MALICIOUS — virussign.com_119b7b7033e5c1a42b44d79a2c9b1070.vir
MALICIOUS — virussign.com_119b7b7033e5c1a42b44d79a2c9b1070.vir is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100), attributed to the Phonzy family. 2 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
5d68d32777e202fdf538e253c9b0be493da42094e4635d5e790b4096ec9f0e36 - SHA-1:
1f26765c84c1f5b57e2613ebf3a111041f8b4a23 - MD5:
119b7b7033e5c1a42b44d79a2c9b1070 - ssdeep:
1536:RuIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7S612:Re1DGSCdYLgD8GelCmsUsgRElywq2L - TLSH:
T1963A5B43B9AA684118E9026693C6DD0138C6BE5F6430FD82966CCFE8F44EBF055C85E7 - Submitted as: virussign.com_119b7b7033e5c1a42b44d79a2c9b1070.vir
- File type: html · Size: 100443 bytes
- Verdict: malicious (95/100) · Family: Phonzy
Source: VirusSign · first seen 2026-07-24T00:00:00.000Z · SHA-256 verified
Detections (2 of 51 engines)
- Microsoft Defender: Trojan:Script/Phonzy.B!ml
- Emsisoft (Emergency Kit): JS:Trojan.Cryxos.6551
MITRE ATT&CK
Why this verdict
The malicious score of 95/100 is the fusion of 9 weighted signals:
- Memory forensics: 5 finding(s), e.g. RWX/private injected region in powershell.exe (pid 2548) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Microsoft Defender flagged Trojan:Script/Phonzy.B!ml (rule
Trojan:Script/Phonzy.B!ml) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged JS:Trojan.Cryxos.6551 (rule
JS:Trojan.Cryxos.6551) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: http://ogp.me/ns/fb#, https://www.actualidadgadget.com/wp-content/uploads/2015/11/tv-online-830x515.png, http://s2.dmcdn.net/c39V/1280x720-Ufx.jpg - static signal, weight 0.35, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (17 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Extracted generic config (17 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
275 behavior events · 1 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- www.bing.com
- desktop-hsgcbep
- fs.microsoft.com
- dns.msftncsi.com
- self.events.data.microsoft.com
- g.live.com
- geo.prod.do.dsp.mp.microsoft.com
- geover.prod.do.dsp.mp.microsoft.com
- watson.events.data.microsoft.com
- settings-win.data.microsoft.com
- aps.prod.windows.com
- msedge.api.cdp.microsoft.com
- www.msftncsi.com
- config.edge.skype.com
- 192.168.122.107
- 192.168.122.1
- 224.0.0.252
- 192.168.122.255
- 239.255.255.250
Embedded URLs
- http://ogp.me/ns/fb#
- https://www.actualidadgadget.com/wp-content/uploads/2015/11/tv-online-830x515.png
- http://s2.dmcdn.net/c39V/1280x720-Ufx.jpg
- https://image.winudf.com/v2/image/Y29tLmRldi5WZW5lenVlbGFUdkNoYW5uZWxfaWNvbl8wXzM0MTFhOTVl/icon.png?w=170&fakeurl=1&type=.png
- http://i.ytimg.com/vi/_8Wnm59IIMU/maxresdefault.jpg
- https://i.ytimg.com/vi/e6AAD88csQI/maxresdefault.jpg
- https://i.ytimg.com/vi/F9r74_6d8pQ/hqdefault.jpg
- http://i0.wp.com/tv.futboladiccion.com/wp-content/uploads/2016/08/america-vs-chivas-en-vivo-gratis-liga-mx-2016.jpg?fit=1200%2C900
- http://3.bp.blogspot.com/-k3EMKJw55qE/WVwuMsWyj8I/AAAAAAAADmM/4SjL6Xk_XfouPD_PAsz8Stp9xZFDIKM7QCK4BGAYYCw/s1600/libertadores-04-julio-guarani-river.png
- http://1.bp.blogspot.com/-eon9tdjpVx0/VceYFUqzooI/AAAAAAAA0d4/J1yNlHh_K98/s320/video%2Bbolivia.jpg
- https://1.bp.blogspot.com/-TZu0SliF8_8/VQJNw-oNl0I/AAAAAAAAC04/Z7Tkill47b4/s1600/Ni%C3%B1os%2Bagradecen%2Ba%2Bla%2BOSV%2Bpor%2Bsu%2Blabor%2Ben%2Blas%2Bescuelas%2B-%2BYouTube%2B15.jpg
- http://videopusscof.weebly.com/
- https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
- https://www.google.com/recaptcha/api.js
- https://image.winudf.com/v2/image/Y29tLmRldi5WZW5lenVlbGFUdkNoYW5uZWxfaWNvbl8wXzM0MTFhOTVl/icon.png?w=170&fakeurl=1&type=.png
- https://www.youtube.com/embed/4mq7ltjerTk
- https://videopusscof.weebly.com/1/post/2018/01/ver-tv-en-vivo-gratis-venezuela6844809.html
- http://twitter.com/share?url=https://videopusscof.weebly.com/1/post/2018/01/ver-tv-en-vivo-gratis-venezuela6844809.html
- https://www.youtube.com/embed/Q7VZrD28e_g&list=PLL1hqxsrI5B8uNsiFyB2EvvZcoi17ipq7
- https://videopusscof.weebly.com/1/post/2018/01/ver-television-en-vivo-espanola1113200.html
- http://twitter.com/share?url=https://videopusscof.weebly.com/1/post/2018/01/ver-television-en-vivo-espanola1113200.html
- https://www.youtube.com/embed/50z5ipz0Ulg
- https://videopusscof.weebly.com/1/post/2018/01/america-en-vivo-por-internet-gratis-20175868883.html
- http://twitter.com/share?url=https://videopusscof.weebly.com/1/post/2018/01/america-en-vivo-por-internet-gratis-20175868883.html
- https://www.youtube.com/embed/0tek2aa8hAQ
Embedded domains
- ogp.me
- www.actualidadgadget.com
- s2.dmcdn.net
- image.winudf.com
- i.ytimg.com
- i0.wp.com
- tv.futboladiccion.com
- 3.bp.blogspot.com
- 1.bp.blogspot.com
- videopusscof.weebly.com
- cdn2.editmysite.com
- fonts.googleapis.com
- cdn1.editmysite.com
- ajax.googleapis.com
- www.weebly.com
- www.google.com
- www.youtube.com
- twitter.com
- r.se
- www.televen.com
- 2.bp.blogspot.com
- www.televisionparatodos.tv
- lh3.googleusercontent.com
- www.elcomercio.com
- img.vavel.com
More Phonzy samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report