SUSPICIOUS — 80e0acd51c4750b4d3338c71d96154fc40ecf2d382b4656a30180be48e37409f

SUSPICIOUS — 80e0acd51c4750b4d3338c71d96154fc40ecf2d382b4656a30180be48e37409f is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: 80e0acd51c4750b4d3338c71d96154fc40ecf2d382b4656a30180be48e37409f
• SHA-1: cc5fb014704c64bf9ce19a86af8d5ca53ca08293
• MD5: ad425aef704501abf649182f974159ca
• ssdeep: 6144:FD/G8e31BkmPpv6HyUtCu8TXg/sGxfL/2:FD+vxSqX0sGxfL/2
• TLSH: T145454C6B79987DCFC84854677D8C14E97287CFDBF4A280C9D2A9DEC488A8C70785C429
• Submitted as: 80e0acd51c4750b4d3338c71d96154fc40ecf2d382b4656a30180be48e37409f
• File type: html · Size: 269226 bytes
• Verdict: suspicious (54/100)

Detections (2 of 50 engines)

• Microsoft Defender: TrojanClicker:JS/Faceliker.M
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://phimhcm.blogspot.com/favicon.ico, http://phimhcm.blogspot.com/feeds/posts/default - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://schema.org/Blog
• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
• http://phimhcm.blogspot.com/favicon.ico
• http://phimhcm.blogspot.com/2013/02/video-can-canh-chiec-xe-tai-quan-dung.html
• http://phimhcm.blogspot.com/feeds/posts/default
• http://phimhcm.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/4659368028944909101/posts/default
• http://phimhcm.blogspot.com/feeds/4426560496695191941/comments/default
• http://2.bp.blogspot.com/-jCfcFK1iUIw/UR3iaP99e0I/AAAAAAABDcA/d23pGrJJRmg/s200/sax.JPG
• http://2.bp.blogspot.com/-jCfcFK1iUIw/UR3iaP99e0I/AAAAAAABDcA/d23pGrJJRmg/w1200-h630-p-k-no-nu/sax.JPG
• http://cliphot.me/anhtuank3y/msexy-ung-dung-xem-video-3
• http://phimhcm.com/
• http://phimhcm.com/feeds/posts/default
• http://phimhcm.com/feeds/posts/default?alt=rss
• http://phimhcm.com/feeds/2971518923963711778/posts/default
• http://phimhcm.com/rsd.g?blogID=2971518923963711778
• http://phimhcm.com/openid-server.g
• https://www.facebook.com/share123.vn
• http://Share123.vn
• http://2.bp.blogspot.com/-UeaDMd-1wmI/UdF00SlLs9I/AAAAAAAAC2M/m1xp96k6uhs/s1600/wrapper.jpg
• http://3.bp.blogspot.com/-tQxshKVrEiA/UKYWBCJuWTI/AAAAAAAAASg/KkVht2Z3sSA/s1600/sprite2.png

Embedded domains

• schema.org
• www.w3.org
• www.google.com
• www.blogger.com
• phimhcm.blogspot.com
• 2.bp.blogspot.com
• up.link
• cliphot.me
• phimhcm.com
• www.phimhcm.com
• www.facebook.com
• 3.bp.blogspot.com
• 1.bp.blogspot.com
• st.top
• 4.bp.blogspot.com
• phimhay4u.com
• widget-content.cloud
• lh5.googleusercontent.com
• lh6.googleusercontent.com
• lh4.googleusercontent.com
• lh3.googleusercontent.com
• entry.link
• apis.google.com
• jquery.com
• jquery.org

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report