MALICIOUS — 5bc24a67c2f4a0c77de176fdbb8b00d63cff12a8617a88220124662163b95f8e
MALICIOUS — 5bc24a67c2f4a0c77de176fdbb8b00d63cff12a8617a88220124662163b95f8e is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100), attributed to the TrojanClicker family. 2 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
5bc24a67c2f4a0c77de176fdbb8b00d63cff12a8617a88220124662163b95f8e - SHA-1:
47d22e4c37e6a34382f23555a9efc8ad822ed722 - MD5:
afe62c85d3d36a30f268d3ee36caf13c - ssdeep:
768:ksEBaggAQHzy/DZgy+Ei5x9MnjleYvZ7K3aDv6zv+daLFeCy4fM/+pexaL:kuB/EiMleYvZ7Zr67+daLoCyYM/+p8m - TLSH:
T1A9330A1F39653E8F09904116A67D07D8D2C8D6B3C93385F96DF6DF48E858E602E188A3 - Submitted as: 5bc24a67c2f4a0c77de176fdbb8b00d63cff12a8617a88220124662163b95f8e
- File type: html · Size: 47938 bytes
- Verdict: malicious (87/100) · Family: TrojanClicker
Detections (2 of 54 engines)
- Microsoft Defender: TrojanClicker:JS/Faceliker.N
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 87/100 is the fusion of 4 weighted signals:
- Microsoft Defender flagged TrojanClicker:JS/Faceliker.N (rule
TrojanClicker:JS/Faceliker.N) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://hd-canliligtvizle.blogspot.com/favicon.ico, http://hd-canliligtvizle.blogspot.com/search/label/Full%20HD%20Film%20izle - static signal, weight 0.35, confidence 0.60
Dynamic analysis (windows)
21577 behavior events · 1 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- 252.0.0.224.in-addr.arpa.
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
- dns.msftncsi.com
- 209.52.40.23.in-addr.arpa.
- settings-win.data.microsoft.com
- 225.188.215.172.in-addr.arpa.
- tas02.sls.update.microsoft.com
- v10.events.data.microsoft.com
- 63.94.165.20.in-addr.arpa.
- nexusrules.officeapps.live.com
- 57.226.107.13.in-addr.arpa.
Dropped files
- 701a354700a02fb1d2277f7b42021182531d4c36184c4505224035764fe77ea4 -
701a354700a02fb1d2277f7b42021182531d4c36184c4505224035764fe77ea4
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://hd-canliligtvizle.blogspot.com/favicon.ico
- http://hd-canliligtvizle.blogspot.com/search/label/Full%20HD%20Film%20izle
- http://hd-canliligtvizle.blogspot.com/feeds/posts/default
- http://hd-canliligtvizle.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/4254843182138907372/posts/default
- http://4.bp.blogspot.com/_v5IxGTiMTD8/S8LH7SKmeXI/AAAAAAAAA4Q/h6nNNJUlloA/s1600/bk_body.jpg
- http://2.bp.blogspot.com/_v5IxGTiMTD8/S8LH71DmYTI/AAAAAAAAA4Y/u9qGJcOWhQk/s1600/bk_colright.jpg
- http://4.bp.blogspot.com/_v5IxGTiMTD8/S8LH8FmflNI/AAAAAAAAA4g/hoorE_Um66A/s1600/bk_footer.jpg
- http://2.bp.blogspot.com/_v5IxGTiMTD8/S8LH8YxQNII/AAAAAAAAA4o/gIE1dMrJW_M/s1600/bk_search.jpg
- http://1.bp.blogspot.com/_v5IxGTiMTD8/S8LH872hY-I/AAAAAAAAA4w/nrWW1uFbYdo/s400/ico_rss.png
- http://1.bp.blogspot.com/_v5IxGTiMTD8/S8LIzYEnBAI/AAAAAAAAA44/8ac4TpvyWhI/s400/bk_separattor_horiz.jpg
- http://2.bp.blogspot.com/_v5IxGTiMTD8/S8LI0NARUcI/AAAAAAAAA5Q/TsTThDt3_xg/s400/bk_dotted_thick.png
- http://1.bp.blogspot.com/_v5IxGTiMTD8/S8LIz82xTmI/AAAAAAAAA5I/UZ3OICqNcOE/s400/bk_meta.jpg
- http://1.bp.blogspot.com/_v5IxGTiMTD8/S8LI0ryym5I/AAAAAAAAA5Y/yIAXt74UsSs/s400/ico_twitter.png
- http://4.bp.blogspot.com/_v5IxGTiMTD8/S8LK4Tc-G9I/AAAAAAAAA5w/5gnoA-n0L28/s400/ico_facebook.png
- http://3.bp.blogspot.com/_v5IxGTiMTD8/S8LK3gYQqXI/AAAAAAAAA5g/aVjfuXi32QI/s400/ico_flickr.png
- http://2.bp.blogspot.com/_v5IxGTiMTD8/S8LK4EWNeuI/AAAAAAAAA5o/S8PC6moGd-0/s400/ico_linkedin.png
- http://4.bp.blogspot.com/_v5IxGTiMTD8/S8LK4oLRTNI/AAAAAAAAA54/rrb6IYZZCy4/s1600/bk_slider_text.jpg
- http://2.bp.blogspot.com/_v5IxGTiMTD8/S8LIzuM38lI/AAAAAAAAA5A/QO_-iRXDh3Q/s400/bk_dotted.png
- http://3.bp.blogspot.com/_v5IxGTiMTD8/S8LODnCg2rI/AAAAAAAAA7I/XOGs10lJlMw/s400/but_search.jpg
Embedded domains
- www.w3.org
- www.google.com
- www.blogger.com
- hd-canliligtvizle.blogspot.com
- www.anshuldudeja.com
- 4.bp.blogspot.com
- 2.bp.blogspot.com
- 1.bp.blogspot.com
- 3.bp.blogspot.com
- ajax.googleapis.com
- btemplatescripts.googlecode.com
- blogspot.com
- apis.google.com
- pagead2.googlesyndication.com
- www.yeniresimler.net
- cetinyilmaz.files.wordpress.com
- www.facebook.com
- like.style.top
- this.style.top
- gk.site5.com
- www.blogblog.com
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 85.210.193.152
- 13.69.239.69
- 51.132.193.105
- 74.179.77.204
- 20.42.65.88
- 72.154.7.101
- 51.104.15.252
- 72.145.35.97
- 52.148.114.188
- 172.215.188.225
- 4.150.223.111
- 52.123.129.14
- 20.42.179.204
- 72.145.35.111
- 20.42.73.31
- 20.165.94.63
- 4.150.223.113
- 4.150.223.96
- 20.42.65.94
- 172.172.255.216
- 40.84.97.4
- 4.150.223.101
- 52.182.143.212
- 57.155.104.224
- 85.210.196.11
More TrojanClicker samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report