MALICIOUS — 6ad87c8b9d3a75a65292a0c23e628dfdb0b25bd8c22905de37bee5055cd8770d

MALICIOUS — 6ad87c8b9d3a75a65292a0c23e628dfdb0b25bd8c22905de37bee5055cd8770d is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (83/100). 0 of 53 detection engines flagged it.

Identification

• SHA-256: 6ad87c8b9d3a75a65292a0c23e628dfdb0b25bd8c22905de37bee5055cd8770d
• SHA-1: ae8b246ec017d1e573600a15094dcd75354233dc
• MD5: 2c5a413f20cde5951ef2a9f36559c501
• ssdeep: 3072:/aIIUcOuUOuDItWMfkuUC85lPVn12h6YaFfCTX/iF7:yDUcOuyPCWaU
• TLSH: T11C3EE83AF24C257F84446072669F11943CCB738FB8D383E9A6D5FA48B869D20D67C426
• Submitted as: 6ad87c8b9d3a75a65292a0c23e628dfdb0b25bd8c22905de37bee5055cd8770d
• File type: html · Size: 139790 bytes
• Verdict: malicious (83/100)

Detections (0 of 53 engines)

No engine flagged this sample.

Why this verdict

The malicious score of 83/100 is the fusion of 5 weighted signals:

• Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
• Obfuscated powershell script: dynamic-exec, defense-evasion (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Contacted 28 external host(s) at runtime (26 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css, https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js, http://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js - static signal, weight 0.35, confidence 0.60
• Extracted generic config (12 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

279 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• ctldl.windowsupdate.com
• login.live.com
• ocsp.digicert.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• oneocsp.microsoft.com
• settings-win.data.microsoft.com
• www.msn.com

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css
• https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
• http://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js
• https://lh6.googleusercontent.com/-6UyQr7E0nTU/UVRWwhvPScI/AAAAAAAAFUU/15cIvW74xwg/s50/quote.png
• http://1.bp.blogspot.com/-VaJX0ShxH6c/TeUGQ0IGOWI/AAAAAAAAJGo/Qw7sIjc5MrQ/s200/bc_separator.png
• http://3.bp.blogspot.com/-moj4-jk-UB0/U1qCkCPaGQI/AAAAAAAADTY/tixmak8NHV8/s1600/share.png
• http://4.bp.blogspot.com/-M_utSb-nN04/U6V8Gut9dJI/AAAAAAAAAjE/6g1X58pjjcg/s1600/single-share.png
• http://4.bp.blogspot.com/-R8OKVUsis3s/UgZEksy0V1I/AAAAAAAAAT4/QtN9sBHMZis/s1600/icon-search.png
• http://68.media.tumblr.com/22a2173e99a4048371e7884d224de883/tumblr_n96x9g8SEM1tdbmuio1_1280.gif
• http://4.bp.blogspot.com/-QexjpeToxgY/U7aSj4K6aLI/AAAAAAAACAQ/TYouY5vo_dI/s1600/search.png
• https://www.blogger.com/dyn-css/authorization.css?targetBlogID=7946553596177797166&amp
• http://schema.org/WebPage
• http://sihuong.blogspot.com
• http://sihuong.blogspot.com/p/serie.html
• https://www.youtube.com/channel/UCws8njKpWNfqlaH_dk7KFOA
• https://www.facebook.com/thuthuatvameovat
• https://plus.google.com/+H%E1%BB%93S%C4%A9H%C6%B0%C6%A1ng_cdm
• https://twitter.com/HoSiHuong
• https://www.facebook.com/sihuong
• http://schema.org/WPHeader
• http://sihuong.blogspot.com/

Embedded domains

• www.w3.org
• www.google.com
• www.blogger.com
• pagead2.googlesyndication.com
• ajax.googleapis.com
• www.noaesthetic.com
• www.khamphablog.com
• a.ai
• lh6.googleusercontent.com
• 1.bp.blogspot.com
• lh5.googleusercontent.com
• 3.bp.blogspot.com
• 4.bp.blogspot.com
• 68.media.tumblr.com
• entry.link
• maxcdn.bootstrapcdn.com
• connect.facebook.net
• blogspot.com
• schema.org
• sihuong.blogspot.com
• www.youtube.com
• www.facebook.com
• plus.google.com
• twitter.com
• bachhoasg.blogspot.com

Embedded IP addresses

• 20.42.73.24
• 52.123.252.232
• 20.247.184.142
• 172.215.188.225
• 4.230.171.124
• 74.178.240.61
• 4.207.44.66
• 74.178.76.54
• 20.231.239.246
• 52.123.128.14
• 52.123.129.14
• 4.207.44.77
• 172.178.240.162
• 135.233.95.80
• 203.26.79.13
• 85.210.196.11
• 52.148.114.188
• 20.184.175.12
• 20.42.65.85
• 172.175.111.170
• 4.150.223.110
• 4.150.223.114
• 52.110.12.16
• 52.110.12.47
• 20.89.1.10

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report