SUSPICIOUS — 816ecacb5c7fe501cf70f0a50bbafb3db59344936cafcdcce800657f893136d3
SUSPICIOUS — 816ecacb5c7fe501cf70f0a50bbafb3db59344936cafcdcce800657f893136d3 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
816ecacb5c7fe501cf70f0a50bbafb3db59344936cafcdcce800657f893136d3 - SHA-1:
ed379d0fe63785cb4ea0cd285c360c2f59283487 - MD5:
fe726756b3d24b9ae732b0132adf095a - ssdeep:
1536:PIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SX1Ow:A1O79n+ZP - TLSH:
T1D1373041A5C6CDA5E2E9121C92725B80B48D7C0718507BDF81AC9BAB7B4F76290FC48F - Submitted as: 816ecacb5c7fe501cf70f0a50bbafb3db59344936cafcdcce800657f893136d3
- File type: html · Size: 76279 bytes
- Verdict: suspicious (54/100)
Detections (1 of 50 engines)
- Microsoft Defender: Trojan:Script/Wacatac.B!ml
MITRE ATT&CK
Why this verdict
The suspicious score of 54/100 is the fusion of 5 weighted signals:
- Obfuscated javascript script: dynamic-exec (layers: char-code) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 28 external host(s) at runtime (13 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://images-na.ssl-images-amazon.com/images/I/61w92uqAAxL._SX466_.jpg, https://truekfiles378.weebly.com/ecd819-su3-windows-10-driver.html, https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js - static signal, weight 0.35, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (9 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
272 behavior events · 1 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- searchapp.bundleassets.example
- to-do.office.com
- staging.to-do.officeppe.com
- inference.location.live.net
- teams.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- desktop-hsgcbep
- ocsp.digicert.com
- config.edge.skype.com
- windows.msn.com
- officeclient.microsoft.com
- www.bing.com
- crl3.digicert.com
- tas02.sls.update.microsoft.com
- to-do.microsoft.com
- v20.events.data.microsoft.com
Embedded URLs
- https://images-na.ssl-images-amazon.com/images/I/61w92uqAAxL._SX466_.jpg
- https://truekfiles378.weebly.com/ecd819-su3-windows-10-driver.html
- https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
- https://www.google.com/recaptcha/api.js
- https://truekfiles378.weebly.com/blog/brightness-not-changing-windows-10
- https://truekfiles378.weebly.com/maschine-2-serial-keygen.html
- https://www.youtube.com/embed/VbvSwsIlvxc
- https://downjup575.weebly.com/final-fantasy-tactics-wotl-jobs.html
- https://truekfiles378.weebly.com/kovaak-aim-trainer-maps-download.html
- https://pbcfl.over-blog.com/2020/10/mosin-nagant-sniper-rifle-serial-numbers.html
- https://www.weebly.com/signup?utm_source=internal&utm_medium=footer
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- images-na.ssl-images-amazon.com
- truekfiles378.weebly.com
- cdn2.editmysite.com
- fonts.googleapis.com
- cdn1.editmysite.com
- ajax.googleapis.com
- www.weebly.com
- www.google.com
- www.youtube.com
- downjup575.weebly.com
- pbcfl.over-blog.com
- google-analytics.com
- test.name
- ec.editmysite.com
Embedded IP addresses
- 72.145.35.97
- 52.123.252.194
- 52.110.12.21
- 135.233.95.144
- 20.76.201.171
- 52.110.12.49
- 52.168.117.174
- 92.223.78.30
- 52.123.252.226
- 52.123.252.220
- 4.243.160.20
- 52.110.12.11
- 135.232.92.97
- 52.123.128.14
- 52.168.117.169
- 4.230.171.124
- 135.234.160.244
- 52.123.129.14
- 51.105.71.136
- 74.178.240.51
- 162.159.36.2
- 52.253.84.76
- 172.215.188.225
- 40.84.97.4
- 20.231.239.246
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report