MALICIOUS — 5ed3c80e9bfcdc1d582af61cf8992110bedb0816fff21f5473ebe38698a6bbce

MALICIOUS — 5ed3c80e9bfcdc1d582af61cf8992110bedb0816fff21f5473ebe38698a6bbce is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (70/100). 0 of 54 detection engines flagged it.

Identification

• SHA-256: 5ed3c80e9bfcdc1d582af61cf8992110bedb0816fff21f5473ebe38698a6bbce
• SHA-1: fc6cfd526789126c62542ee7fedd1d6380ac083d
• MD5: 4c68ec80435a7f6517912c4aa72cc56b
• ssdeep: 768:m1EpKVAqnd+qi9q7B2omZ7hzx1f2kiRj:m1aKVhnd+LABXmZ7hzx1Q
• TLSH: T13C2C1831B654269908D080172FED59D455CF8A17A1B700F8ECA7BF88E818D727AC5CEE
• Submitted as: 5ed3c80e9bfcdc1d582af61cf8992110bedb0816fff21f5473ebe38698a6bbce
• File type: html · Size: 26841 bytes
• Verdict: malicious (70/100)

Detections (0 of 54 engines)

No engine flagged this sample.

Why this verdict

The malicious score of 70/100 is the fusion of 5 weighted signals:

• Obfuscated javascript script: dynamic-exec (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://katwvolta.blogspot.com/favicon.ico, http://katwvolta.blogspot.com/search/label/CSI - static signal, weight 0.35, confidence 0.60
• Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

279 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• ctldl.windowsupdate.com
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• officeclient.microsoft.com
• windows.msn.com
• www.msn.com
• odc.officeapps.live.com
• settings-win.data.microsoft.com
• assets.msn.com

Dropped files

• 9df288d7098c73a9fa5fd19c46ca81266b7c841420ea36617cd9587196703e54 - 9df288d7098c73a9fa5fd19c46ca81266b7c841420ea36617cd9587196703e54

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
• http://katwvolta.blogspot.com/favicon.ico
• http://katwvolta.blogspot.com/search/label/CSI
• http://katwvolta.blogspot.com/feeds/posts/default
• http://katwvolta.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/9138148805797236471/posts/default
• https://www.blogger.com/profile/00518819164720077228
• https://99cools99.blogspot.com/p/anature.html
• http://www.blogger.com/
• http://4.bp.blogspot.com/_qJFbsMHBJNg/SoaUE7XY4hI/AAAAAAAAAJY/fQ02np_6CiY/s1600/libg300.png
• http://3.bp.blogspot.com/_rLYhkzmU7RY/TDvdaQEQJhI/AAAAAAAAAAM/tQr4P8Rb7AQ/s1600/line.gif
• https://www.blogger.com/dyn-css/authorization.css?targetBlogID=9138148805797236471&amp
• http://katwvolta.blogspot.com/
• https://99cools99.blogspot.com/p/nature.html
• https://www.blogger.com/static/v1/widgets/1470655889-widgets.js
• http://katwvolta.blogspot.com/search
• https://www.blogger.com
• https://apis.google.com/js/plusone.js
• https://www.blogger.com/static/v1/jsbin/1147859222-lbx.js
• https://www.blogger.com/static/v1/v-css/4076883957-lightbox_bundle.css
• http://www.msftconnecttest.com/connecttest.txt

Embedded domains

• www.w3.org
• www.google.com
• www.blogger.com
• katwvolta.blogspot.com
• industry.it
• 99cools99.blogspot.com
• 4.bp.blogspot.com
• 3.bp.blogspot.com
• blogspot.com
• www.blogblog.com
• apis.google.com
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 52.168.117.170
• 4.230.171.124
• 85.210.196.11
• 20.247.184.142
• 57.155.101.212
• 74.179.77.204
• 135.232.92.97
• 4.207.44.75
• 20.42.65.85
• 4.150.223.109
• 20.42.65.84
• 72.154.7.99
• 52.148.114.188
• 52.110.12.30
• 52.110.12.11

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report