SUSPICIOUS — amp-auto-ads-0.1.js

SUSPICIOUS — amp-auto-ads-0.1.js is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 0 of 53 detection engines flagged it.

Identification

• SHA-256: 73fc986b5852b1bc12845e23964d8377cd7da34b57a8cda5995e4bc1a012a885
• SHA-1: 8c46fc1bc87081062a8017b5a451aa38a63aae84
• MD5: 7acacdc5f9da00435019594dcc88cda3
• ssdeep: 768:OCg0v1e5U/4WGUehYSq5dHMKNZAd/CJog7E:hjoQE
• TLSH: T12C2C869A7A8EBEFDEC1E852B3F1C64C72347DA747A9110E1D36CC21968E1CD4186181A
• Submitted as: amp-auto-ads-0.1.js
• File type: script · Size: 25100 bytes
• Verdict: suspicious (54/100)

Detections (0 of 53 engines)

No engine flagged this sample.

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec, defense-evasion (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://v3.denakop.com/ad-request, https://tags.premiumads.com.br, https://api.bounceexchange.com/bounce/amp - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://v3.denakop.com/ad-request
• https://tags.premiumads.com.br
• https://api.bounceexchange.com/bounce/amp
• https://mths.be/cssescape

Embedded domains

• t.constructor.name
• r.name
• pagead2.googlesyndication.com
• analytics.alright.network
• v3.denakop.com
• v2.denakop.com
• cdn.firstimpression.io
• tags.premiumads.com.br
• api.bounceexchange.com
• this.es
• this.us
• t.top
• this.ws
• n.top
• t-n.top
• this.es
• n.es
• firstimpression.io
• mths.be

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report