MALICIOUS — 5edb6cb0d8b9be0b2697ab7cf7b10a99fccde29d4c53ef8b92452563168e41dd

MALICIOUS — 5edb6cb0d8b9be0b2697ab7cf7b10a99fccde29d4c53ef8b92452563168e41dd is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100), attributed to the TrojanClicker family. 2 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 5edb6cb0d8b9be0b2697ab7cf7b10a99fccde29d4c53ef8b92452563168e41dd
• SHA-1: c1c4e2c03e222dfdd741bfc5fe3983562d64beb6
• MD5: 1f9d9b99dde566669f4b6762cbfab895
• ssdeep: 3072:SyOh/SSodbnckaYJNQMcZfgfdCqh43+F+3HeHdHfNT2ZDHerNDkQ39:Sh/SSokTSr
• TLSH: T11A3D1A2B6B943F8A04948573906826D860D68B67DD3342E9E192FF89CD2CC748D1CE77
• Submitted as: 5edb6cb0d8b9be0b2697ab7cf7b10a99fccde29d4c53ef8b92452563168e41dd
• File type: html · Size: 133981 bytes
• Verdict: malicious (87/100) · Family: TrojanClicker

Detections (2 of 54 engines)

• Microsoft Defender: TrojanClicker:JS/Faceliker.M
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 87/100 is the fusion of 4 weighted signals:

• Microsoft Defender flagged TrojanClicker:JS/Faceliker.M (rule TrojanClicker:JS/Faceliker.M) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• Obfuscated javascript script: dynamic-exec (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://phimhddd.blogspot.com/favicon.ico, http://phimhddd.blogspot.com/search/label/M%C3%83%C2%83%C3%82%C2%83%C3%83%C2%82%C3%82%C2%83%C3%83%C2%83%C3%82%C2%82%C3%83%C2%82%C3%82%C2%83%C3%83%C2%83%C3%82%C2%83%C3%83%C2%82%C3%82%C2%82%C3%83%C2%83%C3%82%C2%82 - static signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

16970 behavior events · 1 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• tas02.sls.update.microsoft.com
• v10.events.data.microsoft.com
• 76.0.240.10.in-addr.arpa.
• 1.0.240.10.in-addr.arpa.
• d.1.d.1.c.4.2.1.4.9.5.2.6.e.8.b.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa.
• 251.0.0.224.in-addr.arpa.
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 97.223.150.4.in-addr.arpa.
• 164.14.126.40.in-addr.arpa.

Dropped files

• 9df288d7098c73a9fa5fd19c46ca81266b7c841420ea36617cd9587196703e54 - 9df288d7098c73a9fa5fd19c46ca81266b7c841420ea36617cd9587196703e54

Embedded URLs

• http://schema.org/Blog
• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
• http://phimhddd.blogspot.com/favicon.ico
• http://phimhddd.blogspot.com/search/label/M%C3%83%C2%83%C3%82%C2%83%C3%83%C2%82%C3%82%C2%83%C3%83%C2%83%C3%82%C2%82%C3%83%C2%82%C3%82%C2%83%C3%83%C2%83%C3%82%C2%83%C3%83%C2%82%C3%82%C2%82%C3%83%C2%83%C3%82%C2%82
• http://phimhddd.blogspot.com/feeds/posts/default
• http://phimhddd.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/983411471944363842/posts/default
• https://www.blogger.com/profile/16083800064879812428
• http://cliphot.me/anhtuank3y/msexy-ung-dung-xem-video-3
• http://4.bp.blogspot.com/-15aCXWHUUoI/UWVJ-IJvvkI/AAAAAAAAAyY/7eQILI_I4VI/s1600/bg.jpg
• http://3.bp.blogspot.com/-tQxshKVrEiA/UKYWBCJuWTI/AAAAAAAAASg/KkVht2Z3sSA/s1600/sprite2.png
• http://1.bp.blogspot.com/-gA9ZfIdus80/UKYVziljQ6I/AAAAAAAAASY/7qRP4nbrMMg/s1600/sprite.png
• http://3.bp.blogspot.com/-IMVKlRJsPPU/UMsVKwO7MYI/AAAAAAAABzI/IXvG053DEko/s1600/loading1.gif
• http://3.bp.blogspot.com/--j4lVKfbFFQ/UdKoN6wcDiI/AAAAAAAAWOw/UL5xCQqSHq4/s156/repeat-x.png
• http://3.bp.blogspot.com/-jgJfIQRp-rY/UdKmiJAqYdI/AAAAAAAAWOg/DRp7Tx_ir7M/s1600/no-repeat.png
• http://phimhay4u.com/images/bgcontent.jpg
• http://phimhay4u.com/images/bglist.png
• http://2.bp.blogspot.com/-BR742T3brc4/UKxL4v9kA-I/AAAAAAAAFiA/wHRSW_I7EU4/s1600/nav.png
• http://3.bp.blogspot.com/-wbNCtroyALQ/UKxKDZGQeFI/AAAAAAAAFh4/wrl1GYrBZa4/s1600/home.png
• http://4.bp.blogspot.com/-BYrnLPzzWdQ/UKkw-epUFuI/AAAAAAAAFeo/DkQ0-EI9Spk/s1600/arrow_menu.png
• http://2.bp.blogspot.com/-v1JhImsDL7Q/UKxL5ZLycOI/AAAAAAAAFiE/2tc3Wht0T-o/s1600/nav_hover.png

Embedded domains

• schema.org
• www.w3.org
• www.google.com
• www.blogger.com
• phimhddd.blogspot.com
• up.link
• cliphot.me
• www.phimsock.com
• gmail.com
• www.luubuttuoixanh.com
• 4.bp.blogspot.com
• 3.bp.blogspot.com
• 1.bp.blogspot.com
• st.top
• phimhay4u.com
• 2.bp.blogspot.com
• apis.google.com
• keyrom.googlecode.com
• nguyenhuytap.googlecode.com
• phimshock-share123vn.blogspot.com
• a.link
• www.google-analytics.com
• blogspot.com
• connect.facebook.net
• data-vocabulary.org

Embedded IP addresses

• 57.155.104.224
• 74.179.71.159
• 48.211.4.16
• 52.123.252.232
• 4.150.223.98
• 4.247.188.233
• 4.150.223.115
• 74.178.240.61
• 4.150.223.97
• 52.123.128.14
• 40.84.97.4
• 20.184.175.15
• 4.247.188.224
• 57.154.63.210
• 172.215.188.225
• 20.42.179.192
• 20.151.32.144
• 72.145.35.97
• 57.155.101.212
• 52.148.114.188
• 172.215.188.232
• 20.184.175.12
• 4.150.223.102
• 13.89.179.15
• 72.154.7.101

More TrojanClicker samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report