MALICIOUS — 990c909fe5ebaa5e8baaaceb7df59040723ddd07f3ef20d773cde035ee20cd83

MALICIOUS — 990c909fe5ebaa5e8baaaceb7df59040723ddd07f3ef20d773cde035ee20cd83 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (77/100), attributed to the Cryxos family. 2 of 53 detection engines flagged it.

Identification

SHA-256: 990c909fe5ebaa5e8baaaceb7df59040723ddd07f3ef20d773cde035ee20cd83
SHA-1: 96cf1c2d2f0b9d92dba3ec89c7dd9b47f9329d31
MD5: 72aa6e1fd711ef45d0247bf2e4da6e67
ssdeep: 48:lmI++x4S9wPTWrp5ZHkN+grQDz8HOEZHRyhw+Xku:1++x4mw0Hk5ExcEhw+T
TLSH: T1181684DAF0CBADA8CC1D526B7D44A2877A0FDF353A815BD8A74852595CE0CE81D36022
Submitted as: 990c909fe5ebaa5e8baaaceb7df59040723ddd07f3ef20d773cde035ee20cd83
File type: html · Size: 2907 bytes
Verdict: malicious (77/100) · Family: Cryxos

Detections (2 of 53 engines)

Microsoft Defender: Trojan:JS/Cryxos.PGCH!MTB
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 77/100 is the fusion of 3 weighted signals:

Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 27 external host(s) at runtime (25 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

282 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd
http://www.w3.org/1999/xhtml
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787819161&P2=404&P3=2&P4=EZZPgVJRDOONrDz4U63awzJAriRVlDuAtZpSI5wVxcBgO%2fUJ8zbdrrBhHpjKcidRwu68kjXT6%2bWgZAWKCf8FNQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787819228&P2=404&P3=2&P4=OMCUnZmIA%2bR1FoIWSJI06wfW%2b1SLm0C9YS1hCfdV8%2b6gPKB9%2b5d6tto7Pk4ei9HGaq2FfMYnijwr0MX%2bnXnplA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787215929&P2=404&P3=2&P4=R%2fODf8OirQlFh2QyJKPrb4E8K6%2fmERcjRVjK%2fjHm0szB31hCW34kk9g7qVpoQYRnqg289u4uBuCW0czjlyjxxg%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787215515&P2=404&P3=2&P4=dRGxTzxf%2f0BM7XoQYmQstJq%2fCUTFVk%2bnioa9FWe8a5vrvsdlWnxez2J6uPMzGuZpXT8fbz1mWFFO7EtH2WYIqg%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.w3.org
window.top

Embedded IP addresses

20.184.175.21
172.215.188.225
4.230.171.124
4.144.132.114
135.233.95.144
74.178.76.54
20.165.94.63
52.168.112.67
20.112.250.133
92.223.78.30
162.159.142.9
52.123.128.14
40.99.133.242
52.123.129.14
135.234.160.246
203.26.79.13
135.233.95.80
52.148.114.188
20.42.65.90
52.168.117.170
72.153.5.132
172.170.180.133
40.79.167.9
40.84.97.4
40.79.167.10

More Cryxos samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report