MALICIOUS — 76e713d254b6212123e8db469819d663c57c89938603c14b53a81cf352002eeb

MALICIOUS — 76e713d254b6212123e8db469819d663c57c89938603c14b53a81cf352002eeb is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the Wacatac family. 1 of 54 detection engines flagged it.

Identification

SHA-256: 76e713d254b6212123e8db469819d663c57c89938603c14b53a81cf352002eeb
SHA-1: 214ed70bbb32c3bbe6e23bf6775ed11c26aa296f
MD5: 52f3be55a4007442acb44b22e7a0a67f
ssdeep: 768:iIRIOITIwIgIiKZgNDfIwIGI5IVJ7S/nO2Xduvm1UhjNHyXG6hmgXzmqLB7OHw8p:iIRIOITIwIgIiKZgNDfIwIGI5IVJ7S/w
TLSH: T1F030294677A9888958CF5292C18D2C9994C6BE0F0926DCC4C8FCD6A17C5FB7124BCC9B
Submitted as: 76e713d254b6212123e8db469819d663c57c89938603c14b53a81cf352002eeb
File type: html · Size: 38892 bytes
Verdict: malicious (84/100) · Family: Wacatac

Detections (1 of 54 engines)

Microsoft Defender: Trojan:Script/Wacatac.B!ml

Why this verdict

The malicious score of 84/100 is the fusion of 6 weighted signals:

Microsoft Defender flagged Trojan:Script/Wacatac.B!ml (rule Trojan:Script/Wacatac.B!ml) - engine signal, weight 0.55, confidence 0.85
Obfuscated javascript script: dynamic-exec (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 21 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://ogp.me/ns/fb#, http://www.vokrug.tv/pic/product/e/4/b/e/medium_e4be75b345a52815af7488263c7dcbb1.jpeg, http://www.people.su/images/aboutbio/item_48743.jpg - static signal, weight 0.35, confidence 0.60
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

280 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://ogp.me/ns/fb#
http://www.vokrug.tv/pic/product/e/4/b/e/medium_e4be75b345a52815af7488263c7dcbb1.jpeg
http://www.people.su/images/aboutbio/item_48743.jpg
http://mediland.weebly.com/1/post/2016/12/biografiya-hristofora-kolumba.html
https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
https://www.google.com/recaptcha/api.js
https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js
http://twitter.com/share?url=http://mediland.weebly.com/1/post/2016/12/biografiya-hristofora-kolumba.html
http://mediland.weebly.com/blog/biografiya-hristofora-kolumba&is_mobile=&r=3&is_light=1
https://www.weebly.com/signup?utm_source=internal&utm_medium=footer
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

ogp.me
www.vokrug.tv
www.people.su
mediland.weebly.com
cdn2.editmysite.com
fonts.googleapis.com
cdn1.editmysite.com
ajax.googleapis.com
www.weebly.com
www.google.com
twitter.com
google-analytics.com
test.name
ec.editmysite.com
connect.facebook.net
tter.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.96
52.123.252.247
172.215.188.225
4.230.171.124
20.247.185.124
20.165.94.54
57.155.101.212
51.104.15.252
74.178.76.128
52.168.117.168
52.123.252.227
48.211.4.16
72.153.5.129
52.148.114.188
92.223.78.30
52.110.12.44
52.110.12.53

More Wacatac samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report