SUSPICIOUS — 792298193dc56ae8e618331608fa8baf3c7e9a60abacd3b3f11bc8a64e7be0a3
SUSPICIOUS — 792298193dc56ae8e618331608fa8baf3c7e9a60abacd3b3f11bc8a64e7be0a3 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 0 of 54 detection engines flagged it.
Identification
- SHA-256:
792298193dc56ae8e618331608fa8baf3c7e9a60abacd3b3f11bc8a64e7be0a3 - SHA-1:
344014bb7c1a8617d6c2b7e1ba1c1e0d16e3098d - MD5:
0fb9bc32fc52c450f0d4b7051596a896 - ssdeep:
384:rDL2uKua8/5eGQ4bcB1FKnz9POSMwrTaGgpXrplazzOqkBz/ECoo9ZG1zirUaJ7D:rDL2uKB4bcB1xpXrpBy232vuXNf - TLSH:
T1652CB91223D6690F4C95160AE3668C5C8888BDDA917379EFD62E8B47181DF7358FA00F - Submitted as: 792298193dc56ae8e618331608fa8baf3c7e9a60abacd3b3f11bc8a64e7be0a3
- File type: html · Size: 26500 bytes
- Verdict: suspicious (54/100)
Detections (0 of 54 engines)
No engine flagged this sample.
Why this verdict
The suspicious score of 54/100 is the fusion of 4 weighted signals:
- Obfuscated javascript script: dynamic-exec (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: http://dtinsani.com/template/dtinsani/plugin/flexslider/flexslider.css, http://dtinsani.com/template/dtinsani/css/style.css, http://dtinsani.com/template/dtinsani/plugin/smoothscroller/jquery.mCustomScrollbar.css - static signal, weight 0.35, confidence 0.60
- Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
280 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- v10.events.data.microsoft.com
- edge.microsoft.com
- watson.events.data.microsoft.com
- http://www.msftconnecttest.com/connecttest.txt
Embedded URLs
- http://dtinsani.com/template/dtinsani/plugin/flexslider/flexslider.css
- http://dtinsani.com/template/dtinsani/css/style.css
- http://dtinsani.com/template/dtinsani/plugin/smoothscroller/jquery.mCustomScrollbar.css
- http://dtinsani.com/template/dtinsani/plugin/fancybox/source/jquery.fancybox.css?v=2.1.5
- http://dtinsani.com/template/dtinsani/plugin/fancybox/source/helpers/jquery.fancybox-buttons.css?v=1.0.5
- http://dtinsani.com/template/dtinsani/plugin/fancybox/source/helpers/jquery.fancybox-thumbs.css?v=1.0.7
- http://dtinsani.com
- http://dtinsani.com/about/profil
- http://dtinsani.com/about/visi-misi
- http://dtinsani.com/about/struktur-organisasi
- http://dtinsani.com/about/kebijakan-mutu
- http://dtinsani.com/about/manajemen
- http://dtinsani.com/program
- http://dtinsani.com/program/list/kat/1
- http://dtinsani.com/program/list/kat/2
- http://dtinsani.com/program/list/kat/3
- http://dtinsani.com/program/list/kat/4
- http://dtinsani.com/program/list/kat/5
- http://dtinsani.com/program/list/kat/6
- http://dtinsani.com/diskusi
- http://dtinsani.com/pelatihan
- http://dtinsani.com/alumni
- http://dtinsani.com/galeri
- http://dtinsani.com/video
- http://dtinsani.com/kontak
Embedded domains
- dtinsani.com
- google-analytics.com
- schema.org
- www.facebook.com
- twitter.com
- plus.google.com
- opi.yahoo.com
- mail.dtinsani.com
Embedded IP addresses
- 65.154.226.165
- 40.79.163.155
- 4.144.132.114
- 4.230.171.124
- 20.184.175.12
- 52.178.17.233
- 135.233.45.221
- 52.110.12.19
- 52.110.12.14
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report