SUSPICIOUS — 9267ea4836b7840f54d4df3905a61c6bf197ac3ac539281977d9cb2f7b4c3431

SUSPICIOUS — 9267ea4836b7840f54d4df3905a61c6bf197ac3ac539281977d9cb2f7b4c3431 is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 53 detection engines flagged it.

Identification

SHA-256: 9267ea4836b7840f54d4df3905a61c6bf197ac3ac539281977d9cb2f7b4c3431
SHA-1: ee1af093fb4078bc2c6de6b9c60401ac8b0a0061
MD5: 9dfa2352cc8ef651b6eccb5a8c7cd64c
ssdeep: 6144:tf4MeUs82u22NLCg7y8kqDW8Hau9UfRD:teUs82u22NLCge85H7UfF
TLSH: T1FB45E6AD39857ECCCC0DD9673E98D87F33269E69B6B060C8936DDB55B8B4CE00894811
Submitted as: 9267ea4836b7840f54d4df3905a61c6bf197ac3ac539281977d9cb2f7b4c3431
File type: script · Size: 266003 bytes
Verdict: suspicious (54/100)

Detections (2 of 53 engines)

Microsoft Defender: Trojan:JS/Agent.AG!MSR
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Embedded network infrastructure: https://fullcalendar.io/, https://www.googleapis.com/calendar/v3/calendars, http://fullcalendar.io/docs/google_calendar/ - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://fullcalendar.io/
http://www.w3.org/2000/svg
https://www.googleapis.com/calendar/v3/calendars
http://fullcalendar.io/docs/google_calendar/

Embedded domains

fullcalendar.io
www.w3.org
e.prototype.today
e.top
t.top
n.top
e.top-t.top
e.style.top
r.top
i.top
o.top
s-u.top
e.bottom-e.top
e.name
t-s.top
p.bottom-p.top
v.rect.top
d.top
www.googleapis.com
www.google.com
alliancehp.org

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report