MALICIOUS — 9901b2d5a20e98ed517f02c26d57996557077d9effc93d4706be555e725357e4
MALICIOUS — 9901b2d5a20e98ed517f02c26d57996557077d9effc93d4706be555e725357e4 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the TrojanClicker family. 2 of 53 detection engines flagged it.
Identification
- SHA-256:
9901b2d5a20e98ed517f02c26d57996557077d9effc93d4706be555e725357e4 - SHA-1:
bdb186d42fae4774be59d7416791bdf815e244b0 - MD5:
0154e6335effb7a55585cd8043c66f6d - ssdeep:
1536:DqjQb88VGISUYjCkmGIBzgLhMBkyRhh/bbNcV+cF9rCX7CesI0sK3pFSQJ/0ChEb:XVGInkyRhh/bbNcwe9rCX7Ce2sK3pFSh - TLSH:
T16134095F3E111A9D889180526BE849C890CFC69BDD3141D8F9B6DFC8EE78D701458CAE - Submitted as: 9901b2d5a20e98ed517f02c26d57996557077d9effc93d4706be555e725357e4
- File type: html · Size: 55726 bytes
- Verdict: malicious (84/100) · Family: TrojanClicker
Detections (2 of 53 engines)
- Microsoft Defender: TrojanClicker:JS/Faceliker.N
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 84/100 is the fusion of 5 weighted signals:
- Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule
windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 23 external host(s) at runtime (25 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://creativecommons.org/licenses/by/3.0/, http://1.bp.blogspot.com/-9FCgC3SpZ00/UPMiEedG1VI/AAAAAAAACl0/zLgl3K6_d3I/s1600/arrow_right.gif - static signal, weight 0.35, confidence 0.60
- Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
278 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
Dropped files
- 9df288d7098c73a9fa5fd19c46ca81266b7c841420ea36617cd9587196703e54 -
9df288d7098c73a9fa5fd19c46ca81266b7c841420ea36617cd9587196703e54
Embedded URLs
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://creativecommons.org/licenses/by/3.0/
- http://1.bp.blogspot.com/-9FCgC3SpZ00/UPMiEedG1VI/AAAAAAAACl0/zLgl3K6_d3I/s1600/arrow_right.gif
- http://2.bp.blogspot.com/-QB-QrnRTSJI/UPMiEYKozJI/AAAAAAAAClw/ieBOFWLIqlM/s1600/arrow_down.gif
- http://3.bp.blogspot.com/-LzmPTNyR6po/TwETZufjSTI/AAAAAAAAATo/oisHmXUjmSY/s1600/arrow_white.gif
- http://4.bp.blogspot.com/-tk5hQcNMq6M/T8zPEwjH-RI/AAAAAAAAGm0/t8xkrJitkxg/s1600/batas.gif
- http://4.bp.blogspot.com/-Bt0JYGRHfpk/T7ZpN5RNSQI/AAAAAAAAGJQ/zQtrWVZwgHA/s1600/bullet.png
- http://3.bp.blogspot.com/-kci2j8VxzNY/UPw8jUo8hzI/AAAAAAAABNw/xV9j7En07ew/s1600/feed+icon.gif
- http://ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js
- https://www.blogger.com/dyn-css/authorization.css?targetBlogID=449051877590555926&
- http://www.linkbucks.com/Webservices/jsParseLinks.aspx?id=ddbca000
- http://pcgamefullz.blogspot.com/
- http://pcgamefullz.blogspot.com/2012/12/sitemap-all-games.html
- http://pcgamefullz.blogspot.com/search/label/100Mb
- http://pcgamefullz.blogspot.com/search/label/P
- http://pcgamefullz.blogspot.com/search/label/Racing
- http://pcgamefullz.blogspot.com/2013/07/pacman-world-rally-pc-game-free-download.html
- http://static.giantbomb.com/uploads/original/1/17389/592328-psx_pacman_world_ntsc.jpg
- http://4.bp.blogspot.com/-4F6wsbPZnJ8/UWf-VKMeYiI/AAAAAAAAVb0/6fPlczxbVVA/s320/Pacman+World+Rally.1.jpg
- http://4.bp.blogspot.com/-8TQsAwlGufI/UWf-WKplSwI/AAAAAAAAVb8/QmF4houdDv0/s320/Pacman+World+Rally.2.jpg
- http://1.bp.blogspot.com/-jNxkvUUE4z4/UWf-XN8kxWI/AAAAAAAAVcE/pGnyKPpTNE0/s320/Pacman+World+Rally.3.jpg
- http://4.bp.blogspot.com/-buyG-ohrd_E/UUM7-n_JOQI/AAAAAAAAAhs/0kEOWCdGJ6o/s320/Download+Here.gif
- http://adf.ly/Mrir5
- http://1.bp.blogspot.com/-S1m7J5sYTUk/UTm4UIA5pUI/AAAAAAAAAcA/suDexvgmIjY/s1600/enjoyd.png
- http://cdn.iasrv.com/inviteads/scripts/smart/smart.js
Embedded domains
- www.blogger.com
- creativecommons.org
- 1.bp.blogspot.com
- 2.bp.blogspot.com
- 3.bp.blogspot.com
- 4.bp.blogspot.com
- ajax.googleapis.com
- blogspot.com
- www.linkbucks.com
- pcgamefullz.blogspot.com
- static.giantbomb.com
- gratisdownloadgame.blogspot.com
- adf.ly
- just4pcgames.blogspot.com
- x.iasrv.com
- cdn.iasrv.com
- s7.addthis.com
- yourjavascript.com
- feeds.feedburner.com
- feedburner.google.com
- entry.link
- lh3.ggpht.com
- apis.google.com
- pagead2.googlesyndication.com
- s10.histats.com
Embedded IP addresses
- 20.184.175.0
- 4.247.188.224
- 52.230.59.222
- 4.230.171.124
- 74.178.240.61
- 52.182.143.212
- 74.178.76.54
- 74.178.76.128
- 20.76.201.171
- 52.123.129.14
- 52.123.128.14
- 135.233.45.223
- 74.178.232.29
- 172.66.2.5
- 203.26.79.13
- 52.148.114.188
- 4.209.250.170
- 51.104.15.253
- 72.145.35.110
- 52.168.117.168
- 92.223.78.30
- 52.110.12.52
- 52.110.12.37
More TrojanClicker samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report