MALICIOUS — 6b14086f600694063708cba202b5b4894776f7c966da508800ca89674cf2df5b
MALICIOUS — 6b14086f600694063708cba202b5b4894776f7c966da508800ca89674cf2df5b is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 1 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
6b14086f600694063708cba202b5b4894776f7c966da508800ca89674cf2df5b - SHA-1:
b720cd66439aaa653edec6a0c7195b7a45e0654e - MD5:
d934fe8b8748880fe66576a1b7d5f4ba - ssdeep:
3072:FZtEPOKMbi6Wm1O5l27aJieB5cgc3TO17tcilNRsyzLL1fRhVorta2N4blWzLx:FZBbi6Wm1O5l28W0sha2N4O - TLSH:
T1034B8434FF1FADC988527A1ED9A816E82D05B3CB2BE97E5A024C958FB0D44087F87451 - Submitted as: 6b14086f600694063708cba202b5b4894776f7c966da508800ca89674cf2df5b
- File type: html · Size: 480458 bytes
- Verdict: malicious (96/100)
Detections (1 of 54 engines)
- ClamAV feed: InterServer (malware): sigs.InterServer.net.HEX.Topline.js.malware.eval.string.fromcharcode.118.868.UNOFFICIAL
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 7 weighted signals:
- ClamAV feed: InterServer (malware) flagged sigs.InterServer.net.HEX.Topline.js.malware.eval.string.fromcharcode.118.868.UNOFFICIAL (rule
sigs.InterServer.net.HEX.Topline.js.malware.eval.string.fromcharcode.118.868.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95 - Obfuscated javascript script: dynamic-exec (layers: char-code) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 9 external host(s) and 9 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://www.googletagmanager.com/gtm.js?id=, https://gmpg.org/xfn/11, https://www.fammall.com/xmlrpc.php - static signal, weight 0.35, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
4883 behavior events · 1 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- 76.0.240.10.in-addr.arpa.
- 1.0.240.10.in-addr.arpa.
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
- 251.0.0.224.in-addr.arpa.
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
- 252.0.0.224.in-addr.arpa.
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
- update.googleapis.com
- desktop-hsgcbep
- self.events.data.microsoft.com
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 1.0.240.10.in-addr.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 251.0.0.224.in-addr.arpa
Dropped files
- ab619a4fcd4b20ee15b319afdda0a8af0c30881ec2c2d996d88ade01c1e87724 -
ab619a4fcd4b20ee15b319afdda0a8af0c30881ec2c2d996d88ade01c1e87724
Embedded URLs
- https://www.googletagmanager.com/gtm.js?id=
- https://www.fammall.com/wp-content/uploads/2017/08/fammall_favicon.png
- https://gmpg.org/xfn/11
- https://www.fammall.com/xmlrpc.php
- https://www.fammall.com/
- https://schema.org
- https://www.fammall.com/#website
- https://www.fammall.com/#webpage
- https://www.fammall.com/#breadcrumb
- https://www.fammall.com/amp/
- https://www.fammall.com/wp-content/themes/kidz/js/html5.js
- https://www.fammall.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.fammall.com%2F
- https://www.fammall.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.fammall.com%2F&
- https://www.google-analytics.com/analytics.js
- https://www.fammall.com/my-account-2/
- https://www.fammall.com/%E0%B8%AA%E0%B8%B4%E0%B8%99%E0%B8%84%E0%B9%89%E0%B8%B2%E0%B9%80%E0%B8%94%E0%B9%87%E0%B8%81%E0%B8%97%E0%B8%B1%E0%B9%89%E0%B8%87%E0%B8%AB%E0%B8%A1%E0%B8%94/
- https://www.fammall.com/product-category/%E0%B9%80%E0%B8%AA%E0%B8%B7%E0%B9%89%E0%B8%AD%E0%B8%9C%E0%B9%89%E0%B8%B2%E0%B9%80%E0%B8%94%E0%B9%87%E0%B8%81-%E0%B8%8A%E0%B8%B8%E0%B8%94%E0%B9%80%E0%B8%94%E0%B9%87%E0%B8%81-%E0%B8%81%E0%B8%B2%E0%B8%87/
- https://www.fammall.com/product-category/%E0%B8%84%E0%B8%A3%E0%B8%B5%E0%B8%A1%E0%B8%97%E0%B8%B2%E0%B8%9C%E0%B8%B4%E0%B8%A7%E0%B9%80%E0%B8%94%E0%B9%87%E0%B8%81/
- https://www.fammall.com/product-category/%E0%B8%9C%E0%B9%89%E0%B8%B2%E0%B8%AD%E0%B9%89%E0%B8%AD%E0%B8%A1%E0%B9%80%E0%B8%94%E0%B9%87%E0%B8%81/
- https://www.fammall.com/product-category/%E0%B9%82%E0%B8%A5%E0%B8%8A%E0%B8%B1%E0%B9%88%E0%B8%99%E0%B8%81%E0%B8%B1%E0%B8%99%E0%B8%A2%E0%B8%B8%E0%B8%87%E0%B9%80%E0%B8%94%E0%B9%87%E0%B8%81/
- https://www.fammall.com/%E0%B8%84%E0%B8%A7%E0%B8%B2%E0%B8%A1%E0%B8%A3%E0%B8%B9%E0%B9%89%E0%B9%80%E0%B8%81%E0%B8%B5%E0%B9%88%E0%B8%A2%E0%B8%A7%E0%B9%80%E0%B8%94%E0%B9%87%E0%B8%81/
- https://www.fammall.com/category/%e0%b8%a5%e0%b8%b9%e0%b8%81%e0%b8%9b%e0%b9%88%e0%b8%a7%e0%b8%a2-%e0%b8%a5%e0%b8%b9%e0%b8%81%e0%b9%84%e0%b8%a1%e0%b9%88%e0%b8%aa%e0%b8%9a%e0%b8%b2%e0%b8%a2-%e0%b9%80%e0%b8%9b%e0%b9%87%e0%b8%99%e0%b9%84/
- https://www.fammall.com/%e0%b9%80%e0%b8%a1%e0%b8%b7%e0%b9%88%e0%b8%ad%e0%b8%97%e0%b8%b2%e0%b8%a3%e0%b8%81%e0%b8%9b%e0%b9%88%e0%b8%a7%e0%b8%a2-%e0%b9%80%e0%b8%9b%e0%b9%87%e0%b8%99%e0%b9%84%e0%b8%82%e0%b9%89/
- https://www.fammall.com/%e0%b9%80%e0%b8%a1%e0%b8%b7%e0%b9%88%e0%b8%ad%e0%b8%a5%e0%b8%b9%e0%b8%81%e0%b8%9b%e0%b9%88%e0%b8%a7%e0%b8%a2/
- https://www.fammall.com/%e0%b8%a5%e0%b8%b9%e0%b8%81%e0%b8%9b%e0%b9%88%e0%b8%a7%e0%b8%a2%e0%b8%a5%e0%b8%b9%e0%b8%81%e0%b9%80%e0%b8%9b%e0%b9%87%e0%b8%99%e0%b9%84%e0%b8%82%e0%b9%89/
Embedded domains
- www.googletagmanager.com
- www.fammall.com
- gmpg.org
- schema.org
- fonts.googleapis.com
- static.zotabox.com
- www.google-analytics.com
- www.googleadservices.com
- googleads.g.doubleclick.net
- facebook.com
- instagram.com
- twitter.com
- plus.google.com
- www.youtube.com
- fammall.com
- play.google.com
- www.brandingchamp.com
- click.accesstrade.in.th
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 1.0.77.23
- 20.42.179.192
- 52.182.141.63
- 52.123.252.215
- 135.233.95.80
- 4.150.223.113
- 203.26.79.13
- 52.148.114.188
- 104.208.16.94
- 20.50.201.205
- 72.154.7.103
- 72.145.35.97
- 85.210.193.152
- 48.211.4.16
- 20.42.73.31
- 52.253.84.76
- 52.110.12.50
- 4.230.171.124
- 72.154.7.97
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report