MALICIOUS — 80ee3d12acdd5e45c75645dd1b01d53df0a03bc9eb748947946393c008c6d744

MALICIOUS — 80ee3d12acdd5e45c75645dd1b01d53df0a03bc9eb748947946393c008c6d744 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 3 of 50 detection engines flagged it.

Identification

• SHA-256: 80ee3d12acdd5e45c75645dd1b01d53df0a03bc9eb748947946393c008c6d744
• SHA-1: 088be98723d724831f27b6ca23616ba1abfabbd7
• MD5: 2f308a213187a034169186f1b8fbc8d1
• ssdeep: 768:oEijZeqL+REijZeqLOy7lgKluol7dhxp19RMXef7xu270p:oEijZeqLGEijZeqLjGKluolxp1B7x2p
• TLSH: T12A30869B6A90598E08E0501535AD46CA70CED217E83353EAE167FF4CD43CDB4A90ACDB
• Submitted as: 80ee3d12acdd5e45c75645dd1b01d53df0a03bc9eb748947946393c008c6d744
• File type: html · Size: 35963 bytes
• Verdict: malicious (93/100)

Detections (3 of 50 engines)

• ClamAV (daily): Html.Exploit.Agent-6598769-0
• Microsoft Defender: TrojanClicker:JS/Faceliker.A
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 93/100 is the fusion of 3 weighted signals:

• ClamAV (daily) flagged Html.Exploit.Agent-6598769-0 (rule Html.Exploit.Agent-6598769-0) - engine signal, weight 0.90, confidence 0.95
• Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css, http://entranceprepmaterials.blogspot.com/favicon.ico, http://entranceprepmaterials.blogspot.com/feeds/posts/default - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css
• http://entranceprepmaterials.blogspot.com/favicon.ico
• http://entranceprepmaterials.blogspot.com/2013/09/time-aimcats-2013.html
• http://entranceprepmaterials.blogspot.com/feeds/posts/default
• http://entranceprepmaterials.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/2613868328935888467/posts/default
• http://entranceprepmaterials.blogspot.com/feeds/1651626798214571496/comments/default
• https://www.blogger.com/static/v1/jsbin/403901366-ieretrofit.js
• http://ajax.googleapis.com/ajax/libs/jquery/1.5.2/jquery.min.js
• https://www.blogger.com/dyn-css/authorization.css?targetBlogID=2613868328935888467&amp
• https://apis.google.com/js/plusone.js
• http://entranceprepmaterials.blogspot.com/
• http://schema.org/BlogPosting
• https://www.blogger.com/post-edit.g?blogID=2613868328935888467&postID=1651626798214571496&from=pencil
• https://resources.blogblog.com/img/icon18_edit_allbkg.gif
• https://www.blogger.com/share-post.g?blogID=2613868328935888467&postID=1651626798214571496&target=email
• https://www.blogger.com/share-post.g?blogID=2613868328935888467&postID=1651626798214571496&target=blog
• https://www.blogger.com/share-post.g?blogID=2613868328935888467&postID=1651626798214571496&target=twitter
• https://www.blogger.com/share-post.g?blogID=2613868328935888467&postID=1651626798214571496&target=facebook
• https://www.blogger.com/share-post.g?blogID=2613868328935888467&postID=1651626798214571496&target=pinterest
• http://convertsocial.com/embeds/like-download/like-download.php?fburl=https://www.facebook.com/mbatestpreparation&amp

Embedded domains

• www.w3.org
• www.google.com
• www.blogger.com
• entranceprepmaterials.blogspot.com
• jasonmorrow.etsy.com
• themes.googleusercontent.com
• www.blogblog.com
• ajax.googleapis.com
• blogspot.com
• apis.google.com
• pagead2.googlesyndication.com
• schema.org
• resources.blogblog.com
• convertsocial.com
• www.facebook.com
• feedburner.google.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report