MALICIOUS — 80eeba0bbb39ea1bcbd4ed5d4271ea70ba76f1ba2636399d5c9274ece39e72a6
MALICIOUS — 80eeba0bbb39ea1bcbd4ed5d4271ea70ba76f1ba2636399d5c9274ece39e72a6 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 4 of 50 detection engines flagged it.
Identification
- SHA-256:
80eeba0bbb39ea1bcbd4ed5d4271ea70ba76f1ba2636399d5c9274ece39e72a6 - SHA-1:
d34e2ea273e8b2cf6f76880b6e1c8c7c45102b85 - MD5:
5f1455adbe773206da32d6bcfca8da02 - ssdeep:
1536:gupYpopxpjp/pI1p5pjpYpopxpjp/pI1p5pxMMMMJ8wIaxJWi03VQ0jYZCzE/9Kl:RpYpopxpjp/pI1p5pjpYpopxpjp/pI1e - TLSH:
T14C36092FB3452D0BC6A17150AEFC11B461DED27FA02104ADA476E68DDCACC693DC9839 - Submitted as: 80eeba0bbb39ea1bcbd4ed5d4271ea70ba76f1ba2636399d5c9274ece39e72a6
- File type: html · Size: 66817 bytes
- Verdict: malicious (93/100)
Detections (4 of 50 engines)
- ClamAV (daily): Html.Exploit.Agent-6598769-0
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
- Microsoft Defender: TrojanClicker:JS/Faceliker.A
- Emsisoft (Emergency Kit): Trojan.Script.613694
Why this verdict
The malicious score of 93/100 is the fusion of 3 weighted signals:
- ClamAV (daily) flagged Html.Exploit.Agent-6598769-0 (rule
Html.Exploit.Agent-6598769-0) - engine signal, weight 0.90, confidence 0.95 - Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://thehackeruniversity.blogspot.com/favicon.ico, http://thehackeruniversity.blogspot.com/search/label/facebook - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://thehackeruniversity.blogspot.com/favicon.ico
- http://thehackeruniversity.blogspot.com/search/label/facebook
- http://thehackeruniversity.blogspot.com/feeds/posts/default
- http://thehackeruniversity.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/7691429179264744537/posts/default
- https://www.blogger.com/profile/09808395074608152964
- http://www.hackeruniversity.in
- http://creativecommons.org/licenses/by-nc/3.0/
- https://lh4.googleusercontent.com/-y-5hmzZzVKY/UPEKSh0MSfI/AAAAAAAAAUk/-gjR4inUDmE/s8/bg.png
- https://lh3.googleusercontent.com/--EwqE5-RRtk/UPEKSvKPlvI/AAAAAAAAAUo/W4GdLP6M2HE/s9/bg-pattern.png
- https://lh5.googleusercontent.com/-V6xvhwsqsG4/T7cHn8ByR5I/AAAAAAAAJg4/imuiQq8PMbA/s40/Icon_Quote.png
- http://1.bp.blogspot.com/-6fbyrPZ5VKk/Tzt2z3T7TKI/AAAAAAAAE-I/JkuKFFRLJ9Q/s000/rss_alt_16x16.png
- http://1.bp.blogspot.com/-rzO0A3zmVa4/Tzt2yzVrMyI/AAAAAAAAE9Q/gxaojbgNUy4/s000/user_12x16.png
- http://1.bp.blogspot.com/-uWNFEBa6MuM/Tzt2zFM2EWI/AAAAAAAAE9g/zxQrcRVy_ek/s000/clock_16x16.png
- http://1.bp.blogspot.com/-FYHw3iXdHcM/Tzt2zeQY4WI/AAAAAAAAE9o/4PXpabAv8dI/s000/comment_alt2_stroke_16x12.png
- http://4.bp.blogspot.com/-1kdtzaC3kbQ/Tzt2y6mSdrI/AAAAAAAAE9U/EMPvAaWfl5w/s000/tag_fill_16x16.png
- http://lh6.ggpht.com/-GDMurKK2tec/T5JCD6hoKoI/AAAAAAAABAc/COHOItBlFWk/author.png
- http://apis.google.com/js/plusone.js
- https://lh6.googleusercontent.com/-4cWMlF-uqh4/TltCfL8C4DI/AAAAAAAABhE/qNaNueMVpCU/s144/button_bg.png
- https://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js
Embedded domains
- www.w3.org
- www.google.com
- www.blogger.com
- thehackeruniversity.blogspot.com
- www.hackeruniversity.in
- creativecommons.org
- lh4.googleusercontent.com
- lh3.googleusercontent.com
- lh5.googleusercontent.com
- 1.bp.blogspot.com
- 4.bp.blogspot.com
- lh6.ggpht.com
- apis.google.com
- kbk.space
- lh6.googleusercontent.com
- ajax.googleapis.com
- nguoiaolam.googlecode.com
- w.sharethis.com
- blogspot.com
- 2.bp.blogspot.com
- facebook.com
- feeds.feedburner.com
- www.facebook.com
- connect.facebook.net
- pagead2.googlesyndication.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report