SUSPICIOUS — 80e28ed36855fbe2d4014c04b9db6df7540f644c5dc75853818e8bab77c28eb3

SUSPICIOUS — 80e28ed36855fbe2d4014c04b9db6df7540f644c5dc75853818e8bab77c28eb3 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: 80e28ed36855fbe2d4014c04b9db6df7540f644c5dc75853818e8bab77c28eb3
• SHA-1: be1b31033aa6f8fa287fe2c088a2e445b66092b3
• MD5: c384558a837b33bdc7511e5ccf3e135d
• ssdeep: 1536:R2IcawUgbjbO6QVL80E7sTWRfa7m6gblrd3X8ihZ69bsjcXmNRS7ODovh0glqnFD:QUcjvG8rMUcXmNRS7tvh0bo8gGl6I
• TLSH: T1823D0B5B3635794E00F48113BA8D1ED961DA865BF93781E4E2B2EBC4E838C70594C89F
• Submitted as: 80e28ed36855fbe2d4014c04b9db6df7540f644c5dc75853818e8bab77c28eb3
• File type: html · Size: 130375 bytes
• Verdict: suspicious (54/100)

Detections (2 of 50 engines)

• Microsoft Defender: TrojanClicker:JS/Faceliker.M
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, https://connect.facebook.net/en_US/fbevents.js, https://www.facebook.com/tr?id=1954467987984720&ev=PageView&noscript=1 - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
• https://connect.facebook.net/en_US/fbevents.js
• https://www.facebook.com/tr?id=1954467987984720&ev=PageView&noscript=1
• http://fonts.googleapis.com/css?family=Oswald
• http://wanditata.blogspot.com/favicon.ico
• http://wanditata.blogspot.com/2013/06/
• http://wanditata.blogspot.com/feeds/posts/default
• http://wanditata.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/1355262779858753923/posts/default
• http://www.premiumbloggertemplates.com/
• http://www.bloggertipandtrick.net/
• http://creativecommons.org/licenses/by/3.0/
• http://4.bp.blogspot.com/-muPex5Kk2fo/UMKL1l-c3tI/AAAAAAAACMk/98xvtD71sZM/s1600/background.jpg
• http://2.bp.blogspot.com/-SM3qeM5D_Jg/UMKL-DWdKHI/AAAAAAAACNg/T1dEJKNwLzE/s1600/meta-separator.png
• http://2.bp.blogspot.com/-nfTdyZMJOJk/UMKMA6RRe7I/AAAAAAAACN4/7wnaUgAzOvI/s1600/widgettitle-bg.png
• http://2.bp.blogspot.com/-BtToV7d57Qw/UMKMADC7GHI/AAAAAAAACNw/51nh-ApUXbI/s1600/widget-list.png
• http://1.bp.blogspot.com/-C0gk-kK33q4/UMKL_Ik93II/AAAAAAAACNo/SslSqL5tsKg/s1600/search.png
• http://4.bp.blogspot.com/_4HKUHirY_2U/TLlJUqSaolI/AAAAAAAAEq4/qpgAHAOe9x0/s1600/comment-avatar.jpg
• https://ajax.googleapis.com/ajax/libs/jquery/1.8.0/jquery.min.js
• http://www.opensource.org/licenses/mit-license.php
• http://www.gnu.org/licenses/gpl.html

Embedded domains

• www.w3.org
• www.google.com
• www.blogger.com
• connect.facebook.net
• www.facebook.com
• fonts.googleapis.com
• wanditata.blogspot.com
• www.bloggertipandtrick.net
• www.premiumbloggertemplates.com
• creativecommons.org
• 4.bp.blogspot.com
• 2.bp.blogspot.com
• 1.bp.blogspot.com
• ajax.googleapis.com
• www.opensource.org
• www.gnu.org
• users.tpg.com.au
• jquery.malsup.com
• malsup.com
• entry.link
• posttitle.link
• readmorelink.link
• 3.bp.blogspot.com
• apis.google.com
• blogspot.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report