MALICIOUS — 5bc4744354e2f65d4384b136bbc237ebed87bedb280065074342097e5b8265cc

MALICIOUS — 5bc4744354e2f65d4384b136bbc237ebed87bedb280065074342097e5b8265cc is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the Wacatac family. 1 of 54 detection engines flagged it.

Identification

SHA-256: 5bc4744354e2f65d4384b136bbc237ebed87bedb280065074342097e5b8265cc
SHA-1: d95adf71774e11265abedd68f620e7374e187ace
MD5: 5b505ce281ae6f38368ff650998eec95
ssdeep: 1536:LIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZtbI:atbaGCObh6L
TLSH: T1C533F942BBE98CE5D1EE629190815244DCC27C0B1521FD5980ECEBE7786F76394BC48B
Submitted as: 5bc4744354e2f65d4384b136bbc237ebed87bedb280065074342097e5b8265cc
File type: html · Size: 51424 bytes
Verdict: malicious (84/100) · Family: Wacatac

Detections (1 of 54 engines)

Microsoft Defender: Trojan:Script/Wacatac.B!ml

Why this verdict

The malicious score of 84/100 is the fusion of 6 weighted signals:

Microsoft Defender flagged Trojan:Script/Wacatac.B!ml (rule Trojan:Script/Wacatac.B!ml) - engine signal, weight 0.55, confidence 0.85
Obfuscated batch script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://ogp.me/ns/fb#, http://4.bp.blogspot.com/_Sd3kgrxXWzY/SyAsBVuwIOI/AAAAAAAAAYM/rsrWH5iSpY4/s320/slmgr5.jpg, https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js - static signal, weight 0.35, confidence 0.60
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

280 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://ogp.me/ns/fb#
http://zulfikar.co.uk/blog/wp-content/uploads/2014/11/slmgr_DLV_Output_Retail.jpg
http://4.bp.blogspot.com/_Sd3kgrxXWzY/SyAsBVuwIOI/AAAAAAAAAYM/rsrWH5iSpY4/s320/slmgr5.jpg
http://fasrdigi524.weebly.com/1/post/2019/10/slmgr-vbs-output-to-file.html
https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
https://www.google.com/recaptcha/api.js
https://fasrdigi524.weebly.com/1/post/2019/10/slmgr-vbs-output-to-file.html
http://twitter.com/share?url=https://fasrdigi524.weebly.com/1/post/2019/10/slmgr-vbs-output-to-file.html
https://www.weebly.com/signup?utm_source=internal&utm_medium=footer
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

ogp.me
zulfikar.co.uk
4.bp.blogspot.com
fasrdigi524.weebly.com
cdn2.editmysite.com
fonts.googleapis.com
cdn1.editmysite.com
ajax.googleapis.com
www.weebly.com
www.google.com
live.sysinternals.com
twitter.com
google-analytics.com
test.name
ec.editmysite.com
connect.facebook.net
tter.com

Embedded IP addresses

10.0.0.100
10.0.0.200
20.184.175.0
4.230.171.124
85.210.193.152
20.42.179.192
135.232.92.97
135.232.92.137
20.52.64.201
52.253.84.76
92.223.78.30
52.168.117.168
51.116.253.170
72.145.35.98
52.148.114.188
52.110.12.46
52.110.12.22

More Wacatac samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report