MALICIOUS — 5b78f336dbfaa1209930870c28f1dea54cab8bb184c7fa6cf2d25d4019d32574

MALICIOUS — 5b78f336dbfaa1209930870c28f1dea54cab8bb184c7fa6cf2d25d4019d32574 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the Faceliker family. 2 of 53 detection engines flagged it.

Identification

SHA-256: 5b78f336dbfaa1209930870c28f1dea54cab8bb184c7fa6cf2d25d4019d32574
SHA-1: 9d2229ac81463e2a56d939ad9a2b86e15df239f7
MD5: a033d272c651d75d8aeecf46a2d19dc5
ssdeep: 384:UIkHDzVbbMz06jBCn/GK+8vt1t4ytS0wGSKuBqhq:UHjq0uBC/GQiGIBqhq
TLSH: T16626A41DA9071E9F9596D80DE814CEACB8CEE5DF197590C4CECE8B588C889F5D848322
Submitted as: 5b78f336dbfaa1209930870c28f1dea54cab8bb184c7fa6cf2d25d4019d32574
File type: html · Size: 14464 bytes
Verdict: malicious (84/100) · Family: Faceliker

Detections (2 of 53 engines)

Microsoft Defender: Trojan:HTML/Faceliker.AP!MTB
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 84/100 is the fusion of 5 weighted signals:

Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 26 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://www.vvchem.com, http://www.vvchem.com/products/, http://www.vvchem.com/sell/ - static signal, weight 0.35, confidence 0.60
Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

279 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd
http://www.w3.org/1999/xhtml
http://www.vvchem.com
http://www.vvchem.com/products/
http://www.vvchem.com/sell/
http://www.vvchem.com/buy/
http://www.vvchem.com/suppliers/
http://www.vvchem.com/login.jsp
http://www.vvchem.com/reg.jsp
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
http://www.vvchem.com/cas-100/10035-06-0.html
http://www.vvchem.com/structure/cas-100/10035-06-0.png
http://www.vvchem.com/dictionary/en/
http://beian.miit.gov.cn
http://s23.cnzz.com/stat.php?id=3543253&web_id=3543253&show=pic
https://hm.baidu.com/hm.js?2f78e49beb4702631266e0f0a72433f5
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787929587&P2=404&P3=2&P4=B4mzP5ZGbMlt%2f3qhbky4fh8f3RqL5O%2fQlShFChB%2fE6lJ3kCcDHWmSuZYDkqax3LdsZO8HTeWjMxRVGA8Hd1%2bIA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787929606&P2=404&P3=2&P4=n3ozzOHaMeSez1AlFzuR9o8D1RnSu%2bEd8alC%2blXe%2fOhzpuLQW6oAN44q8BOlHQwCpCHT2jIqNlh32Lv2h%2fdWUw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.w3.org
www.vvchem.com
pagead2.googlesyndication.com
beian.miit.gov.cn
s23.cnzz.com
hm.baidu.com

Embedded IP addresses

52.168.117.174
52.123.252.238
4.230.171.124
57.155.104.224
4.144.132.114
74.178.76.128
20.42.73.28
74.178.76.54
74.179.77.204
20.76.201.171
52.123.128.14
52.123.129.14
20.184.175.17
135.233.45.223
162.159.142.9
20.165.94.46
203.26.79.13
52.110.12.18
52.110.12.8
52.148.114.188
4.247.188.224
172.178.240.161
92.223.78.30
72.153.5.96
52.110.12.45

More Faceliker samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report