MALICIOUS — 8f157704a6b5a0508aa8918a386c0fece35705cbd7c2865d2478aba1e9e9f48d

MALICIOUS — 8f157704a6b5a0508aa8918a386c0fece35705cbd7c2865d2478aba1e9e9f48d is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the TrojanClicker family. 4 of 50 detection engines flagged it.

Identification

• SHA-256: 8f157704a6b5a0508aa8918a386c0fece35705cbd7c2865d2478aba1e9e9f48d
• SHA-1: 6dbfcd453e30684e8b0f5bdb8927dbf08cca5df6
• MD5: 9fade509ab71b810ac1ec2f559c48b3e
• ssdeep: 384:XgE93AIoq/AxQ2XMp/b4Z61OLNcfD6og23ZecznkA9CQghJ39UL8OQ0dT5LP5jYY:2/x8pjh1O+D6ogk4knRCQR8OQK1Br
• TLSH: T18A32C7473A91A98B08F05515615C8AC964CAD227A83353FAF1B7EF8CC428D74F94DC8B
• Submitted as: 8f157704a6b5a0508aa8918a386c0fece35705cbd7c2865d2478aba1e9e9f48d
• File type: html · Size: 44484 bytes
• Verdict: malicious (98/100) · Family: TrojanClicker

Detections (4 of 50 engines)

• ClamAV (daily): Html.Exploit.Agent-6598769-0
• Microsoft Defender: TrojanClicker:JS/Faceliker.A
• Emsisoft (Emergency Kit): Trojan.Script.613694
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Html.Exploit.Agent-6598769-0 (rule Html.Exploit.Agent-6598769-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged TrojanClicker:JS/Faceliker.A (rule TrojanClicker:JS/Faceliker.A) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Script.613694 (rule Trojan.Script.613694) - engine signal, weight 0.55, confidence 0.85
• Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css, http://imagenesconfrasesymemes.blogspot.com/favicon.ico, http://imagenesconfrasesymemes.blogspot.com/2012/10/blog-post_14.html - static signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

1 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css
• http://imagenesconfrasesymemes.blogspot.com/favicon.ico
• http://imagenesconfrasesymemes.blogspot.com/2012/10/blog-post_14.html
• http://imagenesconfrasesymemes.blogspot.com/feeds/posts/default
• http://imagenesconfrasesymemes.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/7229256290879309122/posts/default
• http://imagenesconfrasesymemes.blogspot.com/feeds/942823547661179780/comments/default
• https://www.blogger.com/static/v1/jsbin/403901366-ieretrofit.js
• http://3.bp.blogspot.com/-_kxlZJzTg6M/UHs7QeVo41I/AAAAAAAAAkE/pyBd66qH5jA/s400/tipico.jpg
• http://3.bp.blogspot.com/-_kxlZJzTg6M/UHs7QeVo41I/AAAAAAAAAkE/pyBd66qH5jA/w1200-h630-p-k-no-nu/tipico.jpg
• http://ajax.googleapis.com/ajax/libs/jquery/1.5.2/jquery.min.js
• https://www.blogger.com/dyn-css/authorization.css?targetBlogID=7229256290879309122&amp
• https://apis.google.com/js/plusone.js
• http://1.bp.blogspot.com/-XwCYgb62Rso/UIxzH1ovo3I/AAAAAAAABMU/F2_Cgdj99f4/s748/headerrrr.png
• http://imagenesconfrasesymemes.blogspot.com/
• http://schema.org/BlogPosting
• http://3.bp.blogspot.com/-_kxlZJzTg6M/UHs7QeVo41I/AAAAAAAAAkE/pyBd66qH5jA/s1600/tipico.jpg
• http://schema.org/Person
• https://www.blogger.com/profile/05453503007102196889
• https://www.blogger.com/post-edit.g?blogID=7229256290879309122&postID=942823547661179780&from=pencil
• https://resources.blogblog.com/img/icon18_edit_allbkg.gif

Embedded domains

• www.w3.org
• www.google.com
• www.blogger.com
• imagenesconfrasesymemes.blogspot.com
• 3.bp.blogspot.com
• fonts.gstatic.com
• tinachen.org
• ajax.googleapis.com
• blogspot.com
• apis.google.com
• pagead2.googlesyndication.com
• 1.bp.blogspot.com
• schema.org
• resources.blogblog.com
• i454.photobucket.com
• 4.bp.blogspot.com
• plantillasgratis.comuv.com
• u.jimdo.com
• twitter.com
• www.fotosbebes.org
• www.facebook.com
• www.blogblog.com

More TrojanClicker samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report