MALICIOUS — 855217f6c5df51a140950b996c4012480079e63f4a81b24a6854091806a0cce4
MALICIOUS — 855217f6c5df51a140950b996c4012480079e63f4a81b24a6854091806a0cce4 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100). 2 of 54 detection engines flagged it.
Identification
- SHA-256:
855217f6c5df51a140950b996c4012480079e63f4a81b24a6854091806a0cce4 - SHA-1:
f71f3170f0294a9c2b74acaa78be3c8d0c4f84fd - MD5:
4ccc02ec03a2e76bb12e215282520a68 - ssdeep:
3072:yGyFjFzYUZyF8QIlP9ggu91rGVYgcEbF591gq9ZnDSUFfRU41nwJ+WtLHomwXcoV:yGyFjFzYUZycP9VVYgcEx591gq9ZnGSV - TLSH:
T189405D2F73D1399F9498128E769D06DDE0CB96DBE43704E9A752CF48C864C301899CAE - Submitted as: 855217f6c5df51a140950b996c4012480079e63f4a81b24a6854091806a0cce4
- File type: html · Size: 164748 bytes
- Verdict: malicious (91/100)
Detections (2 of 54 engines)
- Microsoft Defender: Trojan:HTML/FaceLiker.VD!MTB
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 91/100 is the fusion of 6 weighted signals:
- Microsoft Defender flagged Trojan:HTML/FaceLiker.VD!MTB (rule
Trojan:HTML/FaceLiker.VD!MTB) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, https://4.bp.blogspot.com/-W1Om9IpJU1U/VpgvBcnSN9I/AAAAAAAAAn8/q7_ru3tUbpk/s1600/benh-dau-da-day.jpg, https://www.trieuchungdaudaday.com/favicon.ico - static signal, weight 0.35, confidence 0.60
- Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
279 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- licensing.mp.microsoft.com
- assets.msn.com
- www.bing.com
- v10.events.data.microsoft.com
- edge.microsoft.com
- watson.events.data.microsoft.com
- http://www.msftconnecttest.com/connecttest.txt
Dropped files
- c9755626dc83b13f603a7add12ae1e9e3970354b44c707f4ffab459f19ef7315 -
c9755626dc83b13f603a7add12ae1e9e3970354b44c707f4ffab459f19ef7315
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- https://www.trieuchungdaudaday.com/2014/08/dau-da-day.html
- https://4.bp.blogspot.com/-W1Om9IpJU1U/VpgvBcnSN9I/AAAAAAAAAn8/q7_ru3tUbpk/s1600/benh-dau-da-day.jpg
- https://www.trieuchungdaudaday.com/favicon.ico
- https://www.trieuchungdaudaday.com/feeds/posts/default
- https://www.trieuchungdaudaday.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/1982796205878094812/posts/default
- https://www.trieuchungdaudaday.com/feeds/1329431201768930383/comments/default
- https://4.bp.blogspot.com/-W1Om9IpJU1U/VpgvBcnSN9I/AAAAAAAAAn8/q7_ru3tUbpk/w1200-h630-p-k-no-nu/benh-dau-da-day.jpg
- https://lh5.googleusercontent.com/proxy/-ZbDC1Qz59NtRJ--b4aH775iSECILkbd7ix9QhVygyM0kYvycngT__Psgz8Hlagc-Ao=s0-d
- https://lh5.googleusercontent.com/-cz1ogKtwNBc/T-xs3x0de-I/AAAAAAAABwI/KlCgXlV7uo0/s36/author.png
- http://landofcoder.com
- http://2.bp.blogspot.com/-uitX7ROPtTU/Tyv-G4NA_uI/AAAAAAAAFBY/NcWLPVnYEnU/s1600/no+image.jpg
- http://www.trieuchungdaudaday.com
- http://www.opensource.org/licenses/mit-license.php
- http://realcombiz.com
- https://www.blogger.com/dyn-css/authorization.css?targetBlogID=1982796205878094812&
- https://www.trieuchungdaudaday.com/
- https://uphinhnhanh.com/images/2018/10/20/Untitled-18e885.png
- http://google.com/ads/remarketingsetup
- http://dalamart.net/shop/product/dang-tho-tra-day-thao-nguyen-tui-500gr-811?search=tr%C3%A0+d%C3%A2y
Embedded domains
- www.w3.org
- www.google.com
- www.blogger.com
- www.trieuchungdaudaday.com
- 4.bp.blogspot.com
- ajax.googleapis.com
- fonts.googleapis.com
- lh5.googleusercontent.com
- 3.bp.blogspot.com
- 2.bp.blogspot.com
- 1.bp.blogspot.com
- yourjavascript.com
- gmail.com
- landofcoder.com
- entry.link
- www.google-analytics.com
- www.opensource.org
- realcombiz.com
- helplogger.googlecode.com
- dalamart.net
- blogspot.com
- uphinhnhanh.com
- www.googleadservices.com
- googleads.g.doubleclick.net
- lh4.googleusercontent.com
Embedded IP addresses
- 40.79.150.121
- 4.230.171.124
- 52.230.59.222
- 4.150.223.114
- 4.150.223.115
- 135.233.45.221
- 52.110.12.21
- 52.110.12.49
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report