MALICIOUS — 5edcd4cedaec09de313bee52609e60103d9169adc8fc0730387866e78e0bc000
MALICIOUS — 5edcd4cedaec09de313bee52609e60103d9169adc8fc0730387866e78e0bc000 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the TrojanClicker family. 2 of 54 detection engines flagged it.
Identification
- SHA-256:
5edcd4cedaec09de313bee52609e60103d9169adc8fc0730387866e78e0bc000 - SHA-1:
ee41f0ba69a49cb59f7e9ae94ff346822c138cf5 - MD5:
4ee9c4d832708a24d09c76418241483c - ssdeep:
3072:PTOh/SSodbnckaYJNQMcZf+0xCqo8h+LNVBqB/LDIk1AUbX/PSYkwR66rNDk5BS:ah/SSokA8A0HSfet - TLSH:
T1523EE62A3E657E4A00D08467E25C1AE851C2C357DC7781F9D662FED0886CC38AD1DEB6 - Submitted as: 5edcd4cedaec09de313bee52609e60103d9169adc8fc0730387866e78e0bc000
- File type: html · Size: 142703 bytes
- Verdict: malicious (92/100) · Family: TrojanClicker
Detections (2 of 54 engines)
- Microsoft Defender: TrojanClicker:JS/Faceliker!pz
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 92/100 is the fusion of 7 weighted signals:
- Microsoft Defender flagged TrojanClicker:JS/Faceliker!pz (rule
TrojanClicker:JS/Faceliker!pz) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - Obfuscated powershell script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 2 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://filmandroidizw.blogspot.com/favicon.ico, http://filmandroidizw.blogspot.com/search/label/phim%20h%C3%A0nh%20%C4%91%E1%BB%99ng%20h%C3%ACnh%20s%E1%BB%B1%20t%C3%A2m%20l%C3%BD - static signal, weight 0.35, confidence 0.60
- Extracted generic config (15 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
281 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- officeclient.microsoft.com
- www.msn.com
- odc.officeapps.live.com
- licensing.mp.microsoft.com
- settings-win.data.microsoft.com
Embedded URLs
- http://schema.org/Blog
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://filmandroidizw.blogspot.com/favicon.ico
- http://filmandroidizw.blogspot.com/search/label/phim%20h%C3%A0nh%20%C4%91%E1%BB%99ng%20h%C3%ACnh%20s%E1%BB%B1%20t%C3%A2m%20l%C3%BD
- http://cliphot.me/anhtuank3y/msexy-ung-dung-xem-video-3
- http://4.bp.blogspot.com/-15aCXWHUUoI/UWVJ-IJvvkI/AAAAAAAAAyY/7eQILI_I4VI/s1600/bg.jpg
- http://3.bp.blogspot.com/-tQxshKVrEiA/UKYWBCJuWTI/AAAAAAAAASg/KkVht2Z3sSA/s1600/sprite2.png
- http://1.bp.blogspot.com/-gA9ZfIdus80/UKYVziljQ6I/AAAAAAAAASY/7qRP4nbrMMg/s1600/sprite.png
- http://3.bp.blogspot.com/-IMVKlRJsPPU/UMsVKwO7MYI/AAAAAAAABzI/IXvG053DEko/s1600/loading1.gif
- http://3.bp.blogspot.com/--j4lVKfbFFQ/UdKoN6wcDiI/AAAAAAAAWOw/UL5xCQqSHq4/s156/repeat-x.png
- http://3.bp.blogspot.com/-jgJfIQRp-rY/UdKmiJAqYdI/AAAAAAAAWOg/DRp7Tx_ir7M/s1600/no-repeat.png
- http://phimhay4u.com/images/bgcontent.jpg
- http://phimhay4u.com/images/bglist.png
- http://2.bp.blogspot.com/-BR742T3brc4/UKxL4v9kA-I/AAAAAAAAFiA/wHRSW_I7EU4/s1600/nav.png
- http://3.bp.blogspot.com/-wbNCtroyALQ/UKxKDZGQeFI/AAAAAAAAFh4/wrl1GYrBZa4/s1600/home.png
- http://4.bp.blogspot.com/-BYrnLPzzWdQ/UKkw-epUFuI/AAAAAAAAFeo/DkQ0-EI9Spk/s1600/arrow_menu.png
- http://2.bp.blogspot.com/-v1JhImsDL7Q/UKxL5ZLycOI/AAAAAAAAFiE/2tc3Wht0T-o/s1600/nav_hover.png
- http://3.bp.blogspot.com/-GZP1O27-kCg/UKk0DRsozhI/AAAAAAAAFfI/9zy-hFXgTbk/s1600/search-icon.png
- http://3.bp.blogspot.com/-3W0OHTJwYN0/ULO9wskHnII/AAAAAAAAGGs/aJWlK5TQtwQ/s1600/bg_outer.png
- http://3.bp.blogspot.com/-_8aUmsu3yAE/ULOokuty4mI/AAAAAAAAGGA/FqHIrABQSNg/s1600/sidebar_titlebg.png
- http://2.bp.blogspot.com/-ziLQSIzhSgs/UKpbq9wd50I/AAAAAAAAFf4/og27scD9kMw/s1600/menu_play_ico.png
Embedded domains
- schema.org
- www.w3.org
- www.google.com
- www.blogger.com
- filmandroidizw.blogspot.com
- up.link
- cliphot.me
- www.phimsock.com
- gmail.com
- www.luubuttuoixanh.com
- 4.bp.blogspot.com
- 3.bp.blogspot.com
- 1.bp.blogspot.com
- st.top
- phimhay4u.com
- 2.bp.blogspot.com
- apis.google.com
- keyrom.googlecode.com
- sites.google.com
- film.androidizw.com
- a.link
- www.google-analytics.com
- blogspot.com
- connect.facebook.net
- data-vocabulary.org
Embedded IP addresses
- 20.184.175.15
- 52.123.252.222
- 4.144.132.223
- 57.155.104.224
- 4.230.171.124
- 74.179.77.204
- 4.150.223.100
- 74.178.240.51
- 172.64.154.167
- 52.110.12.4
- 52.110.12.37
- 72.154.7.106
- 52.148.114.188
- 52.110.12.50
- 52.110.12.18
More TrojanClicker samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report