MALICIOUS — 5bc5fb71605b2be4517bf3dae960b78c5fd7d85346461b020ff9b6449a3a7d08
MALICIOUS — 5bc5fb71605b2be4517bf3dae960b78c5fd7d85346461b020ff9b6449a3a7d08 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the Iframeinject family. 2 of 54 detection engines flagged it.
Identification
- SHA-256:
5bc5fb71605b2be4517bf3dae960b78c5fd7d85346461b020ff9b6449a3a7d08 - SHA-1:
04c14445ad179030f595a0cbe6c71622f65c9e1e - MD5:
b60eddeb16a89fa6d56a6e250abf1bbf - ssdeep:
768:HLT0EipB/k+sKpN19V+BHtApjp1p5ahSMt3jajpvS9w/ZD2Y/dQnw:rTupB/k++HtAdfPahSMBajpK9w/Z1 - TLSH:
T1E934A749770976CF2490D113916C4EA4C0C5C2ABE73385F6D6A7F640A9A9EB03C2FC96 - Submitted as: 5bc5fb71605b2be4517bf3dae960b78c5fd7d85346461b020ff9b6449a3a7d08
- File type: html · Size: 52608 bytes
- Verdict: malicious (92/100) · Family: Iframeinject
Detections (2 of 54 engines)
- Microsoft Defender: Trojan:JS/Iframeinject.AH
- Kaspersky (KVRT): Trojan-Downloader.JS.Iframe.dfw
Why this verdict
The malicious score of 92/100 is the fusion of 7 weighted signals:
- Microsoft Defender flagged Trojan:JS/Iframeinject.AH (rule
Trojan:JS/Iframeinject.AH) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Trojan-Downloader.JS.Iframe.dfw (rule
Trojan-Downloader.JS.Iframe.dfw) - engine signal, weight 0.55, confidence 0.85 - Obfuscated powershell script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 1 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://keywebtracker.com/?if=1&scr_w=, http://ie7-news.blogspot.com/favicon.ico - static signal, weight 0.35, confidence 0.60
- Extracted generic config (13 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
278 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- officeclient.microsoft.com
- www.msn.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- licensing.mp.microsoft.com
Dropped files
- 10c59a8c3c2c45b50cf349471cca0b43ea9ce0d0a06c40b8c4e108e4acedd471 -
10c59a8c3c2c45b50cf349471cca0b43ea9ce0d0a06c40b8c4e108e4acedd471
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://keywebtracker.com/?if=1&scr_w=
- http://ie7-news.blogspot.com/favicon.ico
- http://ie7-news.blogspot.com/search/label/panhard%20ct%2024
- http://ie7-news.blogspot.com/feeds/posts/default
- http://ie7-news.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/6262718143475989127/posts/default
- https://www.blogger.com/profile/04781256308906644932
- https://www.blogger.com/dyn-css/authorization.css?targetBlogID=6262718143475989127&
- https://apis.google.com/js/plusone.js
- http://ie7-news.blogspot.com/
- http://ie7-news.blogspot.com/2011/07/puglia-natale-2007-y10-fire.html
- http://lh5.ggpht.com/_KMC_t82A_JA/TLM82Zl4yhI/AAAAAAAABXQ/oXm73DzPGUg/050.JPG
- http://oskin.ru/pub/chrysler-dodge/manuals/Logos/Chrysler-Wings.jpg
- http://th02.deviantart.net/fs43/PRE/f/2009/129/4/f/Saturn_Sky_by_fliOx.jpg
- http://i53.tinypic.com/2qipc37.jpg
- http://stunnrstatus.files.wordpress.com/2010/05/mattcooke36frontstance.jpg
- http://connorsmotorcar.com/59Buic/59Buick.JPG
- http://pictures.topspeed.com/cars/saturn/2009-saturn-sky-ar58908/IMG/crop/200806/2009-saturn-sky-6-1_1600x0w.jpg
- http://images3.wikia.nocookie.net/__cb20100529084940/automobile/images/b/bb/Maserati_Birdcage_75th_open.JPG
- http://www.benzinsider.com/wp-content/uploads/2010/03/486724_850827_3599_2883_860918AC21-Custom.jpg
Embedded domains
- www.w3.org
- www.google.com
- www.blogger.com
- keywebtracker.com
- ie7-news.blogspot.com
- blogspot.com
- apis.google.com
- pagead2.googlesyndication.com
- lh5.ggpht.com
- oskin.ru
- th02.deviantart.net
- i53.tinypic.com
- stunnrstatus.files.wordpress.com
- connorsmotorcar.com
- pictures.topspeed.com
- images3.wikia.nocookie.net
- www.benzinsider.com
- jackfrostaa.com
- lh6.ggpht.com
- fr.academic.ru
- behance.vo.llnwd.net
- local.aaca.org
- www.danziricambi.it
- www.mycarheaven.com
- 2.bp.blogspot.com
Embedded IP addresses
- 52.168.117.175
- 57.155.104.224
- 4.230.171.124
- 20.247.185.124
- 74.178.240.51
- 52.168.117.170
- 135.233.95.144
- 172.64.154.167
- 52.110.12.26
- 52.110.12.47
- 40.84.97.4
- 20.42.73.26
- 72.153.5.139
- 52.148.114.188
- 52.110.12.3
More Iframeinject samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report