SUSPICIOUS — 5a41a9bf94afd3b76e643309261e432b14af2a38338b7d01fe3a9c72e6026203
SUSPICIOUS — 5a41a9bf94afd3b76e643309261e432b14af2a38338b7d01fe3a9c72e6026203 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 50 detection engines flagged it.
Identification
- SHA-256:
5a41a9bf94afd3b76e643309261e432b14af2a38338b7d01fe3a9c72e6026203 - SHA-1:
25e9b84c0b7141a2cf16a244251bfc60f62680a8 - MD5:
5737ae297b6002e2896fce080a54ba5f - ssdeep:
3072:k/GgiC2lP15MdglhPIsjO7skKalIT3TpADW//zCc7Cm9eJ0cTe1bn:CskKalITTpWW//j - TLSH:
T1583E9451BA961F67C8E55107B8D88BAC008AFA5358BDD7C6C3B9CFCD086CF5090681A7 - Submitted as: 5a41a9bf94afd3b76e643309261e432b14af2a38338b7d01fe3a9c72e6026203
- File type: html · Size: 140653 bytes
- Verdict: suspicious (54/100)
Detections (1 of 50 engines)
- Emsisoft (Emergency Kit): Trojan.JS.Redirector.BWY
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated powershell script: dynamic-exec, defense-evasion (layers: base64+gzip/deflate+char-code) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: http://ogp.me/ns#, https://yoast.com/wordpress/plugins/seo/, http://www.anticoborgoderomolini.com/ - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://ogp.me/ns#
- https://yoast.com/wordpress/plugins/seo/
- http://www.anticoborgoderomolini.com/
- http://www.anticoborgoderomolini.com/feed/
- http://www.anticoborgoderomolini.com/comments/feed/
- http://www.anticoborgoderomolini.com/wp-content/plugins/bold-page-builder/css/front_end/dummy.css?ver=4.9.18
- http://www.anticoborgoderomolini.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.1
- http://www.anticoborgoderomolini.com/wp-content/plugins/cookie-notice/css/front.min.css?ver=4.9.18
- http://www.anticoborgoderomolini.com/wp-content/themes/hotelcalifornia/style.crush.min.css?ver=4.9.18
- http://www.anticoborgoderomolini.com/wp-content/themes/hotelcalifornia/css/viewport-buggyfill.css?ver=4.9.18
- http://www.anticoborgoderomolini.com/wp-content/themes/hotelcalifornia/css/magnific-popup.css?ver=4.9.18
- http://www.anticoborgoderomolini.com/wp-content/themes/hotelcalifornia/css/ie9.css?ver=4.9.18
- https://fonts.googleapis.com/css?family=Playfair+Display%3A100%2C200%2C300%2C400%2C500%2C600%2C700%2C800%2C900%2C100italic%2C200italic%2C300italic%2C400italic%2C500italic%2C600italic%2C700italic%2C800italic%2C900italic%7CPlayfair+Display%3A100%2C200%2C300%2C400%2C500%2C600%2C700%2C800%2C900%2C100italic%2C200italic%2C300italic%2C400italic%2C500italic%2C600italic%2C700italic%2C800italic%2C900italic%7CLato%3A100%2C200%2C300%2C400%2C500%2C600%2C700%2C800%2C900%2C100italic%2C200italic%2C300italic%2C400italic%2C500italic%2C600italic%2C700italic%2C800italic%2C900italic%7CPlayfair+Display%3A100%2C200%2C300%2C400%2C500%2C600%2C700%2C800%2C900%2C100italic%2C200italic%2C300italic%2C400italic%2C500italic%2C600italic%2C700italic%2C800italic%2C900italic%7CLato%3A100%2C200%2C300%2C400%2C500%2C600%2C700%2C800%2C900%2C100italic%2C200italic%2C300italic%2C400italic%2C500italic%2C600italic%2C700italic%2C800italic%2C900italic&
- http://www.anticoborgoderomolini.com/wp-content/plugins/contact-form-7/includes/js/jquery-ui/themes/smoothness/jquery-ui.min.css?ver=1.11.4
- http://www.anticoborgoderomolini.com/wp-includes/js/jquery/jquery.js?ver=1.12.4
- http://www.anticoborgoderomolini.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
- http://www.anticoborgoderomolini.com/wp-content/plugins/bold-page-builder/script_fe.js?ver=1
- http://www.anticoborgoderomolini.com/wp-content/plugins/bt_cost_calculator/jquery.dd.js?ver=4.9.18
- http://www.anticoborgoderomolini.com/wp-content/plugins/bt_cost_calculator/cc.main.js?ver=4.9.18
- http://www.anticoborgoderomolini.com/wp-content/plugins/hotelcalifornia/bt_elements.js?ver=4.9.18
- http://www.anticoborgoderomolini.com/wp-content/themes/hotelcalifornia/js/viewport-units-buggyfill.js?ver=4.9.18
- http://www.anticoborgoderomolini.com/wp-content/themes/hotelcalifornia/js/slick.min.js?ver=4.9.18
- http://www.anticoborgoderomolini.com/wp-content/themes/hotelcalifornia/js/jquery.magnific-popup.min.js?ver=4.9.18
- http://www.anticoborgoderomolini.com/wp-content/themes/hotelcalifornia/js/iscroll.js?ver=4.9.18
- http://www.anticoborgoderomolini.com/wp-content/themes/hotelcalifornia/js/fancySelect.js?ver=4.9.18
Embedded domains
- ogp.me
- yoast.com
- www.anticoborgoderomolini.com
- schema.org
- fonts.googleapis.com
- s.w.org
- www.google-analytics.com
- api.w.org
- www.instagram.com
- www.facebook.com
- www.youtube.com
- anticoborgoderomolini.com
- it-it.facebook.com
- maps.googleapis.com
- adsnet.work
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report