SUSPICIOUS — 6075f915f9f48a6278640e95ad7468e015ddf91262ccdafb3041d1a15db576c7

SUSPICIOUS — 6075f915f9f48a6278640e95ad7468e015ddf91262ccdafb3041d1a15db576c7 is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 53 detection engines flagged it.

Identification

• SHA-256: 6075f915f9f48a6278640e95ad7468e015ddf91262ccdafb3041d1a15db576c7
• SHA-1: c5ab8524051dba207bf81efc747aef7ffcb716e5
• MD5: 3a21da55feb99968121c4cc130df2e0f
• ssdeep: 192:lcidboqtegpgkL+0o7lDv6HRP0BMHaC14s7EBurmr4RhXptYAnL/IZiUs:lfH/8uRsMHaK7EBuyEjXpqAnMwUs
• TLSH: T1CE26B94E3FD8B559850045322E880058AEE19C0FF67224C9895CCFC89EEEB2774B8977
• Submitted as: 6075f915f9f48a6278640e95ad7468e015ddf91262ccdafb3041d1a15db576c7
• File type: script · Size: 14324 bytes
• Verdict: suspicious (54/100)

Detections (1 of 53 engines)

• Microsoft Defender: Trojan:Script/Wacatac.B!ml

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://cleverjump.org/counter.js, https://semalt.com, https://semalt.com/?s= - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cleverjump.org/counter.js
• https://semalt.com
• https://semalt.com/?s=
• https://semalt.com/popups/popup_wow.php?lang=en

Embedded domains

• kickvox.com
• semalt.com
• jarvissavings.com
• foundationaccessories.com
• rixot.com
• mailspeaker.com
• chrome.google.com
• sites.google.com
• kindhunter.com
• cleverjump.org
• www.software-plus.org
• trustpilot.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report