MALICIOUS — 773b6f77af06f9f89704763249fc0b433a19e2ad76629e30a407e538e723135e

MALICIOUS — 773b6f77af06f9f89704763249fc0b433a19e2ad76629e30a407e538e723135e is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100), attributed to the Redirector family. 1 of 54 detection engines flagged it.

Identification

• SHA-256: 773b6f77af06f9f89704763249fc0b433a19e2ad76629e30a407e538e723135e
• SHA-1: c496b740a275543c529f496847f3a8500da6697a
• MD5: 527fa3b82928c002ad5bfcba2ab4efa7
• ssdeep: 1536:5I9Ob9/mx6gfJhMUENMZq50kQz2F5gPvhe3G0rJjxzNqOljDvO:S6gfJhMjMZqzD5gPvhe3G0tj10SDW
• TLSH: T11738D773335AB99FD9DB62EA3696589C300326CB711184F0C2F4CEC6ACAFDA1541905E
• Submitted as: 773b6f77af06f9f89704763249fc0b433a19e2ad76629e30a407e538e723135e
• File type: script · Size: 83227 bytes
• Verdict: malicious (75/100) · Family: Redirector

Detections (1 of 54 engines)

• Microsoft Defender: Trojan:JS/Redirector.ARF!MTB

Why this verdict

The malicious score of 75/100 is the fusion of 3 weighted signals:

• Microsoft Defender flagged Trojan:JS/Redirector.ARF!MTB (rule Trojan:JS/Redirector.ARF!MTB) - engine signal, weight 0.55, confidence 0.85
• Obfuscated powershell script: dynamic-exec, defense-evasion (layers: char-code+concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://main.travelfornamewalking.ga/js.php?v=352 - static signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

1173 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• ntp.ubuntu.com
• desktop-hsgcbep._dosvc._tcp.local
• desktop-hsgcbep(1)._dosvc._tcp.local
• desktop-hsgcbep(2)._dosvc._tcp.local
• desktop-hsgcbep(3)._dosvc._tcp.local
• desktop-hsgcbep(4)._dosvc._tcp.local
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• 23.40.52.209
• 162.159.142.9 US · San Francisco · AS13335 Cloudflare, Inc.
• 23.11.37.157
• 40.126.14.160
• 52.230.60.54 SG · Singapore · AS8075 Microsoft Corporation
• 150.171.22.17
• 23.198.40.44

Embedded URLs

• https://github.com/FezVrasta/popper.js/issues/373
• https://main.travelfornamewalking.ga/js.php?v=352
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• rect.top
• offsets.top
• result.top
• boundaries.top
• this.popper.style.top
• modifier.name
• popper.top
• bound.top
• github.com
• options.modifiers.name
• main.travelfornamewalking.ga

Embedded IP addresses

• 4.150.223.110
• 172.172.255.216
• 20.42.65.93
• 162.159.142.9
• 52.230.60.54
• 52.110.12.22
• 4.230.171.124
• 72.154.7.102
• 52.148.114.188

More Redirector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report