MALICIOUS — 5ed01200623fa847cac09d8328f750b7bb7832d785710b4c784dcbdefa6c812d

MALICIOUS — 5ed01200623fa847cac09d8328f750b7bb7832d785710b4c784dcbdefa6c812d is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (74/100). 0 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 5ed01200623fa847cac09d8328f750b7bb7832d785710b4c784dcbdefa6c812d
• SHA-1: 5b81e63f692936fb202fa0e1853cc77861938e16
• MD5: 3de7d6e3308b24bb250ab27e5b939e1e
• ssdeep: 3072:rLeMh7qDWJgRhq4UdWJiz6UAIJ8pa98HrqkzaG/42FdAld/sggckHb0+rGu7Z3:rLeMh7qDWJ+nqWkZF6pa98HrDfWqnD
• TLSH: T139425E5E79DAADCECC5C641B7EDC1AE5614B8B1FF47240C8D26AEF40D4B4CA0684881E
• Submitted as: 5ed01200623fa847cac09d8328f750b7bb7832d785710b4c784dcbdefa6c812d
• File type: html · Size: 217561 bytes
• Verdict: malicious (74/100)

Detections (0 of 54 engines)

No engine flagged this sample.

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 74/100 is the fusion of 6 weighted signals:

• Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Contacted 23 external host(s) and 15 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Embedded network infrastructure: https://math-bimprippt19.blogspot.com/favicon.ico, https://math-bimprippt19.blogspot.com/feeds/posts/default, https://math-bimprippt19.blogspot.com/feeds/posts/default?alt=rss - static signal, weight 0.35, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

14846 behavior events · 1 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• d.1.d.1.c.4.2.1.4.9.5.2.6.e.8.b.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa.
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 76.0.240.10.in-addr.arpa.
• 1.0.240.10.in-addr.arpa.
• 251.0.0.224.in-addr.arpa.
• 76.44.207.4.in-addr.arpa.
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• tas02.sls.update.microsoft.com
• v10.events.data.microsoft.com
• 90.65.42.20.in-addr.arpa.

Dropped files

• cf97e1a6d3f57e22748715f7ecdc28bf07d16d6856a707572b42a76d51d7b27d - cf97e1a6d3f57e22748715f7ecdc28bf07d16d6856a707572b42a76d51d7b27d

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://math-bimprippt19.blogspot.com/favicon.ico
• https://math-bimprippt19.blogspot.com/2013/08/rangkuman-materi-integral.html
• https://math-bimprippt19.blogspot.com/feeds/posts/default
• https://math-bimprippt19.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/792254905679805799/posts/default
• https://math-bimprippt19.blogspot.com/feeds/5485250106730015714/comments/default
• https://www.blogger.com/static/v1/jsbin/403901366-ieretrofit.js
• http://upload.wikimedia.org/math/0/9/b/09b51ce4b5d77f40b7ca997765f9baea.png
• https://lh3.googleusercontent.com/proxy/v4IVrL_UDzG_0ikmEMUK6kqOp9EH93cBG6j0hVfgFPuT6p0ZdFRIS5D-a_vDDxbBs2pwtW24fcU_skyPSTDfaDhrabxulamUZs3OSRq0wBE4d7to4WB0zh6M1ZGvZno=w1200-h630-p-k-no-nu
• http://meyerweb.com/eric/tools/css/reset/
• http://cssreset.com
• https://www.blogger.com/dyn-css/authorization.css?targetBlogID=792254905679805799&amp
• http://schema.org/Blog
• https://math-bimprippt19.blogspot.com/
• https://www.kkaktrichannel.info/p/cari.html
• https://math-bimprippt19.blogspot.com/search/label/kelas%206
• https://math-bimprippt19.blogspot.com/search/label/kelas%207
• https://math-bimprippt19.blogspot.com/search/label/Kelas%208
• https://math-bimprippt19.blogspot.com/search/label/kelas%209
• https://math-bimprippt19.blogspot.com/search/label/kelas10
• https://math-bimprippt19.blogspot.com/search/label/kelas11

Embedded domains

• www.w3.org
• www.google.com
• math-bimprippt19.blogspot.com
• www.blogger.com
• upload.wikimedia.org
• lh3.googleusercontent.com
• meyerweb.com
• cssreset.com
• jquery.org
• e.top
• g.top
• this.name
• b.name
• d.top
• b.top
• m.top
• b.top-h.top
• blogspot.com
• schema.org
• www.kkaktrichannel.info
• data-vocabulary.org
• t.link
• lh5.googleusercontent.com
• lh4.googleusercontent.com
• lh6.googleusercontent.com

Embedded IP addresses

• 4.150.223.108
• 13.89.179.15
• 34.54.88.138
• 20.42.179.192
• 172.215.188.232
• 162.159.140.229
• 40.84.85.40
• 4.207.44.76
• 74.178.240.61
• 57.155.101.212
• 20.42.179.204
• 20.184.175.16
• 20.42.65.90
• 40.84.97.4
• 51.104.15.252
• 172.172.255.216
• 85.210.193.152
• 135.233.95.144
• 172.178.240.161
• 74.178.76.44
• 85.210.196.11
• 20.42.73.25
• 48.211.4.16
• 52.148.114.188
• 57.154.63.210

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report