SUSPICIOUS — 3432011497-widgets.js

SUSPICIOUS — 3432011497-widgets.js is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 0 of 50 detection engines flagged it.

Identification

SHA-256: 645849c850c103e72d0365d4ead1d3fbadda90c40dea8c4c40d9be2925716c5e
SHA-1: c7091962f3217b5b040c9f0f6c95db56fa1a7490
MD5: 1e5eaeee45c84258eeda70d9eb8be8a9
ssdeep: 1536:TS5N5GyrX6+on3Q8yTMrCgWNea09Ux3R9KAKmKRWV5bnglSWKJooVoEuDSryQ2ok:26+zKWNejK9KUKIzgsKY1ryQOcEtCQd
TLSH: T1173FD7BF39486EEDCC0E649A7E8C788B7B035965F2A160D4C2ACD78464E5CE43D5C428
Submitted as: 3432011497-widgets.js
File type: script · Size: 151020 bytes
Verdict: suspicious (54/100)

Detections (0 of 50 engines)

No engine flagged this sample.

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

Obfuscated javascript script: dynamic-exec, defense-evasion (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Embedded network infrastructure: https://lh3.googleusercontent.com, https://twitter.com/intent/tweet?text=, https://m.facebook.com/sharer.php?u= - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://lh3.googleusercontent.com
http://www.w3.org/XML/1998/namespace
http://www.w3.org/1999/xlink
https://twitter.com/intent/tweet?text=
https://m.facebook.com/sharer.php?u=
https://resources.blogblog.com/img/widgets/icon_contactform_cross.gif
https://csi.gstatic.com/csi
http://csi.gstatic.com/csi

Embedded domains

wikipedia.org
lh3.googleusercontent.com
window.jstiming.load.name
csi.gstatic.com
h.name
this.ca
this.ua
a.ua
c.ua
b.ca
v.za
this.ua
v.ua
e.za
a.za
c.name
window.name
a.style.top
a.ca
this.ca
www.w3.org
a.ga
this.ga
k.ga
twitter.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report