SUSPICIOUS — 6adfecbbfe26c19e68d5106b87acbb7e44db3132fed0956fe50f7520c8f97efa

SUSPICIOUS — 6adfecbbfe26c19e68d5106b87acbb7e44db3132fed0956fe50f7520c8f97efa is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 53 detection engines flagged it.

Identification

• SHA-256: 6adfecbbfe26c19e68d5106b87acbb7e44db3132fed0956fe50f7520c8f97efa
• SHA-1: 8394da7d528f2aad9d06925b080cbfc31f6459a4
• MD5: 83ded9b7431a3b09464fce87aa04ada5
• ssdeep: 768:gty811BtyrTa3hXFwp9fz9eWiKD43cVOtyKtyRtyz5outyLeF6:gtyqtyyXwp9fz9rN4cVOtyKtyRtyz5Je
• TLSH: T1E5325176ADC715C60CD0C403655E4AD892D9C1AA6D73C390E6EDEFCA9838C25CC4E6E2
• Submitted as: 6adfecbbfe26c19e68d5106b87acbb7e44db3132fed0956fe50f7520c8f97efa
• File type: html · Size: 43739 bytes
• Verdict: suspicious (54/100)

Detections (1 of 53 engines)

• Microsoft Defender: Trojan:HTML/Redirector.X

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://piramida-starting.blogspot.com/favicon.ico, http://piramida-starting.blogspot.com/search/label/%C3%83%C2%90%C3%82%C2%9D%C3%83%C2%90%C3%82%C2%B5%C3%83%C2%90%C3%82%C2%BC%C3%83%C2%90%C3%82%C2%BD%C3%83%C2%90%C3%82%C2%BE%C3%83%C2%90%C3%82%C2%B3%C3%83%C2%90%C3%82%C2%BE%2B%C3%83%C2%90%C3%82%C2%B8%C3%83%E2%80%98%C3%82%C2%81%C3%83%E2%80%98%C3%82%E2%80%9A%C3%83%C2%90%C3%82%C2%BE%C3%83%E2%80%98%C3%82%E2%82%AC%C3%83%C2%90%C3%82%C2%B8%C3%83%C2%90%C3%82%C2%B8 - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
• http://piramida-starting.blogspot.com/favicon.ico
• http://piramida-starting.blogspot.com/search/label/%C3%83%C2%90%C3%82%C2%9D%C3%83%C2%90%C3%82%C2%B5%C3%83%C2%90%C3%82%C2%BC%C3%83%C2%90%C3%82%C2%BD%C3%83%C2%90%C3%82%C2%BE%C3%83%C2%90%C3%82%C2%B3%C3%83%C2%90%C3%82%C2%BE%2B%C3%83%C2%90%C3%82%C2%B8%C3%83%E2%80%98%C3%82%C2%81%C3%83%E2%80%98%C3%82%E2%80%9A%C3%83%C2%90%C3%82%C2%BE%C3%83%E2%80%98%C3%82%E2%82%AC%C3%83%C2%90%C3%82%C2%B8%C3%83%C2%90%C3%82%C2%B8
• http://piramida-starting.blogspot.com/feeds/posts/default
• http://piramida-starting.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/165729422897550347/posts/default
• https://www.blogger.com/profile/09800236742838008652
• https://www.blogger.com/dyn-css/authorization.css?targetBlogID=165729422897550347&amp
• https://apis.google.com/js/plusone.js
• http://1.bp.blogspot.com/_tWSsXd3TY7w/Sr5RII0AB8I/AAAAAAAAAAY/lzc1p9S5GeE/S1600-R/170-990x648.jpg
• http://piramida-starting.blogspot.com/
• http://wst78963.popunder.ru/cout.php?sid=87431
• http://wst78963.popunder.ru/out.php?sid=87431
• http://smi2.ru/
• http://js.smi2.ru/data/js/4406.js
• http://piramida-starting.blogspot.com/search/label/%D0%93%D0%BB%D0%B0%D0%B2%D0%BD%D0%BE%D0%B5%20%D1%83%D1%81%D0%BB%D0%BE%D0%B2%D0%B8%D0%B5%20%D0%BF%D1%80%D0%B8%D0%B1%D1%8B%D0%BB%D1%8C%D0%BD%D0%BE%D1%81%D1%82%D0%B8
• http://piramida-starting.blogspot.com/search/label/%D0%9A%D0%B0%D0%BA%20%D0%BF%D0%BE%D1%81%D1%82%D1%80%D0%BE%D0%B8%D1%82%D1%8C%20%D0%BF%D0%B8%D1%80%D0%B0%D0%BC%D0%B8%D0%B4%D1%83%3F
• http://piramida-starting.blogspot.com/search/label/%D0%9A%D0%B0%D0%BA%D0%B8%D0%B5%20%D1%81%D1%83%D1%89%D0%B5%D1%81%D1%82%D0%B2%D1%83%D1%8E%D1%82%20%D0%B2%D0%B8%D0%B4%D1%8B%20%D0%BF%D0%B8%D1%80%D0%B0%D0%BC%D0%B8%D0%B4
• http://piramida-starting.blogspot.com/search/label/%D0%9C%D0%B0%D0%B2%D1%80%D0%BE%D0%B4%D0%B8%20%D0%BD%D0%B0%D1%88%D0%B8%D1%85%20%D0%B4%D0%BD%D0%B5%D0%B9
• http://piramida-starting.blogspot.com/search/label/%D0%9C%D0%B0%D1%80%D0%BA%D0%B5%D1%82%D0%B8%D0%BD%D0%B3-%20%D1%81%D0%B2%D1%8F%D0%B7%D1%8C%20%D1%81%20%D1%84%D0%B8%D0%BD%D0%B0%D0%BD%D1%81%D0%BE%D0%B2%D1%8B%D0%BC%D0%B8%20%D0%BF%D0%B8%D1%80%D0%B0%D0%BC%D0%B8%D0%B4%D0%B0%D0%BC%D0%B8
• http://piramida-starting.blogspot.com/search/label/%D0%9D%D0%B5%D0%BC%D0%BD%D0%BE%D0%B3%D0%BE%20%D0%B8%D1%81%D1%82%D0%BE%D1%80%D0%B8%D0%B8

Embedded domains

• www.w3.org
• www.google.com
• www.blogger.com
• piramida-starting.blogspot.com
• blogspot.com
• apis.google.com
• pagead2.googlesyndication.com
• 1.bp.blogspot.com
• wst78963.popunder.ru
• smi2.ru
• js.smi2.ru
• www.liveinternet.ru
• counter.yadro.ru
• www.blogblog.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report