MALICIOUS — 80e6105d0ef3448f34308e591a4a4dfe770212c04174d90ffcfe590b03189b70
MALICIOUS — 80e6105d0ef3448f34308e591a4a4dfe770212c04174d90ffcfe590b03189b70 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
80e6105d0ef3448f34308e591a4a4dfe770212c04174d90ffcfe590b03189b70 - SHA-1:
644b4e92e01df30a836ddc424ebadda205d36c92 - MD5:
52f4a97aeb7d0412f533f95ba9a30179 - ssdeep:
1536:i7yopjF6aZh/AlEoAlWYY5JU33kmMosWJ1ptIh4F9R6N1Yuh1Zo/AzuUpO:i7yopjF60h/AlYemosuh1Zo/AzuUpO - TLSH:
T16E3EA96A2627B6CB0CC0992A625C1ED140C9C757E93246F5F297FF48D838CE1890BD5B - Submitted as: 80e6105d0ef3448f34308e591a4a4dfe770212c04174d90ffcfe590b03189b70
- File type: html · Size: 139482 bytes
- Verdict: malicious (93/100)
Detections (3 of 50 engines)
- ClamAV (daily): Html.Exploit.Agent-6598769-0
- Microsoft Defender: TrojanClicker:JS/Faceliker.A
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 93/100 is the fusion of 3 weighted signals:
- ClamAV (daily) flagged Html.Exploit.Agent-6598769-0 (rule
Html.Exploit.Agent-6598769-0) - engine signal, weight 0.90, confidence 0.95 - Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://californianlondon.blogspot.com/favicon.ico, http://californianlondon.blogspot.com/feeds/posts/default - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://californianlondon.blogspot.com/favicon.ico
- http://californianlondon.blogspot.com/2009/10/
- http://californianlondon.blogspot.com/feeds/posts/default
- http://californianlondon.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/6389212040955789233/posts/default
- http://ajax.googleapis.com/ajax/libs/jquery/1.6.2/jquery.min.js
- https://www.blogger.com/dyn-css/authorization.css?targetBlogID=6389212040955789233&
- https://apis.google.com/js/plusone.js
- http://californianlondon.blogspot.com/
- http://ads.clicksor.com/newServing/showAd.php?nid=1&
- http://www.yesadvertising.com
- http://www.househomedesign.com/image/Villa-O-Worthy-of-a-Five-Star-Rating-in-France-1.jpg
- http://t1.gstatic.com/images?q=tbn:ANd9GcTHF9ZntVtykecYhirLjrjUl1gDLu6fbVJ--n9oUzAAWFiIZFVv
- http://homedesignparadise.com/wp-content/uploads/2010/10/Spectacular-architecture-and-class-of-Villa-in-Bali_2.jpg
- http://www.designrumahku.com/wp-content/uploads/2010/03/Ross-Street-House-in-Madison-by-Richard-Wittschiebe-Hand-Architects.jpg
- http://designrumahku.com/wp-content/uploads/2009/10/villa-alumbrera-canggu-bali_big.jpg
- http://scripts.chitika.net/eminimalls/amm.js
- http://californianlondon.blogspot.com/2009/10/arsitektur-rumah-dengan-latar-belakang.html
- http://3.bp.blogspot.com/_rD3fj5P8gmE/Sukk-JNbhhI/AAAAAAAACWQ/Ww90Rb34_BQ/s1600-h/mountain+house+architecture.jpg
- http://3.bp.blogspot.com/_rD3fj5P8gmE/Sukk-JNbhhI/AAAAAAAACWQ/Ww90Rb34_BQ/s400/mountain+house+architecture.jpg
Embedded domains
- www.w3.org
- www.google.com
- www.blogger.com
- californianlondon.blogspot.com
- ajax.googleapis.com
- blogspot.com
- apis.google.com
- pagead2.googlesyndication.com
- ads.clicksor.com
- www.yesadvertising.com
- www.househomedesign.com
- t1.gstatic.com
- homedesignparadise.com
- www.designrumahku.com
- designrumahku.com
- scripts.chitika.net
- 3.bp.blogspot.com
- interiortags.blogspot.com
- architechome.com
- 1.bp.blogspot.com
- 4.bp.blogspot.com
- 2.bp.blogspot.com
- javabali.info
- t0.gstatic.com
- www.777seo.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report