MALICIOUS — 85fd3d09641a5c07f33f72f2e9e966d3e617807e39c6399a627504a4a8954e82
MALICIOUS — 85fd3d09641a5c07f33f72f2e9e966d3e617807e39c6399a627504a4a8954e82 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the FKLR family. 1 of 54 detection engines flagged it.
Identification
- SHA-256:
85fd3d09641a5c07f33f72f2e9e966d3e617807e39c6399a627504a4a8954e82 - SHA-1:
02742c50b510612bf4f2cf4e2dea124c7bea4178 - MD5:
6fe33a0b1f70254fc848589b769fd884 - ssdeep:
1536:76b9uvSoteMLmlw/6JUgVOhOINON6xNoNjNaNANeNJNbNF5FC:76puvSoOINON6xNoNjNaNANeNJNbNFi - TLSH:
T18A399216A6F07D4F864554CE6050124D8CA6ADFF7422B0E99AE88F87489DFB3F439423 - Submitted as: 85fd3d09641a5c07f33f72f2e9e966d3e617807e39c6399a627504a4a8954e82
- File type: html · Size: 85067 bytes
- Verdict: malicious (84/100) · Family: FKLR
Detections (1 of 54 engines)
- Emsisoft (Emergency Kit): Trojan.Agent.FKLR
Why this verdict
The malicious score of 84/100 is the fusion of 6 weighted signals:
- Emsisoft (Emergency Kit) flagged Trojan.Agent.FKLR (rule
Trojan.Agent.FKLR) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://1.bp.blogspot.com/-B0hwmwKdmV8/YOvWfcdBSrI/AAAAAAAACPA/5190mxxdbB0q7AYXSo8OABAnf_sgXG4wQCLcBGAsYHQ/s16000/og.jpg, https://www.elcorteingles.es//, https://cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js - static signal, weight 0.35, confidence 0.60
- Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
278 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- windows.msn.com
- www.msn.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
Embedded URLs
- https://1.bp.blogspot.com/-B0hwmwKdmV8/YOvWfcdBSrI/AAAAAAAACPA/5190mxxdbB0q7AYXSo8OABAnf_sgXG4wQCLcBGAsYHQ/s16000/og.jpg
- https://www.elcorteingles.es//
- https://cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js
- https://cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js
- https://cdn.jsdelivr.cc/npm/sweetalert2@10.16.0/dist/sweetalert2.all.min.js
- https://cdn.jsdelivr.cc/npm/lazyload@2.0.0-rc.2/lazyload.min.js
- https://cdn.jsdelivr.cc/npm/popper.js@1.16.1/dist/umd/popper.min.js
- https://cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css
- https://1.bp.blogspot.com/-nhHh-0RUOCk/YOvWeHmRs7I/AAAAAAAACOw/ovDPsKd_BKchLK0arUezkSTHLrp5FwHXACLcBGAsYHQ/s16000/favicon%2B%25281%2529.ico
- https://www.googletagmanager.com/gtag/js?id=G-5DEX0XBVZY
- https://1.bp.blogspot.com/-_epuOpFgtwo/YOvWfJb2hPI/AAAAAAAACO8/H5j3G1f213gglD5i7wIW9vwVo-Kyw0IBwCLcBGAsYHQ/s16000/left.png
- https://1.bp.blogspot.com/-zVGFyklw3Ps/YOvWeSTBUSI/AAAAAAAACO0/4wXfDrwF6ssDotPE2th_Ub6HqOSkxPrDACLcBGAsYHQ/s16000/center.png
- https://1.bp.blogspot.com/-m08_kPZCmDw/YOvWfu-Sl5I/AAAAAAAACPI/je6ziou6l0Y_eAFNh9jpbp6T0AjkoQrdACLcBGAsYHQ/s16000/right.png
- https://1.bp.blogspot.com/-LbxqopXRvoA/YOvWeW-x--I/AAAAAAAACO4/tVwPHyg9YSMFg0xXuHYu8sn2LitfC7dxQCLcBGAsYHQ/s16000/1st.jpg
- https://1.bp.blogspot.com/-Z1qlbqEb_z0/YOvaEHL2GbI/AAAAAAAACQA/Gohz1M7S62g6Ur8x-iv3xxatfTfVW7E6QCLcBGAsYHQ/s16000/fullbox.png
- https://1.bp.blogspot.com/-kdZDznoLSCg/YOvWfXwwOFI/AAAAAAAACPE/AFi8zU7tamUx7fjZ665MhuW_nqPXbgY7gCLcBGAsYHQ/s16000/outbox.png
- https://1.bp.blogspot.com/-ZzX4hWM5sZo/YOvZXYwckaI/AAAAAAAACPg/QX789eKNG6APaHiRQ7UFroXGpLAuLo-NwCLcBGAsYHQ/s16000/box1.png
- https://1.bp.blogspot.com/-ZWtNCbrMqKE/YOvZXvMGXAI/AAAAAAAACPo/FhrhUEZJw78fBxHtTGobvsZ0I2jzt2gyACLcBGAsYHQ/s16000/box2.png
- https://1.bp.blogspot.com/-x_0r01UWABs/YOvZYBNw6MI/AAAAAAAACPs/wimyyBTNlWE-ZsZchxfo4C00qqnoosJcACLcBGAsYHQ/s16000/inbox.png
- https://1.bp.blogspot.com/-rLxlOZPzTEY/YOvZXqHBzpI/AAAAAAAACPk/KhGSFndkcx4uA02905GMtoGK6L-JAq1RACLcBGAsYHQ/s16000/box3.png
- https://uprimp.com/bnr.php?section=General&pub=995577&format=300x50&ga=g
- https://1.bp.blogspot.com/-YrZ1qtO3KGE/YHgCjAGdgJI/AAAAAAAAA-8/dGN_EUs3E-kxQrFjBZtOcxMLKj-_E5f8ACLcBGAsYHQ/s16000/17.jpg
- https://1.bp.blogspot.com/-afclJF5HbbU/YHgCjqvvkhI/AAAAAAAAA_Q/TdiT3kQj_OMXVdWNq9K5sRfWdZHvj394wCLcBGAsYHQ/s16000/20.jpg
- https://1.bp.blogspot.com/-SArZhhwQ8qU/YHgCqWpdtOI/AAAAAAAABB0/u2tun92dFTc8ntZRZYhIOTSbiPPHUQgUQCLcBGAsYHQ/s16000/58.jpg
- https://1.bp.blogspot.com/-meiYp1EIVGc/YHgCjxjPKQI/AAAAAAAAA_U/PkUIj0O0FBMxTGQzyxUmjhCgMDr0MyyowCLcBGAsYHQ/s16000/22.jpg
Embedded domains
- 1.bp.blogspot.com
- www.elcorteingles.es
- cdn.jsdelivr.cc
- www.googletagmanager.com
- c.top
- benfly.net
- uprimp.com
- v.gapis.xyz
- www.w3.org
- hm.baidu.com
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 41.17.79.44
- 52.168.117.175
- 4.230.171.124
- 172.215.188.232
- 74.179.77.204
- 74.179.77.164
- 20.247.184.142
- 51.116.253.168
- 74.178.76.128
- 104.18.33.89
- 20.184.175.7
- 162.159.142.9
- 92.223.78.30
- 72.153.5.135
- 52.148.114.188
- 52.110.12.47
- 52.110.12.49
More FKLR samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report