MALICIOUS — 5bc1d7683a3511fe55f96d3e0fe329ae964ada11af9d3847d846575693d419db
MALICIOUS — 5bc1d7683a3511fe55f96d3e0fe329ae964ada11af9d3847d846575693d419db is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100). 2 of 54 detection engines flagged it.
Identification
- SHA-256:
5bc1d7683a3511fe55f96d3e0fe329ae964ada11af9d3847d846575693d419db - SHA-1:
e2ccb97b870fd7fcb7bc3394656266d649a565d8 - MD5:
57d7fadf1b5b137e4ee6300c71af1ca3 - ssdeep:
3072:Avnliot2jdpCI2a+vJx1t8aN4Blg4VcgPLGOodoLt+rtBe:AvnlepCZXt8aN4BXci - TLSH:
T19B3D2C5A3A453DCF5884C061BE9C5EE451C785DBB63380E8E2B1EF459878CB0A86DC1B - Submitted as: 5bc1d7683a3511fe55f96d3e0fe329ae964ada11af9d3847d846575693d419db
- File type: html · Size: 131570 bytes
- Verdict: malicious (91/100)
Detections (2 of 54 engines)
- Microsoft Defender: TrojanClicker:JS/Faceliker.M
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 91/100 is the fusion of 6 weighted signals:
- Microsoft Defender flagged TrojanClicker:JS/Faceliker.M (rule
TrojanClicker:JS/Faceliker.M) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://ikatantkj-5.blogspot.com/favicon.ico, http://ikatantkj-5.blogspot.com/feeds/posts/default - static signal, weight 0.35, confidence 0.60
- Extracted generic config (13 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
280 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- login.live.com
- update.googleapis.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- officeclient.microsoft.com
- windows.msn.com
- odc.officeapps.live.com
- www.msn.com
- settings-win.data.microsoft.com
Embedded URLs
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://ikatantkj-5.blogspot.com/favicon.ico
- http://ikatantkj-5.blogspot.com/2013/05/ini-alasan-microsoft-pakai-nama-xbox-one.html
- http://ikatantkj-5.blogspot.com/feeds/posts/default
- http://ikatantkj-5.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/6171280061606055198/posts/default
- http://ikatantkj-5.blogspot.com/feeds/988389221715596778/comments/default
- http://img.okeinfo.net/content/2013/05/29/326/814622/XUa7Az9Ua8.jpg
- https://lh3.googleusercontent.com/proxy/x3H5LSFGs2_q2QgvCQ1KL_Rwi1JMYQrZ2McbE515hK4id52uGy89sT9Mp-hd_hvna1Bp3m4cvBRCTPPSbKZ8nK0_SQ-6-NbpqcqVnL71VXgIrDjxb57k=w1200-h630-p-k-no-nu
- http://fonts.googleapis.com/css?family=Droid+Sans
- http://www.ivythemes.com
- http://mkr-site.blogspot.com
- http://2.bp.blogspot.com/-aKxyQfOeHVA/US9hBVGNkrI/AAAAAAAAIqI/2B8K4Bi4u1Y/s1600/progress_ani.gif
- https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
- https://plus.google.com/108949996304093815163/about
- http://isotope.metafizzy.co
- http://metafizzy.co/#licenses
- https://lh3.googleusercontent.com/-duNoMAb1RS4/T2WEWrOfR8I/AAAAAAAACZ0/ObgHf-PmTuE/s36/03.gif
- https://lh6.googleusercontent.com/-LIr-ZdDp2xI/T2WEYDacVnI/AAAAAAAACaY/W7MF5qKO2sE/s47/06.gif
- https://lh6.googleusercontent.com/-Q5lMkgcmVR4/T2WEWkNi3MI/AAAAAAAACZ4/7VBYeVbx7kA/s36/01.gif
- https://lh3.googleusercontent.com/-mCsZPeixHvA/T2WEWivv9FI/AAAAAAAACZw/64ZGRgdlDeg/s36/02.gif
- https://lh5.googleusercontent.com/-u__sc3DgZ2c/T2d0_lDLueI/AAAAAAAACkw/YbeuRNde61Q/s36/03a.gif
- https://lh5.googleusercontent.com/-EwonQGBTYwo/T2WEXeVq3oI/AAAAAAAACZ8/4ixt2ZVlqrI/s36/04.gif
- https://lh3.googleusercontent.com/-fMtAZDakmBI/T2WEXswr5BI/AAAAAAAACaA/83R1X_PumTk/s36/05.gif
- https://lh3.googleusercontent.com/-Em3lvBgvYlI/T2WElbV0BaI/AAAAAAAACdI/ApynphQdka8/s36/7.gif
Embedded domains
- www.blogger.com
- ikatantkj-5.blogspot.com
- img.okeinfo.net
- lh3.googleusercontent.com
- fonts.googleapis.com
- fonts.gstatic.com
- www.ivythemes.com
- mkr-site.blogspot.com
- 2.bp.blogspot.com
- ajax.googleapis.com
- plus.google.com
- isotope.metafizzy.co
- metafizzy.co
- d.top
- this.offset.top
- b.top
- lh6.googleusercontent.com
- lh5.googleusercontent.com
- lh4.googleusercontent.com
- 1.bp.blogspot.com
- r.link
- 4.bp.blogspot.com
- q.link
- img1.blogblog.com
- blogspot.com
Embedded IP addresses
- 20.184.175.9
- 52.123.252.234
- 4.144.132.223
- 40.84.97.4
- 4.230.171.124
- 135.232.92.97
- 20.42.73.31
- 20.165.94.63
- 172.64.154.167
- 162.159.142.9
- 72.153.5.133
- 52.148.114.188
- 52.110.12.33
File paths
- s:\)\)+/g,
- s:\)+/g,
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report