MALICIOUS — 5bc472a3a60e81e47a1db9890c2292a205bd72c3864fa9640566561fb20277d5
MALICIOUS — 5bc472a3a60e81e47a1db9890c2292a205bd72c3864fa9640566561fb20277d5 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 3 of 54 detection engines flagged it.
Identification
- SHA-256:
5bc472a3a60e81e47a1db9890c2292a205bd72c3864fa9640566561fb20277d5 - SHA-1:
18b55c08926ab37bbcf120615f1b50344cb52e20 - MD5:
fed7821071b1f9c6c4e1f1640f2df496 - ssdeep:
768:FMmbVK4py7hgV4EgGH45X2ztxYTgY245X2ztC4jX+IJT2qMS:FMmgOya4EYlKjX+IJ0S - TLSH:
T1692FC6592BA4398A08D082132B7C46D8D1D9D6D7E13383E9D266FF4CD538CA0AD58CDB - Submitted as: 5bc472a3a60e81e47a1db9890c2292a205bd72c3864fa9640566561fb20277d5
- File type: html · Size: 35339 bytes
- Verdict: malicious (99/100)
Detections (3 of 54 engines)
- ClamAV (daily): Html.Exploit.Agent-6598769-0
- Microsoft Defender: TrojanClicker:JS/Faceliker.A
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 99/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Html.Exploit.Agent-6598769-0 (rule
Html.Exploit.Agent-6598769-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged TrojanClicker:JS/Faceliker.A (rule
TrojanClicker:JS/Faceliker.A) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://hamm-leverkusen.blogspot.com/favicon.ico, http://hamm-leverkusen.blogspot.com/ - static signal, weight 0.35, confidence 0.60
- Extracted generic config (15 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
280 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- login.live.com
- update.googleapis.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- settings-win.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- windows.msn.com
- officeclient.microsoft.com
- www.msn.com
- odc.officeapps.live.com
Dropped files
- 9df288d7098c73a9fa5fd19c46ca81266b7c841420ea36617cd9587196703e54 -
9df288d7098c73a9fa5fd19c46ca81266b7c841420ea36617cd9587196703e54
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://hamm-leverkusen.blogspot.com/favicon.ico
- http://hamm-leverkusen.blogspot.com/
- http://hamm-leverkusen.blogspot.com/feeds/posts/default
- http://hamm-leverkusen.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/6864906178019282140/posts/default
- https://www.blogger.com/profile/17539897321937853267
- http://ajax.googleapis.com/ajax/libs/jquery/1.6.2/jquery.min.js
- https://www.blogger.com/dyn-css/authorization.css?targetBlogID=6864906178019282140&
- https://www.blogger.com/blogin.g?blogspotURL=http://hamm-leverkusen.blogspot.com/&
- http://hamm-leverkusen.blogspot.com/2009/02/caseiras-lindas.html
- http://4.bp.blogspot.com/_34NhrbhB4ks/SaaZN-hYC_I/AAAAAAAAAKo/ulGLr5vQ_f0/w72-h72-p-k-no-nu/AsmeninasdaUniversidadeNova16.JPG
- http://hamm-leverkusen.blogspot.com/2012/10/o-gostinho-da-praia-part2.html
- http://1.bp.blogspot.com/-8AlToYFS5JI/T74gbjT-OaI/AAAAAAAABS4/pKX4XlM8Clo/w72-h72-p-k-no-nu/1.png
- http://hamm-leverkusen.blogspot.com/2008/12/bem-bom.html
- http://hamm-leverkusen.blogspot.com/2009/12/a-beleza-da-natureza.html
- http://2.bp.blogspot.com/_34NhrbhB4ks/SytnP_OZgCI/AAAAAAAAAeA/1BU_lGUPkX4/w72-h72-p-k-no-nu/Natureza.jpg
- http://hamm-leverkusen.blogspot.com/2014/12/lidiya-a.html
- http://2.bp.blogspot.com/-9maZ5wiYuvM/TxVSP-74McI/AAAAAAAAEso/BBG3pFKzPR4/w72-h72-p-k-no-nu/lidiya_a_met-art_VLE_19_7.jpg
- http://hamm-leverkusen.blogspot.com/2008/11/a-beleza-das-flores.html
- http://3.bp.blogspot.com/_34NhrbhB4ks/SSFuM-t87MI/AAAAAAAAAB8/l_TnR6zvC18/w72-h72-p-k-no-nu/flor+1.jpg
Embedded domains
- www.w3.org
- www.google.com
- www.blogger.com
- hamm-leverkusen.blogspot.com
- ajax.googleapis.com
- blogspot.com
- 4.bp.blogspot.com
- 1.bp.blogspot.com
- 2.bp.blogspot.com
- 3.bp.blogspot.com
- www.gstatic.com
- schema.org
- www.blogblog.com
- apis.google.com
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 51.11.192.50
- 20.247.184.197
- 48.211.4.16
- 4.230.171.124
- 104.46.162.231
- 74.178.240.51
- 74.178.240.61
- 20.165.94.63
- 104.18.33.89
- 52.110.12.22
- 52.110.12.50
- 20.42.179.192
- 20.184.175.20
- 4.150.223.107
- 52.148.114.188
- 92.223.78.30
- 72.154.7.110
- 52.110.12.44
- 52.110.12.49
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report