MALICIOUS — 8f13716b4837aa49c88e08cacec55a992a69853d5ab7189a865a1b9f06e6bc7c
MALICIOUS — 8f13716b4837aa49c88e08cacec55a992a69853d5ab7189a865a1b9f06e6bc7c is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Faceliker family. 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
8f13716b4837aa49c88e08cacec55a992a69853d5ab7189a865a1b9f06e6bc7c - SHA-1:
a0922e68922d52a23c77af207114488c160b0d30 - MD5:
be6a8d9abb9954c202871a0a34593705 - ssdeep:
1536:oUgbdcXmNRSOD7OtVX6VActJ9AOWc+7Fstxj5q9rCX7CesErs+M:oUcdcXmNRSFrX6VA+7AC+7mtxjw9rCXi - TLSH:
T1AA381A9E7545BA4F54408121BA9C06E890EE85EBD53380EEF5B5EFC4CC2CE20585D8AF - Submitted as: 8f13716b4837aa49c88e08cacec55a992a69853d5ab7189a865a1b9f06e6bc7c
- File type: html · Size: 80844 bytes
- Verdict: malicious (96/100) · Family: Faceliker
Detections (4 of 50 engines)
- Microsoft Defender: TrojanClicker:JS/Faceliker.E
- Emsisoft (Emergency Kit): JS:Trojan.Clicker.NBP
- Trellix Stinger (McAfee): JS/Faceliker.t
- Kaspersky (KVRT): Trojan.JS.FBook.bk
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 8 weighted signals:
- Microsoft Defender flagged TrojanClicker:JS/Faceliker.E (rule
TrojanClicker:JS/Faceliker.E) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged JS:Trojan.Clicker.NBP (rule
JS:Trojan.Clicker.NBP) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged JS/Faceliker.t (rule
JS/Faceliker.t) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 60 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://misfamosas.net/, http://famosasmx.blogspot.com/favicon.ico - static signal, weight 0.35, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
272 behavior events · 1 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- searchapp.bundleassets.example
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- msedge.api.cdp.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://misfamosas.net/
- http://famosasmx.blogspot.com/favicon.ico
- http://famosasmx.blogspot.com/2013/05/tania-rincon-photoshoot-nuevo-x16-hq.html
- http://famosasmx.blogspot.com/feeds/posts/default
- http://famosasmx.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/7823905331411833760/posts/default
- http://famosasmx.blogspot.com/feeds/2095608777108966825/comments/default
- http://1.bp.blogspot.com/-xSH7qE6gjrY/UYH3JwRJszI/AAAAAAAAH_k/5YbjPtC_3gE/s640/ffm-firj-tania-photoshoot+%2812%29.jpg
- http://1.bp.blogspot.com/-xSH7qE6gjrY/UYH3JwRJszI/AAAAAAAAH_k/5YbjPtC_3gE/w1200-h630-p-k-no-nu/ffm-firj-tania-photoshoot+%2812%29.jpg
- http://www.premiumbloggertemplates.com/
- http://www.bloggertipandtrick.net/
- http://creativecommons.org/licenses/by/3.0/
- https://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js
- http://www.opensource.org/licenses/mit-license.php
- http://www.gnu.org/licenses/gpl.html
- http://users.tpg.com.au/j_birch/plugins/superfish/changelog.txt
- http://1.bp.blogspot.com/-VNR5Yjt6yuU/TvKHT1xV6TI/AAAAAAAADDI/9JKciYbJmWo/s000/background.png
- http://3.bp.blogspot.com/-Xi6sRIMcZfM/TvKHT2JjrDI/AAAAAAAADDM/_uez6xFfZVg/s000/main-bg.png
- http://3.bp.blogspot.com/-nSOlpPJbZjk/TvKHUAMKEPI/AAAAAAAADDY/u97doX_oIEk/s000/menu-primary-shadow.png
- http://3.bp.blogspot.com/-Pe3dtxwXMMI/TvKHUZU7ZyI/AAAAAAAADDg/94pWVfb4dl8/s000/menu-secondary-bg.png
Embedded domains
- www.w3.org
- www.google.com
- www.blogger.com
- misfamosas.net
- famosasmx.blogspot.com
- 1.bp.blogspot.com
- www.bloggertipandtrick.net
- www.premiumbloggertemplates.com
- creativecommons.org
- ajax.googleapis.com
- www.opensource.org
- www.gnu.org
- users.tpg.com.au
- entry.link
- posttitle.link
- readmorelink.link
- 3.bp.blogspot.com
- 2.bp.blogspot.com
- 4.bp.blogspot.com
- apis.google.com
- blogspot.com
- www.blogblog.com
- internacionales.misfamosas.net
- www.twitter.com
- www.facebook.com
Embedded IP addresses
- 52.110.12.53
- 51.116.253.168
- 48.211.4.16
- 4.230.171.124
- 72.145.35.115
- 74.178.240.61
- 52.168.112.67
- 20.231.239.246
- 172.178.240.161
- 20.76.201.171
- 4.144.132.114
- 20.42.65.94
- 40.99.134.2
- 57.155.101.212
- 135.233.45.221
- 40.84.97.4
- 92.223.78.30
- 4.247.188.224
- 135.232.92.97
- 40.99.134.18
- 135.232.92.137
- 162.159.36.2
- 74.178.232.29
- 52.168.117.170
- 52.123.129.14
More Faceliker samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report