SUSPICIOUS — 80eadc0d3dee21b6ff61cda67170c540cae13a886b439a8786b2975214b8557a

SUSPICIOUS — 80eadc0d3dee21b6ff61cda67170c540cae13a886b439a8786b2975214b8557a is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 50 detection engines flagged it.

Identification

SHA-256: 80eadc0d3dee21b6ff61cda67170c540cae13a886b439a8786b2975214b8557a
SHA-1: d4c43a173e0164afbf1eed28b5bf3ee4bd081c32
MD5: 51f11f0bc6a13e5f6ad6051276b0cfa0
ssdeep: 3072:ET3KqkyI8QAE8TEKlqTmLea72k7dctA88I33qJtKOF2hWsr5rI0NLjbkySdje:wKqkyXTE8degkLz
TLSH: T1B43E2A19F9943B6FF054FA3399D806E461CDC7DEB92383E9D2D2BA449C18C6058F8816
Submitted as: 80eadc0d3dee21b6ff61cda67170c540cae13a886b439a8786b2975214b8557a
File type: html · Size: 138285 bytes
Verdict: suspicious (54/100)

Detections (2 of 50 engines)

Microsoft Defender: TrojanClicker:JS/Faceliker.AJ
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://fonts.googleapis.com/css?family=Oswald, http://fonts.googleapis.com/css?family=PT+Sans+Narrow - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

http://www.w3.org/1999/xhtml
http://www.google.com/2005/gml/b
http://www.google.com/2005/gml/data
http://www.google.com/2005/gml/expr
http://www.facebook.com/2008/fbml
https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
https://plus.google.com/u/2/115406569289032556228?rel=author
http://fonts.googleapis.com/css?family=Oswald
http://fonts.googleapis.com/css?family=PT+Sans+Narrow
http://1.bp.blogspot.com/-3NtBlxdoh68/UAgse2GIduI/AAAAAAAAHxM/hThRotkqvd8/s1600/topmenu.png
http://3.bp.blogspot.com/-LzmPTNyR6po/TwETZufjSTI/AAAAAAAAATo/oisHmXUjmSY/s1600/arrow_white.gif
http://4.bp.blogspot.com/-OJVzg33wOVw/UAgpbr2g9II/AAAAAAAAHw8/maqEyMYy6NM/s1600/nav-bg.png
http://1.bp.blogspot.com/-sv3VBy8Tch0/T6UzB3zDYMI/AAAAAAAAA-Y/dVtCsOgvB_o/s1600/search_button.png
http://3.bp.blogspot.com/-h2VKwi0QJ8o/UABDnt7g2NI/AAAAAAAAHlE/ZONRawNK674/s1600/mas+goreng.png
http://2.bp.blogspot.com/-mS_e1X2n4C0/UAVsoWRIPCI/AAAAAAAAHqo/sWfeUOIyX6k/s1600/batas.png
http://4.bp.blogspot.com/-POy-pvgzudE/Tz0SPxJXQnI/AAAAAAAAFUI/SlCAfDMFIhg/s1600/anonymous.jpg
http://3.bp.blogspot.com/-NONrBLhghFk/To0nNB1LmkI/AAAAAAAAAI4/CAuzDfYiCiU/s1600/comment-arrow.gif
http://2.bp.blogspot.com/--9HK_Z5z-6M/UAWV_CVq_aI/AAAAAAAAHs4/RRIuTf61B88/s1600/sidebar-bg.png
http://4.bp.blogspot.com/-WkNxaiXvG88/UAg7RhESeNI/AAAAAAAAHxg/9XKoHfLS43I/s1600/sidebarember.png
http://2.bp.blogspot.com/-7BeF7FZiHo0/T6vZzVSzTzI/AAAAAAAABJs/FlrWN7ZRxmk/s1600/drid.gif
http://1.bp.blogspot.com/-43EW3Gjakwc/T6vZz6K4N_I/AAAAAAAABJ0/hi2LK0zc4JQ/s1600/listed.gif
http://2.bp.blogspot.com/-3m9ZaGhFRqM/T-OcKK0I31I/AAAAAAAAG-U/0U2O4f5HYIw/s1600/video.png
http://4.bp.blogspot.com/-Bt0JYGRHfpk/T7ZpN5RNSQI/AAAAAAAAGJQ/zQtrWVZwgHA/s1600/bullet.png
http://2.bp.blogspot.com/-FZeymYQZe1s/UAhMxkfmnTI/AAAAAAAAHxs/4JCAf-AfNZM/s1600/footer.png
http://4.bp.blogspot.com/-CUCJ1nBg0IA/UAhO0xBIQUI/AAAAAAAAHx0/CEZQmR3B23g/s1600/credit.png

Embedded domains

www.w3.org
www.google.com
www.facebook.com
www.blogger.com
plus.google.com
fonts.googleapis.com
1.bp.blogspot.com
3.bp.blogspot.com
4.bp.blogspot.com
2.bp.blogspot.com
ajax.googleapis.com
entry.link
www.google-analytics.com
webphimhd.com
code.jquery.com
apis.google.com
sinhvienit.net
googledrive.com
blogspot.com
iphimhd.blogspot.com
ketqua.xoso.in
ngonvail.blogspot.com
truyentranhtuan.net
www.webphimhd.com
connect.facebook.net

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report