MALICIOUS — 885867d4db307ead4c418f8210fb20d22bb1903f0888139460b52f0bead51e91

MALICIOUS — 885867d4db307ead4c418f8210fb20d22bb1903f0888139460b52f0bead51e91 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100), attributed to the TrojanClicker family. 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 885867d4db307ead4c418f8210fb20d22bb1903f0888139460b52f0bead51e91
• SHA-1: 3cbbdab9ee52de52e94e59760fe5367d73625cf1
• MD5: 5b65eb90d3cda36e1a75ce647f2b9f55
• ssdeep: 1536:LCNk26KBIm3wRKUjsfXIBjsS/M1hiOquYw5hY6xJNGjKFtcsvlRnVbW6lm9qMDvF:I66Im3wRK+sfzS/c4Oww5hYuJNGOFtcV
• TLSH: T1E93A493B33963ECF4CE04451B9DC199C90CB96E7D83344E4E8A6DF486CBDD60646886A
• Submitted as: 885867d4db307ead4c418f8210fb20d22bb1903f0888139460b52f0bead51e91
• File type: html · Size: 97685 bytes
• Verdict: malicious (95/100) · Family: TrojanClicker

Detections (4 of 50 engines)

• Microsoft Defender: TrojanClicker:JS/Faceliker.N
• Emsisoft (Emergency Kit): JS:Trojan.Clicker.NBP
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic
• Trellix Stinger (McAfee): JS/Faceliker.t

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 95/100 is the fusion of 7 weighted signals:

• Memory forensics: 4 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7236) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Microsoft Defender flagged TrojanClicker:JS/Faceliker.N (rule TrojanClicker:JS/Faceliker.N) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged JS:Trojan.Clicker.NBP (rule JS:Trojan.Clicker.NBP) - engine signal, weight 0.55, confidence 0.85
• Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: http://www.facebook.com/2008/fbml, https://www.blogger.com/static/v1/widgets/204402360-widget_css_bundle.css, https://dengges.blogspot.com/favicon.ico - static signal, weight 0.35, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Extracted generic config (12 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

274 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• searchapp.bundleassets.example
• www.msftconnecttest.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• desktop-hsgcbep
• aps.prod.windows.com
• dns.msftncsi.com
• config.edge.skype.com
• tas02.sls.update.microsoft.com
• to-do.microsoft.com
• settings-win.data.microsoft.com
• www.bing.com
• ctldl.windowsupdate.com
• staging.to-do.microsoft.com
• edge.microsoft.com
• teams.microsoft.com
• watson.events.data.microsoft.com

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• http://www.facebook.com/2008/fbml
• https://www.blogger.com/static/v1/widgets/204402360-widget_css_bundle.css
• https://plus.google.com/108450765982827338272
• https://dengges.blogspot.com/favicon.ico
• http://dengges.blogspot.com/2013/02/game-pc-fifa-13-update-v17-reloaded.html
• https://dengges.blogspot.com/feeds/posts/default
• https://dengges.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/4739796971899974175/posts/default
• https://dengges.blogspot.com/feeds/8440107389359364030/comments/default
• http://4.bp.blogspot.com/-fdIBqeM_iyA/URwYgBSASrI/AAAAAAAAAeo/PPVFh8HCxpQ/s320/2013-02-14_054546.png
• https://dengges.blogspot.com/2013/02/game-pc-fifa-13-update-v17-reloaded.html
• http://www.forblogger.net
• https://lh4.googleusercontent.com/proxy/TVDfcze7Ft3R9fsY-gk1xFzMktRGXfwThrLZtegb7u6KvG9LZ60W3ORArW5KuyuOE6XvFzhdaLPzhpzHHbuECpW1Bi39EHMj70pmkrXgyO_MxD0Vf5Y8cg=s0-d
• http://tcr.tynt.com/ti.js
• https://www.blogger.com/dyn-css/authorization.css?targetBlogID=4739796971899974175&amp
• http://data-vocabulary.org/Review
• https://dengges.blogspot.com/
• http://dengges.blogspot.com/search/label/Xfactor
• http://dengges.blogspot.com/search/label/Film
• http://dengges.blogspot.com/search/label/Games
• http://dengges.blogspot.com/search/label/Software

Embedded domains

• www.w3.org
• www.google.com
• www.facebook.com
• www.blogger.com
• plus.google.com
• dengges.blogspot.com
• 4.bp.blogspot.com
• fonts.googleapis.com
• fonts.gstatic.com
• www.forblogger.net
• lh4.googleusercontent.com
• 1.bp.blogspot.com
• infonetmu.blogspot.com
• apis.google.com
• w.sharethis.com
• tcr.tynt.com
• blogspot.com
• connect.facebook.net
• data-vocabulary.org
• rdf.data-vocabulary.org
• www.lintas.me
• bdv.bidvertiser.com
• www.bidvertiser.com
• adf.ly
• auth.name

More TrojanClicker samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report