MALICIOUS — 5ed998d92e1e7da900620c17712b8dea86903f907d7fec2f69a561925a9f83b1
MALICIOUS — 5ed998d92e1e7da900620c17712b8dea86903f907d7fec2f69a561925a9f83b1 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100). 2 of 54 detection engines flagged it.
Identification
- SHA-256:
5ed998d92e1e7da900620c17712b8dea86903f907d7fec2f69a561925a9f83b1 - SHA-1:
c38cb97f319396a2602045e9fe43976d0d000949 - MD5:
bcc7cd98501e95940299853deb4ef2d6 - ssdeep:
1536:1BKZSl75WcHdxet6siC9KO9J0F9Ee+nyOB6qUi3l/h:1BKZS15WcHm32O9J0F9Ee+yOsqU2l/h - TLSH:
T19536B42E2A1A778B04E0950678AC8ED5C1CA8653F923C4F5F5A37F849434D78EC0A993 - Submitted as: 5ed998d92e1e7da900620c17712b8dea86903f907d7fec2f69a561925a9f83b1
- File type: html · Size: 66634 bytes
- Verdict: malicious (91/100)
Detections (2 of 54 engines)
- Microsoft Defender: TrojanClicker:JS/Faceliker.N
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 91/100 is the fusion of 6 weighted signals:
- Microsoft Defender flagged TrojanClicker:JS/Faceliker.N (rule
TrojanClicker:JS/Faceliker.N) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://tarihinarkaodasi.blogspot.com/favicon.ico, http://tarihinarkaodasi.blogspot.com/feeds/posts/default - static signal, weight 0.35, confidence 0.60
- Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
278 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- settings-win.data.microsoft.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- licensing.mp.microsoft.com
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://tarihinarkaodasi.blogspot.com/favicon.ico
- http://tarihinarkaodasi.blogspot.com/2011/01/tarihin-arka-odas-29-ocak-2012.html
- http://tarihinarkaodasi.blogspot.com/feeds/posts/default
- http://tarihinarkaodasi.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/3261434242168376568/posts/default
- http://tarihinarkaodasi.blogspot.com/feeds/5947225094229767538/comments/default
- http://blogandweb.com/
- http://btemplates.com/
- http://www.woothemes.com/
- http://2.bp.blogspot.com/_73i0fjAB_Hw/SRs1WaCDX3I/AAAAAAAAAlk/QkZqPSVF3fQ/s1600/top.gif
- http://4.bp.blogspot.com/_73i0fjAB_Hw/SRs1ZrwA-TI/AAAAAAAAAoM/j0HTo3pIBzg/s1600/menu_bg.gif
- http://4.bp.blogspot.com/_73i0fjAB_Hw/SRs1ZNMCS7I/AAAAAAAAAnk/HRqTa7XFZk0/s1600/menu_button.gif
- http://2.bp.blogspot.com/_73i0fjAB_Hw/SRs1WCQAwnI/AAAAAAAAAlc/ptyixVX9D4g/s1600/content_bg.gif
- http://4.bp.blogspot.com/_73i0fjAB_Hw/SRs1YZkt-TI/AAAAAAAAAms/aEjKC2E3GpE/s1600/post_element.gif
- http://4.bp.blogspot.com/_73i0fjAB_Hw/SRs1XloU6LI/AAAAAAAAAmM/CwZLoazYb0o/s1600/icon_author.gif
- http://3.bp.blogspot.com/_73i0fjAB_Hw/SRs1XyKOhGI/AAAAAAAAAmU/eEMveMzzghM/s1600/icon_comment.gif
- http://4.bp.blogspot.com/_73i0fjAB_Hw/SRs1Ya9d6JI/AAAAAAAAAm0/Eg6cciY1sE4/s1600/sidebar_block_top.gif
- http://3.bp.blogspot.com/_73i0fjAB_Hw/SRs1XbdI8YI/AAAAAAAAAl8/Za1-gZw965w/s1600/circle.gif
- http://1.bp.blogspot.com/_73i0fjAB_Hw/SRs1ZXr-GBI/AAAAAAAAAns/U8x9F9CAIh8/s1600/sidebar_ul_lines.gif
- http://1.bp.blogspot.com/_73i0fjAB_Hw/SRs1XnTBGcI/AAAAAAAAAmE/WwBYmYMeLvw/s1600/icon_folder.gif
Embedded domains
- www.w3.org
- www.google.com
- www.blogger.com
- tarihinarkaodasi.blogspot.com
- blogandweb.com
- btemplates.com
- www.woothemes.com
- 2.bp.blogspot.com
- 4.bp.blogspot.com
- 3.bp.blogspot.com
- 1.bp.blogspot.com
- blogspot.com
- apis.google.com
- pagead2.googlesyndication.com
- www.facebook.com
- like.style.top
- srv.sayyac.com
- www.sayyac.com
- kadinelbisemodelleri.com
- mobilyadekorasyonnn.info
- sakizimu.blogspot.com
- kpssdestek.blogspot.com
- minimum-system-requirements.blogspot.com
- woothemes.com
- www.blogblog.com
Embedded IP addresses
- 20.89.1.9
- 52.123.252.215
- 4.230.171.124
- 4.247.188.224
- 20.247.184.142
- 135.232.92.137
- 20.165.94.54
- 20.89.1.8
- 135.233.95.144
- 51.116.253.170
- 92.223.78.30
- 135.234.160.245
- 104.18.33.89
- 125.56.205.32
- 125.56.205.24
- 72.145.35.108
- 52.148.114.188
- 52.110.12.18
- 52.110.12.52
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report