MALICIOUS — 96049fecc91e30cea3f83cf1bbd3c13f1a692b65b4cd8b57a6d8fbed05733c97

MALICIOUS — 96049fecc91e30cea3f83cf1bbd3c13f1a692b65b4cd8b57a6d8fbed05733c97 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 96049fecc91e30cea3f83cf1bbd3c13f1a692b65b4cd8b57a6d8fbed05733c97
• SHA-1: 916412eae3dd17445b06c9e4f2fb1037e4e063dc
• MD5: 69702c91d1395ec4d7506abcbcb097ee
• ssdeep: 768:4hlkvgOriWNzvoWgG7T2ZeK5tw0MeVnfMJOelu3pb2yNd:4IvpT2ZemtwhexMJOe83pd
• TLSH: T19B39C55A7B29678F08E09516756C8EE490C6C277E52392F8E272FF48C52CCB0A44DC4B
• Submitted as: 96049fecc91e30cea3f83cf1bbd3c13f1a692b65b4cd8b57a6d8fbed05733c97
• File type: html · Size: 85531 bytes
• Verdict: malicious (93/100)

Detections (3 of 53 engines)

• ClamAV (daily): Html.Exploit.Agent-6598769-0
• Microsoft Defender: TrojanClicker:JS/Faceliker.A
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 93/100 is the fusion of 3 weighted signals:

• ClamAV (daily) flagged Html.Exploit.Agent-6598769-0 (rule Html.Exploit.Agent-6598769-0) - engine signal, weight 0.90, confidence 0.95
• Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css, http://asianhotxxx.blogspot.com/favicon.ico, http://asianhotxxx.blogspot.com/feeds/posts/default - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css
• http://asianhotxxx.blogspot.com/favicon.ico
• http://asianhotxxx.blogspot.com/2011/10/beautiful-females.html
• http://asianhotxxx.blogspot.com/feeds/posts/default
• http://asianhotxxx.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/1078793537960301665/posts/default
• http://asianhotxxx.blogspot.com/feeds/3385404683908386054/comments/default
• https://www.blogger.com/static/v1/jsbin/403901366-ieretrofit.js
• http://2.bp.blogspot.com/-wGGMcD4-znE/Toepr5Hxp9I/AAAAAAAAAnA/GOj0VpkrqRI/s640/1.jpg
• http://2.bp.blogspot.com/-wGGMcD4-znE/Toepr5Hxp9I/AAAAAAAAAnA/GOj0VpkrqRI/w1200-h630-p-k-no-nu/1.jpg
• http://www.blogblog.com/1kt/awesomeinc/body_background_dark.png
• http://www.blogblog.com/1kt/awesomeinc/body_gradient_dark.png
• http://ajax.googleapis.com/ajax/libs/jquery/1.6.2/jquery.min.js
• https://www.blogger.com/dyn-css/authorization.css?targetBlogID=1078793537960301665&amp
• https://apis.google.com/js/plusone.js
• http://asianhotxxx.blogspot.com/
• http://ads.clicksor.com/newServing/showAd.php?nid=1&amp
• http://www.yesadvertising.com
• http://schema.org/BlogPosting
• http://2.bp.blogspot.com/-wGGMcD4-znE/Toepr5Hxp9I/AAAAAAAAAnA/GOj0VpkrqRI/s1600/1.jpg
• http://4.bp.blogspot.com/-3EqgPUapMqU/ToepsytMVHI/AAAAAAAAAnE/KoldeQL71EM/s1600/2.jpg

Embedded domains

• www.w3.org
• www.google.com
• www.blogger.com
• asianhotxxx.blogspot.com
• 2.bp.blogspot.com
• tinachen.org
• header.padding.top
• header.margin.top
• widget.padding.top
• widget.outer.margin.top
• date.header.border.radius.top
• date.space
• date.first.border.radius.top
• post.first.padding.top
• pager.border.radius.top
• pager.space.top
• www.blogblog.com
• ajax.googleapis.com
• blogspot.com
• apis.google.com
• pagead2.googlesyndication.com
• ads.clicksor.com
• www.yesadvertising.com
• schema.org
• 4.bp.blogspot.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report