SUSPICIOUS — 5d97620b750aa59c679ac47068f1843810710e4f9772a1796d16803a05d7bab4

SUSPICIOUS — 5d97620b750aa59c679ac47068f1843810710e4f9772a1796d16803a05d7bab4 is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 5d97620b750aa59c679ac47068f1843810710e4f9772a1796d16803a05d7bab4
• SHA-1: 7dcabb8490243802c73dc5b4eaac2e3270bb742c
• MD5: f881cfe274d6839d8b7dad34b584baab
• ssdeep: 768:tWB6/8lHJdkMioFpg54UB2yQEny+NNxV4KgRgZmJHu:b0d3ioFpg54UB2yQEny+BaKgqYJO
• TLSH: T1462CA44B785D6D8ECE0E42AF3DC9BDD97713CE56B58588C892B9C348BCD0C90786442A
• Submitted as: 5d97620b750aa59c679ac47068f1843810710e4f9772a1796d16803a05d7bab4
• File type: script · Size: 26162 bytes
• Verdict: suspicious (54/100)

Detections (2 of 53 engines)

• Microsoft Defender: Trojan:JS/Agent.AG!MSR
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec, defense-evasion (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://jqueryvalidation.org/ - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://jqueryvalidation.org/

Embedded domains

• jqueryvalidation.org
• j.name
• a.name
• b.name
• this.name
• e.name
• f.name
• a.element.name
• c.name

File paths

• C:\\fakepath\\

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report