPS_WD0lS72AKXezRRfFk0ajErF_iUtJqBo2sGIsrpNvi5l4-pn8wR0=s0-d
https://borneosensasi.blogspot.com/2014/01/awas-alat-curi-wi-fi.html
https://borneosensasi.blogspot.com/2014/01/awas-alat-curi-wi-fi.html#comment-form
https://borneosensasi.blogspot.com/search/label/berita
https://lh6.googleusercontent.com/proxy/AimiRTeTunPnr83PxUhqZsHqfBxn2zlYWeNPjdy5epVdOqLWwKj-UWqJLfjHU5SlgcFD1tkD2NZOPn8eNYi2PR035Nl0-rIXleFH5jyt1rn9hUH2qpDV7vCKLWOH7LNNSyuF9LRadeeeKr-zESJI8ncPb8bOHMRsHxt2P-0sPC2YQwlpd8Vu_TKlBQbihFqW16MHVKzKVw-rJZ6rF8tprFl98OEnk-1KFlo=s0-d
https://lh4.googleusercontent.com/proxy/aFG_W4KyU_h6gtMorqp3-5Irk-TA0x-LJXzy8cwPxlAyc5Vg9fFw6Nm61SR85XW4hzYOwj5N6SVI-tVIcyCl-aGtlcrpsUVn_NJeLjmhtKWF7H4UhfKM19HlJqz1mOfi6qNQhvVbPFJuomP7jN1w5BSUkxQoG0rNmv1HXGZlqV3Cz--ob0p5A3ast95Zjy8-AJd_5XZIxl3Hc9E7fKw4X0U=s0-d
https://draft.blogger.com/profile/03994835012742450334
https://draft.blogger.com/post-edit.g?blogID=3803711357305757037&postID=685554497458508382&from=pencil
https://resources.blogblog.com/img/icon18_edit_allbkg.gif
https://draft.blogger.com/share-post.g?blogID=3803711357305757037&postID=685554497458508382&target=email
https://draft.blogger.com/share-post.g?blogID=3803711357305757037&postID=685554497458508382&target=blog

Embedded domains

www.blogger.com
borneosensasi.blogspot.com
draft.blogger.com
1-ps.googleusercontent.com
lh6.googleusercontent.com
fonts.googleapis.com
mkr-site.blogspot.com
www.ivythemes.com
4.bp.blogspot.com
fancyapps.com
ajax.googleapis.com
h.top
g.top
i.top
f.top
blogspot.com
www.mobicow.com
lh4.googleusercontent.com
s7.addthis.com
resources.blogblog.com
w.sharethis.com
www.linkwithin.com
lh5.googleusercontent.com
widgets.amung.us
code.adengage.com

Embedded IP addresses

20.184.175.23
20.184.175.18
51.116.253.170
20.184.175.16
72.145.35.102
85.210.196.11
52.148.114.188
72.145.35.96
51.104.15.252
57.155.104.224
51.105.71.137
4.150.223.100
104.46.162.231
4.150.223.115
4.150.223.107
4.207.44.73
172.172.255.216
20.42.179.192
20.42.73.30
20.184.175.20
172.215.188.232
20.42.65.93
13.69.109.130
74.178.76.44
20.42.65.89

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report