MALICIOUS — 80e56e418b757e267af35a0b02f7bb06047a8ec8a8aa8707b375622ed3b4e0ad

MALICIOUS — 80e56e418b757e267af35a0b02f7bb06047a8ec8a8aa8707b375622ed3b4e0ad is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 3 of 50 detection engines flagged it.

Identification

SHA-256: 80e56e418b757e267af35a0b02f7bb06047a8ec8a8aa8707b375622ed3b4e0ad
SHA-1: cfae3e267f86ab6c74e719299e9b64b55a2672ae
MD5: e761541701226f79f0f3ff6e39a8b261
ssdeep: 1536:PpikFfyyL5SXlvzO60ltc7e1e7keneeebeeeurwyEJPNxViTrXMZxiwro3JYD:PpikFfyPgtcgExVifXMjiwk3JYD
TLSH: T1623AB71F3B5D3A8B18B0D55136598AE8A1D3C6E78C7680F9E2626B48CD38863741EC17
Submitted as: 80e56e418b757e267af35a0b02f7bb06047a8ec8a8aa8707b375622ed3b4e0ad
File type: html · Size: 93391 bytes
Verdict: malicious (93/100)

Detections (3 of 50 engines)

ClamAV (daily): Js.Coinminer.Generic-6836639-1
Microsoft Defender: Trojan:JS/CoinHive.B
Kaspersky (KVRT): HEUR:Trojan.JS.Miner.gen

Why this verdict

The malicious score of 93/100 is the fusion of 3 weighted signals:

ClamAV (daily) flagged Js.Coinminer.Generic-6836639-1 (rule Js.Coinminer.Generic-6836639-1) - engine signal, weight 0.90, confidence 0.95
Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, https://coinhive.com/lib/coinhive.min.js, http://4fotos1palabra2013.blogspot.com/ - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

http://www.w3.org/1999/xhtml
http://www.google.com/2005/gml/b
http://www.google.com/2005/gml/data
http://www.google.com/2005/gml/expr
https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
https://coinhive.com/lib/coinhive.min.js
http://4fotos1palabra2013.blogspot.com/
http://2.bp.blogspot.com/-FVt0LQOvQ3U/UbqjlVZ6OEI/AAAAAAAACTw/yHuO7qxcHzI/s1600/pattern1.png
http://3.bp.blogspot.com/-21oON59Zccg/UbqjmG10DXI/AAAAAAAACUI/nkA7x0oJQMo/s1600/sprite1.png
http://1.bp.blogspot.com/-qMY0I7XFWqQ/Ubqjkn2jQlI/AAAAAAAACTc/dIKnI1KQRpQ/s1600/code.png
http://2.bp.blogspot.com/-H2cQGpu6B08/UbqjmbSoCzI/AAAAAAAACUQ/byyeJFP8C28/s1600/thumb.png
http://3.bp.blogspot.com/-sd2EtJIYnW4/Ubqjli0tocI/AAAAAAAACT4/jlP5mYMCvzE/s1600/speaker.png
http://1.bp.blogspot.com/-l0KfqLngx34/Ubqjm1f4WII/AAAAAAAACUc/9_TL1-p9bVg/s1600/tick.png
http://4.bp.blogspot.com/-C4uNFnXOjIQ/Ubqjk5T06QI/AAAAAAAACTg/2rEMsonXpJI/s1600/cross.png
http://3.bp.blogspot.com/-qXV1qRPIjHY/UbqjmHPAHzI/AAAAAAAACUE/7_sAZf8tHLY/s1600/sprite_32x32.png
http://3.bp.blogspot.com/-J6vkgUr1Czo/UbqjlJ0bsZI/AAAAAAAACTs/gQdYRJolyM0/s1600/divider.png
http://media02.hongkiat.com/responsive-web-nav/demo/nav-icon.png
http://fonts.googleapis.com/css?family=Open+Sans
http://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js
http://html5shiv.googlecode.com/svn/trunk/html5.js
http://blogtipsntricks.googlecode.com/files/selectivizr-min.js
http://ie7-js.googlecode.com/svn/version/2.1
https://www.blogger.com/dyn-css/authorization.css?targetBlogID=2300970438213935791&amp
http://4fotos1palabra2013.blogspot.com.es
http://4fotos1palabra2013.blogspot.com.es/search/label/PS3?max-results=5

Embedded domains

www.w3.org
www.google.com
www.blogger.com
coinhive.com
4fotos1palabra2013.blogspot.com
www.blogtipsntricks.com
2.bp.blogspot.com
3.bp.blogspot.com
1.bp.blogspot.com
4.bp.blogspot.com
media02.hongkiat.com
fonts.googleapis.com
ajax.googleapis.com
html5shiv.googlecode.com
blogtipsntricks.googlecode.com
ie7-js.googlecode.com
www.google-analytics.com
4fotos1palabra2013.blogspot.com.es
blogspot.com
ads.smowtion.com
resources.blogblog.com
translate.google.com
www.twitter.com
plus.google.com
pinterest.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report