MALICIOUS — 90895b5f18652bbebb52187a1b89740b6a1eb694262d7bb55143ce66636797e6

MALICIOUS — 90895b5f18652bbebb52187a1b89740b6a1eb694262d7bb55143ce66636797e6 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100). 1 of 54 detection engines flagged it.

Identification

SHA-256: 90895b5f18652bbebb52187a1b89740b6a1eb694262d7bb55143ce66636797e6
SHA-1: ac4c4c480781769722fae77b900e31e52de8b867
MD5: 2ab8ed86b404f7c43e66bb5f09408346
ssdeep: 3072:S2Y8Njz2S81Ep2cvbM9FNa+l/eDkwlXJ2l/esRDyh42HEp1S9:w8Rqp1gv
TLSH: T1853AE76B77256A8F08D0450265AC5EEC60C6C2D7E93382A5F272EF8CD83CC749949C97
Submitted as: 90895b5f18652bbebb52187a1b89740b6a1eb694262d7bb55143ce66636797e6
File type: html · Size: 100747 bytes
Verdict: malicious (84/100)

Detections (1 of 54 engines)

Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 84/100 is the fusion of 5 weighted signals:

Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 2 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://layanan.oposisi.net/tampilan/highslide-with-html.js, http://layanan.oposisi.net/tampilan/highslide.css, http://layanan.oposisi.net/tampilan/bingkai/ - static signal, weight 0.35, confidence 0.60
Extracted generic config (15 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

277 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/1999/xhtml
http://www.google.com/2005/gml/b
http://www.google.com/2005/gml/data
http://www.google.com/2005/gml/expr
http://layanan.oposisi.net/tampilan/highslide-with-html.js
http://layanan.oposisi.net/tampilan/highslide.css
http://layanan.oposisi.net/tampilan/bingkai/
https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css
http://damncok.blogspot.com/
http://yourjavascript.com/31244224371/fb.js
http://grasakfuckaudio.blogspot.com/search/label/analog.68.117
http://grasakfuckaudio.blogspot.com/favicon.ico
http://grasakfuckaudio.blogspot.com/feeds/posts/default
http://grasakfuckaudio.blogspot.com/feeds/posts/default?alt=rss
https://www.blogger.com/feeds/2961288418925170704/posts/default
https://www.blogger.com/profile/00858482389030740799
https://www.blogger.com/static/v1/jsbin/403901366-ieretrofit.js
http://3.bp.blogspot.com/-vi72oL3XQA4/T36LfXegDvI/AAAAAAAAANM/qJ8KQgL_-ow/s200/gfa.gif
https://ajax.googleapis.com/ajax/libs/jquery/1.6.1/jquery.min.js
http://en.vietwebguide.com
https://ajax.googleapis.com/ajax/libs/jquery/1.5.0/jquery.min.js
http://dinhquanghuy.110mb.com/jquery.cookie.js
http://www.iconj.com/ico/v/t/vt3fu2a3jx.ico
https://www.blogger.com/dyn-css/authorization.css?targetBlogID=2961288418925170704&amp
https://www.blogger.com/go/adspersonalization

Embedded domains

www.w3.org
www.google.com
layanan.oposisi.net
www.blogger.com
damncok.blogspot.com
yourjavascript.com
grasakfuckaudio.blogspot.com
3.bp.blogspot.com
ajax.googleapis.com
en.vietwebguide.com
entry.link
dinhquanghuy.110mb.com
google-analytics.com
www.iconj.com
blogspot.com
apis.google.com
pagead2.googlesyndication.com
2.bp.blogspot.com
adf.ly
teknoinfokita.blogspot.com
s3.amazonaws.com
adsensecamp.com
feeds.feedburner.com
feedburner.google.com
www.linkwithin.com

Embedded IP addresses

52.230.59.222
51.132.193.104
52.123.252.247
4.230.171.124
172.64.154.167
52.110.12.2
52.110.12.22
172.215.188.225
72.145.35.99
52.148.114.188
52.110.12.30
52.110.12.20

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report