SUSPICIOUS — 80ed8900d8ea54e0f489f5805f0fe9bc410048142b1ea855c6595812d171a695

SUSPICIOUS — 80ed8900d8ea54e0f489f5805f0fe9bc410048142b1ea855c6595812d171a695 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 50 detection engines flagged it.

Identification

• SHA-256: 80ed8900d8ea54e0f489f5805f0fe9bc410048142b1ea855c6595812d171a695
• SHA-1: 29ef54002cd897b07fac7226239c4e003db1b316
• MD5: 966b46cef7e5227a44bc6513069d2997
• ssdeep: 3072:cZY2sYJ6rHfgaToXdYKlGu+Irf6/uDT1yk6bB2k7xqxKG:cmoaTo4j/uDT1yrbBE
• TLSH: T1A83B987B3B166A8F50C0C462B5DD1DE891E386EBE922C0B8F2A2FB44D434C60D95D917
• Submitted as: 80ed8900d8ea54e0f489f5805f0fe9bc410048142b1ea855c6595812d171a695
• File type: html · Size: 104462 bytes
• Verdict: suspicious (54/100)

Detections (1 of 50 engines)

• Microsoft Defender: TrojanClicker:JS/Faceliker.C

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://fonts.googleapis.com/css?family=Oswald, http://fonts.googleapis.com/css?family=PT+Sans+Narrow - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
• http://fonts.googleapis.com/css?family=Oswald
• http://fonts.googleapis.com/css?family=PT+Sans+Narrow
• http://www.bing.com/
• http://creativecommons.org/licenses/by/3.0/
• http://4.bp.blogspot.com/-UzQSVqe350A/URJhGaHsGqI/AAAAAAAAB7s/UVJaEnVxtc8/s1600/body.gif
• http://3.bp.blogspot.com/-IeHXc7J7dZs/URLRwVeKocI/AAAAAAAACFA/OepYPORtIII/s1600/menuh.png
• http://1.bp.blogspot.com/-gZeAq088yso/URLQIekivZI/AAAAAAAACEw/ddkS4dh4ueI/s1600/arrow.png
• http://3.bp.blogspot.com/-AIW512aa4Ms/URJ2uXZh45I/AAAAAAAAB9c/QMul0JdxpNs/s1600/outerpic.png
• http://1.bp.blogspot.com/-SVWRw06Y6UE/URLY5tAnjYI/AAAAAAAACFo/5FDTDhy13CA/s1600/page_bg.jpg
• http://2.bp.blogspot.com/-dgVu9b__hgI/URLbeXpM6EI/AAAAAAAACFw/3vGr4n3yVK8/s1600/sidebar+h2.jpg
• http://4.bp.blogspot.com/-fhTZlJkFnPc/UQezZ0aM1ZI/AAAAAAAABcY/v1vUibnXaKc/s1600/arrow-down.png
• http://4.bp.blogspot.com/-WwOfybPl9ig/UQezafv_uNI/AAAAAAAABcg/uLkQHEqKKBM/s1600/arrow-right.png
• http://4.bp.blogspot.com/-MXCdgmCfwRc/UQezaV_MLdI/AAAAAAAABck/N-dsAOjgvtk/s1600/avatar.jpg
• http://2.bp.blogspot.com/-6p_AqXL70hQ/UQWPHMObw9I/AAAAAAAABZ0/f2UWIvjFkSQ/s1600/footerli.png
• http://1.bp.blogspot.com/-qJET1HGpUDc/URJ3PJ91EtI/AAAAAAAAB9k/6-zUQ4CKbmg/s1600/slider-holder.png
• http://4.bp.blogspot.com/-bp2HK6MdDXg/T5aB6vI5GPI/AAAAAAAAF98/gwCsmb8Fcks/s1600/transparant.png
• http://4.bp.blogspot.com/-b9OEmVdL6Q4/URA_BL7OXWI/AAAAAAAAB2k/c9exOQaNu2U/s1600/slider_item_active.png
• http://3.bp.blogspot.com/-eEgZtLbyI5A/URLe2rdcXjI/AAAAAAAACGA/Bzcm_LnSpk4/s1600/slider_item.png
• http://4.bp.blogspot.com/-SMVDkVsdj0I/URLTaa0lVII/AAAAAAAACFQ/STj40Z_py0Q/s1600/overlay_feature.png
• http://2.bp.blogspot.com/-EZyIk5avkHk/URJ9koETxtI/AAAAAAAAB9s/NNAmTygwDLo/s1600/slider-shadow.png
• http://3.bp.blogspot.com/-K4hNJ9YcB7I/URKRQe-RbaI/AAAAAAAAB_c/bGaB_wyqaoA/s1600/dotted.png
• http://static.graddit.com/css/graddit.css
• http://code.jquery.com/jquery-2.2.3.js
• http://yourjavascript.com/24211643151/jquery.easing.js

Embedded domains

• www.blogger.com
• fonts.googleapis.com
• www.bing.com
• creativecommons.org
• 4.bp.blogspot.com
• 3.bp.blogspot.com
• 1.bp.blogspot.com
• 2.bp.blogspot.com
• static.graddit.com
• code.jquery.com
• yourjavascript.com
• www.l0ve.info
• gmail.com
• entry.link
• blogspot.com
• stereolabel.blogspot.com
• icontainer.style.top
• ajax.googleapis.com
• www.blogblog.com
• apis.google.com
• www.9a9.red

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report