MALICIOUS — 6373287286d936149e5ad101bc2791025a83302e029d4c0aa0a01c18855f9c65
MALICIOUS — 6373287286d936149e5ad101bc2791025a83302e029d4c0aa0a01c18855f9c65 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (83/100), attributed to the FKLR family. 1 of 53 detection engines flagged it.
Identification
- SHA-256:
6373287286d936149e5ad101bc2791025a83302e029d4c0aa0a01c18855f9c65 - SHA-1:
3d72e10040eaac28815a041787c6f7886d8cba41 - MD5:
36ff8c0ad9c0ac23dbebeff83fef95ec - ssdeep:
1536:j0Zz9jSZZXuhg7CFEvBO0QTmN6N2JxNONANVNmN7NJNbNEKSGQ:j0J9jSZamN6N2JxNONANVNmN7NJNbNEX - TLSH:
T11639B416A5F07D4F864554DE6090168D8CA6ACFE7413B0EDDAE88F87489CFA2F439423 - Submitted as: 6373287286d936149e5ad101bc2791025a83302e029d4c0aa0a01c18855f9c65
- File type: html · Size: 86443 bytes
- Verdict: malicious (83/100) · Family: FKLR
Detections (1 of 53 engines)
- Emsisoft (Emergency Kit): Trojan.Agent.FKLR
Why this verdict
The malicious score of 83/100 is the fusion of 5 weighted signals:
- Memory forensics: 2 finding(s), e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85 - Obfuscated javascript script: dynamic-exec (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 21 external host(s) at runtime (30 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://1.bp.blogspot.com/--JWtMkBvn6s/YVmmACb5L4I/AAAAAAAAHM0/F96suyubZqE4-rsae0VPbsNybozVO8V1wCLcBGAsYHQ/s16000/mess.jpg, https://www.konzum.hr/, https://cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js - static signal, weight 0.35, confidence 0.60
- Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
277 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- c.pki.goog
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
Embedded URLs
- https://1.bp.blogspot.com/--JWtMkBvn6s/YVmmACb5L4I/AAAAAAAAHM0/F96suyubZqE4-rsae0VPbsNybozVO8V1wCLcBGAsYHQ/s16000/mess.jpg
- https://www.konzum.hr/
- https://cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js
- https://cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js
- https://cdn.jsdelivr.cc/npm/sweetalert2@10.16.0/dist/sweetalert2.all.min.js
- https://cdn.jsdelivr.cc/npm/lazyload@2.0.0-rc.2/lazyload.min.js
- https://cdn.jsdelivr.cc/npm/popper.js@1.16.1/dist/umd/popper.min.js
- https://cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css
- https://1.bp.blogspot.com/-zK8ek7HXxjs/YVmmACwAlyI/AAAAAAAAHMs/MssmPuf3LrAJBy6mFPwBtPy6bMI6-MopQCLcBGAsYHQ/w16-h16/fav.png
- https://www.googletagmanager.com/gtag/js?id=G-Q8DC6X3LFK
- https://1.bp.blogspot.com/-xkfqWBL7rPo/YVmmAJXX6pI/AAAAAAAAHMw/Ii_gSusUIzoWOuIa5uIoSnoNIFpzHGSfACLcBGAsYHQ/s16000/left.jpg
- https://1.bp.blogspot.com/-Z3ttOCZEu0s/YVmmAvWDsPI/AAAAAAAAHM4/W2Id63eKStQ2hQ2A1VXt04lJfN7Mlb8fQCLcBGAsYHQ/s16000/right.jpg
- https://1.bp.blogspot.com/-o2O_iBvKjvw/YVmmA0-F_iI/AAAAAAAAHM8/JB6O0gCbqVwFq25lB3ZcR5TeqfvLYX_WwCLcBGAsYHQ/s16000/show1.jpg
- https://1.bp.blogspot.com/-cF9kqTibVE8/YVmmBGuxvFI/AAAAAAAAHNA/-SIBLyO1UzAtr_WMFxhBg6E6yq0O6jCXACLcBGAsYHQ/s16000/show2.jpg
- https://1.bp.blogspot.com/-rwnbSQc_48k/YUQPXWFBqmI/AAAAAAAAGDs/xMTiON5o2DA3aqxrgav9ArV4aJz0aXypgCLcBGAsYHQ/s16000/13outbox.png
- https://1.bp.blogspot.com/-YkICnu0MND8/YOmSgYEBdmI/AAAAAAAACNo/lX5TkKBkOXUPD4JeiQEmCiIabMSMSBK9QCLcBGAsYHQ/s16000/box1.png
- https://1.bp.blogspot.com/-dlZWmXsBRtk/YOmSgcn-MbI/AAAAAAAACNk/akitNN8HwGk_odCfiBIsjfxiSpCZa_VKwCLcBGAsYHQ/s16000/box2.png
- https://1.bp.blogspot.com/-FLBnWeuz3KE/YUQQnb2tr_I/AAAAAAAAGD4/IudFLB_v-7MNO2G-JJ2zls04MIFxRJsnwCLcBGAsYHQ/s16000/333.png
- https://1.bp.blogspot.com/-Ey83XmOz6dc/YOmShEWbJdI/AAAAAAAACNw/h_oUcvOE8b0DQgJ9XOJAa2T1PPoH0bUKwCLcBGAsYHQ/s16000/box3.png
- https://uprimp.com/bnr.php?section=General&
- https://1.bp.blogspot.com/--4xBHLsL3tA/YUXMy7E1DwI/AAAAAAAAGQE/8KCEBCxsgp86kzYqjbF4aQG09RyKfS6wQCLcBGAsYHQ/s0/126213603_730552200891932_8097881791719697756_n.jpg
- https://1.bp.blogspot.com/-CetoSX8poj4/YUXM0WHyp3I/AAAAAAAAGQQ/kogGnftLjBEN1XFomQbodpCRCszyvfg_QCLcBGAsYHQ/s320/64624200_158106888575197_5775058187782717440_n.jpg
- https://1.bp.blogspot.com/-l3sDVMxD0Ck/YUXMy30hWjI/AAAAAAAAGQA/prHIBy8bH3g3-FQQpFnyKHMO8vbJ3l_mACLcBGAsYHQ/s320/157925570_133306992030166_7501703254048777350_n.jpg
- https://1.bp.blogspot.com/-HnoOSyA0Ss4/YUXMzNHnduI/AAAAAAAAGQI/2-0ew8Nipt4KRSAIRlrKSFQ2yRutpLQmwCLcBGAsYHQ/s320/139560249_1134848683635296_1242912194971943727_n.jpg
- https://1.bp.blogspot.com/-v4PobNUDJqo/YUXMzwngEQI/AAAAAAAAGQM/Y5gAMJiDQZcaR0oxqSgbqZIwcpwT4g4GQCLcBGAsYHQ/s320/59733536_602692060206598_1708515965756506112_n.jpg
Embedded domains
- 1.bp.blogspot.com
- cdn.jsdelivr.cc
- www.googletagmanager.com
- c.top
- benfly.net
- uprimp.com
- v.gapis.xyz
- www.w3.org
- hm.baidu.com
- www.konzum.hr
Embedded IP addresses
- 41.17.79.44
- 20.184.175.19
- 4.230.171.124
- 20.42.179.204
- 4.144.132.114
- 135.233.95.144
- 135.233.95.135
- 20.184.175.21
- 203.26.79.13
- 135.232.92.34
- 20.112.250.133
- 52.123.129.14
- 52.123.128.14
- 135.233.45.223
- 40.84.97.4
- 52.148.114.188
- 72.145.35.99
- 48.200.63.27
- 20.42.65.84
- 92.223.78.30
- 52.110.12.26
- 52.110.12.5
More FKLR samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report