SUSPICIOUS — 612cf90b240cf17b455099a35a222f3ed2fb7fe12de122f8c70b2a7193606ca1

SUSPICIOUS — 612cf90b240cf17b455099a35a222f3ed2fb7fe12de122f8c70b2a7193606ca1 is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 612cf90b240cf17b455099a35a222f3ed2fb7fe12de122f8c70b2a7193606ca1
• SHA-1: aa2f2a043f84198389489c4c46c234eaada4d0bd
• MD5: 6a5c18ed5e4d7b7bc9bf94325bed3323
• ssdeep: 96:X3/skfRwbDOrdfFjg/2cmVflyvppC2eclS+2fP68ku:X3/4sN6mbyvps2IzfPku
• TLSH: T1071D876721643EEFE0CB457A7F46281F394F6ADE1282C06052DC29936C87D835609E6F
• Submitted as: 612cf90b240cf17b455099a35a222f3ed2fb7fe12de122f8c70b2a7193606ca1
• File type: script · Size: 6007 bytes
• Verdict: suspicious (54/100)

Detections (2 of 53 engines)

• Microsoft Defender: Trojan:JS/Agent.AG!MSR
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: http://bas2k.ru/, http://www.opensource.org/licenses/mit-license.php - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://github.com/bas2k/jquery.appear/
• http://code.google.com/p/jquery-appear/
• http://bas2k.ru/
• http://www.opensource.org/licenses/mit-license.php

Embedded domains

• github.com
• code.google.com
• bas2k.ru
• www.opensource.org
• o.top
• sernexuss.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report