MALICIOUS — 9a3bfa4d62d9190ea1d3af5aaf94c9af74481712cd0f460606cf4d3cd954dd3b
MALICIOUS — 9a3bfa4d62d9190ea1d3af5aaf94c9af74481712cd0f460606cf4d3cd954dd3b is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Autolike family. 4 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
9a3bfa4d62d9190ea1d3af5aaf94c9af74481712cd0f460606cf4d3cd954dd3b - SHA-1:
da6b0a188eda17ffe6f414983e741c6b3b4e9409 - MD5:
c6b9d9a79e1545ffe7d3b3ce20e43514 - ssdeep:
1536:pY8b8VSeO3fuOQp5I1MCvOANaS6cgRrZx8cbp0:9eO3WOQp5I1MCBw/x8Q0 - TLSH:
T1BE3D37163B7FBE8774D2D12BF68447A4F09182167B33C1F6E1237789E464E645A0EA02 - Submitted as: 9a3bfa4d62d9190ea1d3af5aaf94c9af74481712cd0f460606cf4d3cd954dd3b
- File type: html · Size: 128252 bytes
- Verdict: malicious (99/100) · Family: Autolike
Detections (4 of 51 engines)
- ClamAV (daily): Js.Malware.Autolike-1
- Microsoft Defender: TrojanClicker:JS/Faceliker.C
- Emsisoft (Emergency Kit): Trojan.JS.Clicker.AEI
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 10 weighted signals:
- ClamAV (daily) flagged Js.Malware.Autolike-1 (rule
Js.Malware.Autolike-1) - engine signal, weight 0.90, confidence 0.95 - Memory forensics: 4 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 8176) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Microsoft Defender flagged TrojanClicker:JS/Faceliker.C (rule
TrojanClicker:JS/Faceliker.C) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.JS.Clicker.AEI (rule
Trojan.JS.Clicker.AEI) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1917767771-widget_css_bundle.css, http://creativecommons.org/licenses/by/3.0/, http://1.bp.blogspot.com/-9FCgC3SpZ00/UPMiEedG1VI/AAAAAAAACl0/zLgl3K6_d3I/s1600/arrow_right.gif - static signal, weight 0.35, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (17 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Extracted generic config (17 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
276 behavior events · 1 ATT&CK techniques · 0 dropped files.
Runtime network
- searchapp.bundleassets.example
- www.msftconnecttest.com
- www.bing.com
- desktop-hsgcbep
- config.edge.skype.com
- tas02.sls.update.microsoft.com
- dns.msftncsi.com
- to-do.microsoft.com
- settings-win.data.microsoft.com
- ctldl.windowsupdate.com
- watson.events.data.microsoft.com
- edge.microsoft.com
- aps.prod.windows.com
- ecs.office.com
- g.live.com
- self.events.data.microsoft.com
- msedge.api.cdp.microsoft.com
- fs.microsoft.com
- www.msftncsi.com
- geo.prod.do.dsp.mp.microsoft.com
Embedded URLs
- https://www.blogger.com/static/v1/widgets/1917767771-widget_css_bundle.css
- https://www.google.com/
- http://creativecommons.org/licenses/by/3.0/
- http://1.bp.blogspot.com/-9FCgC3SpZ00/UPMiEedG1VI/AAAAAAAACl0/zLgl3K6_d3I/s1600/arrow_right.gif
- http://2.bp.blogspot.com/-QB-QrnRTSJI/UPMiEYKozJI/AAAAAAAAClw/ieBOFWLIqlM/s1600/arrow_down.gif
- http://3.bp.blogspot.com/-LzmPTNyR6po/TwETZufjSTI/AAAAAAAAATo/oisHmXUjmSY/s1600/arrow_white.gif
- http://4.bp.blogspot.com/-tk5hQcNMq6M/T8zPEwjH-RI/AAAAAAAAGm0/t8xkrJitkxg/s1600/batas.gif
- http://4.bp.blogspot.com/-Bt0JYGRHfpk/T7ZpN5RNSQI/AAAAAAAAGJQ/zQtrWVZwgHA/s1600/bullet.png
- http://3.bp.blogspot.com/-kci2j8VxzNY/UPw8jUo8hzI/AAAAAAAABNw/xV9j7En07ew/s1600/feed+icon.gif
- http://1.bp.blogspot.com/-zt3csy2DqGo/U661h1iTakI/AAAAAAAAAFc/v5tUjZIJDHs/s1600/mas-icons.png
- http://code.jquery.com/jquery-2.1.1.js
- http://ajax.googleapis.com/ajax/libs/jqueryui/1.9.2/jquery-ui.min.js
- http://4.bp.blogspot.com/-FQcN0HoEKOM/U-KOVyHHpdI/AAAAAAAAABo/vLPl7bpLNwk/s1600/love-icon%5B1%5D.png
- https://www.blogger.com/dyn-css/authorization.css?targetBlogID=4192648698393498088&zx=fee790f9-3b77-455d-8d29-55f3f5bb617a
- http://1001girlmovies.blogspot.md/
- http://2.bp.blogspot.com/-Orz321Gat5Y/U9p9AMWVXYI/AAAAAAAAAGU/8K4hznEeMtQ/s1600/Idool.jpg
- http://www.campusrape.info?href=http://www.campusrape.info&layout=standard&show_faces=false&width=20&action=like&font=tahoma&colorscheme=light&height=20
- http://1001girlmovies.blogspot.md/search/label/.indo%20nude
- http://1001girlmovies.blogspot.md/search/label/.indo%20nude.blowjob.%20hijab
- http://1001girlmovies.blogspot.md/search/label/1%20Cowok%202%20Cewek
- http://1001girlmovies.blogspot.md/search/label/ABG%20Kecil
- http://1001girlmovies.blogspot.md/search/label/ABG..indo%20nude
- http://1001girlmovies.blogspot.md/search/label/AFF%20cam%20capture
- http://1001girlmovies.blogspot.md/search/label/airlines
- http://1001girlmovies.blogspot.md/search/label/army%20girl
Embedded domains
- www.blogger.com
- www.google.com
- creativecommons.org
- 1.bp.blogspot.com
- 2.bp.blogspot.com
- 3.bp.blogspot.com
- 4.bp.blogspot.com
- code.jquery.com
- ajax.googleapis.com
- www.campusrape.info
- icontainer.style.top
- resources.blogblog.com
- lh6.googleusercontent.com
- apis.google.com
- www.facebook.com
- twitter.com
- plus.google.com
- pinterest.com
- www.youtube.com
- feeds.feedburner.com
- 1001girlmovies.blogspot.com
- www.blogblog.com
- 1001girlmovies.blogspot.md
More Autolike samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report