MALICIOUS — 8f19349c49b34ec07333ef96cf63d2729ec31fc0590ef3b941b80e8d31f41713

MALICIOUS — 8f19349c49b34ec07333ef96cf63d2729ec31fc0590ef3b941b80e8d31f41713 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100), attributed to the TrojanClicker family. 3 of 23 detection engines flagged it.

Identification

SHA-256: 8f19349c49b34ec07333ef96cf63d2729ec31fc0590ef3b941b80e8d31f41713
SHA-1: 9a4fe836eafa71c85d7d15cf9b51d6725d585e02
MD5: 7b6c572a019cd0cd181d8c3617467908
ssdeep: 1536:EirO/81frJPia6a5Igo0noIbQyr4yhbsJnzx:F1DJata5I90noIMyr4ylsJnzx
TLSH: T1093894563F257A4A08E04556749C5EE811D283A3ED3392F9E376FFE9903CC74A40A893
Submitted as: 8f19349c49b34ec07333ef96cf63d2729ec31fc0590ef3b941b80e8d31f41713
File type: html · Size: 81634 bytes
Verdict: malicious (87/100) · Family: TrojanClicker

Detections (3 of 23 engines)

Microsoft Defender: TrojanClicker:JS/Faceliker.A
Emsisoft (Emergency Kit): Trojan.Script.613694
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 87/100 is the fusion of 4 weighted signals:

Microsoft Defender flagged TrojanClicker:JS/Faceliker.A (rule TrojanClicker:JS/Faceliker.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Script.613694 (rule Trojan.Script.613694) - engine signal, weight 0.55, confidence 0.85
Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css, http://zmonuments.blogspot.com/favicon.ico, http://zmonuments.blogspot.com/search/label/Migrating%20in%20Australia - static signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

1 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

none

Embedded URLs

http://www.w3.org/1999/xhtml
http://www.google.com/2005/gml/b
http://www.google.com/2005/gml/data
http://www.google.com/2005/gml/expr
https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css
http://zmonuments.blogspot.com/favicon.ico
http://zmonuments.blogspot.com/search/label/Migrating%20in%20Australia
http://zmonuments.blogspot.com/feeds/posts/default
http://zmonuments.blogspot.com/feeds/posts/default?alt=rss
https://www.blogger.com/feeds/5882740571486913168/posts/default
https://www.blogger.com/profile/07831228977523212544
https://www.blogger.com/static/v1/jsbin/403901366-ieretrofit.js
http://ajax.googleapis.com/ajax/libs/jquery/1.5.2/jquery.min.js
https://www.blogger.com/dyn-css/authorization.css?targetBlogID=5882740571486913168&amp
http://schema.org/Blog
http://zmonuments.blogspot.com/
http://3.bp.blogspot.com/-KUBLkpn5-hk/UbS9Iu9WH4I/AAAAAAAAACc/4QssLKsDo-g/s1600/logo_96.png
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://schema.org/BlogPosting
http://1.bp.blogspot.com/-tL3eG-fGrNY/Ubms_CNXmqI/AAAAAAAAAIg/rCK1aY6w4ug/s320/Overseas-Talent.jpg
http://zmonuments.blogspot.com/2013/06/migrating-in-australia-basic.html
http://1.bp.blogspot.com/-tL3eG-fGrNY/Ubms_CNXmqI/AAAAAAAAAIg/rCK1aY6w4ug/s1600/Overseas-Talent.jpg
http://zmonuments.blogspot.com/2013/06/migrating-in-australia-basic.html#more
http://s7.addthis.com/js/250/addthis_widget.js#pubid=xa-4ec4dd3d1e59e9dc
http://zmonuments.blogspot.com/2013/06/migrating-in-australia-basic.html#comment-form

Embedded domains

www.w3.org
www.google.com
sellcars13.blogspot.com
stats.g.doubleclick.net
www.blogger.com
zmonuments.blogspot.com
fonts.gstatic.com
www.noaesthetic.com
www.blogblog.com
header.shadow.offset.top
tabs.margin.top
main.padding.top
ajax.googleapis.com
blogspot.com
schema.org
3.bp.blogspot.com
pagead2.googlesyndication.com
1.bp.blogspot.com
s7.addthis.com
resources.blogblog.com
www.linkwithin.com
www.way2blogging.org
www.tqarob.blogspot.com
tqarob.googlecode.com
2.bp.blogspot.com

More TrojanClicker samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report