MALICIOUS — 7b9ca1220c0ce24025e8c360ffef6a0a80ffaa4a28faeafe22f0c4a1da4e7a6e
MALICIOUS — 7b9ca1220c0ce24025e8c360ffef6a0a80ffaa4a28faeafe22f0c4a1da4e7a6e is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the CobaltStrike family. 2 of 54 detection engines flagged it.
Identification
- SHA-256:
7b9ca1220c0ce24025e8c360ffef6a0a80ffaa4a28faeafe22f0c4a1da4e7a6e - SHA-1:
5ffba613b5cb5e443c46b0b121bb364678e2a8be - MD5:
fa245703fae6793760c3727c7a67a5c4 - ssdeep:
3072:Gs2yvyKYyLkJ1Zgn6lDlkl6wRtUB6iI9G0ITpmfR:GAvyKYyLOg2a - TLSH:
T1D13B093AF6492E7FF491B437259C158C60CD93CFBC6383E9E5C27945A828C6099F8426 - Submitted as: 7b9ca1220c0ce24025e8c360ffef6a0a80ffaa4a28faeafe22f0c4a1da4e7a6e
- File type: html · Size: 109522 bytes
- Verdict: malicious (96/100) · Family: CobaltStrike
Detections (2 of 54 engines)
- Microsoft Defender: TrojanClicker:JS/Faceliker.U
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 96/100 is the fusion of 7 weighted signals:
- Extracted CobaltStrike config (1 C2) - engine signal, weight 0.80, confidence 0.70
- Microsoft Defender flagged TrojanClicker:JS/Faceliker.U (rule
TrojanClicker:JS/Faceliker.U) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://vochongyeu.blogspot.com/favicon.ico, http://vochongyeu.blogspot.com/feeds/posts/default - static signal, weight 0.35, confidence 0.60
- Memory forensics: 4 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule
windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
280 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- th.bing.com
- edge.microsoft.com
- v10.events.data.microsoft.com
- time.windows.com
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.facebook.com/2008/fbml
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://vochongyeu.blogspot.com/favicon.ico
- http://vochongyeu.blogspot.com/2014/01/ao-nguc-thao-nao-tot-nhat-cho-ban.html
- http://vochongyeu.blogspot.com/feeds/posts/default
- http://vochongyeu.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/8454973600324229442/posts/default
- http://vochongyeu.blogspot.com/feeds/6626446712622123162/comments/default
- http://www.womenshealthvn.com/sites/default/files/styles/large/public/fancy/ao-nguc-the-thao.jpg
- https://lh6.googleusercontent.com/proxy/OOMXbstHSeFsceBKFM7h00Okv_YaSFYwYAXmLH-_9xbqINwoX23b73My9qgL647nnwxSalWK_5iOFy0YdmG4HMgC2oq-S81qi5p1yXFBSJQQL5I0JR12jTSod-ooyXOmfgXsc9JX9DxyjPn-mWMDbAjfY3g=w1200-h630-p-k-no-nu
- https://plus.google.com/+vnherolove/posts
- http://template-helloximo.blogspot.com/
- http://iloveyouvietnam.blogspot.com/
- http://1.bp.blogspot.com/-0DpZkbkyvso/TvByduoOgmI/AAAAAAAAAUI/XmYs71qC74E/s1600/bgbody.gif
- http://2.bp.blogspot.com/-C7WC9PAQ6sM/TvByt4Fm9kI/AAAAAAAAAUQ/0odC6Cy6774/s1600/title2.gif
- http://4.bp.blogspot.com/-EZICTeKicc0/TvBzAGL1HQI/AAAAAAAAAUY/u0uzN1BlPI8/s1600/bgright.gif
- https://lh5.googleusercontent.com/-X9ET4BGCnkU/UO7D_c7VKTI/AAAAAAAARVQ/dx2hNf8lbjQ/s300/sibar%2520post.jpg
- http://2.bp.blogspot.com/-ASs3o7Kv6ZY/TvBzVU3Q5vI/AAAAAAAAAUw/zSA_4LkWyEw/s1600/li.gif
- http://4.bp.blogspot.com/-2otoLFBCmcY/TvBzfRHSJPI/AAAAAAAAAU4/lbWVc_qOr4I/s1600/boxtitlerp.gif
- http://2.bp.blogspot.com/-N99SVZCY_SE/TvBzsMhfkdI/AAAAAAAAAVI/01sjQ5aOSzg/s1600/boxtitle2.gif
- http://lh6.ggpht.com/-GDMurKK2tec/T5JCD6hoKoI/AAAAAAAABAc/COHOItBlFWk/author.png
Embedded domains
- www.w3.org
- www.google.com
- www.facebook.com
- www.blogger.com
- vochongyeu.blogspot.com
- www.womenshealthvn.com
- lh6.googleusercontent.com
- plus.google.com
- template-helloximo.blogspot.com
- iloveyouvietnam.blogspot.com
- 1.bp.blogspot.com
- 2.bp.blogspot.com
- 4.bp.blogspot.com
- lh5.googleusercontent.com
- lh6.ggpht.com
- 3.bp.blogspot.com
- entry.link
- files.main.bloggerstop.net
- d.link
- blogspot.com
- adf.ly
- shop-ninja.com
- connect.facebook.net
- bdv.bidvertiser.com
- bloggeritems.com
Embedded IP addresses
- 4.150.223.106
- 4.144.132.114
- 52.123.252.243
- 4.230.171.124
- 172.64.154.167
- 20.184.175.9
- 52.168.117.171
- 4.247.188.224
- 72.145.35.102
- 52.148.114.188
- 52.110.12.31
- 52.110.12.3
More CobaltStrike samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report