MALICIOUS — 9dc3262e1893b60e4d5696de62b15498ab831564be87f84358c4336b702d92f5

MALICIOUS — 9dc3262e1893b60e4d5696de62b15498ab831564be87f84358c4336b702d92f5 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100). 1 of 54 detection engines flagged it.

Identification

SHA-256: 9dc3262e1893b60e4d5696de62b15498ab831564be87f84358c4336b702d92f5
SHA-1: 23eff7c915011c2c5ffc115ce4d721891fa096f5
MD5: a73f3379588b6e52b21a4cbe889936bd
ssdeep: 768:vIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7S449X:vIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqM
TLSH: T1692F8486B69DCCC1DACFDBD381941C1448D6AD0F096DFC8995BCABB0786FB61105888B
Submitted as: 9dc3262e1893b60e4d5696de62b15498ab831564be87f84358c4336b702d92f5
File type: html · Size: 33854 bytes
Verdict: malicious (84/100)

Detections (1 of 54 engines)

Microsoft Defender: Trojan:Script/Wacatac.C!ml

Why this verdict

The malicious score of 84/100 is the fusion of 5 weighted signals:

Microsoft Defender flagged Trojan:Script/Wacatac.C!ml (rule Trojan:Script/Wacatac.C!ml) - engine signal, weight 0.55, confidence 0.85
Obfuscated javascript script: dynamic-exec (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://ogp.me/ns/fb#, http://2.bp.blogspot.com/-bbUbGp-E33U/TZNQKGzX9HI/AAAAAAAAG0Q/1v-Dx1BhS2A/s1600/Praxair-Global-Market-Share.jpg, http://f.tqn.com/y/collegeapps/1/S/a/I/-/-/southern-illinois-edwardsville-Illinois2011-wiki.jpg - static signal, weight 0.35, confidence 0.60
Extracted generic config (6 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

280 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://ogp.me/ns/fb#
http://2.bp.blogspot.com/-bbUbGp-E33U/TZNQKGzX9HI/AAAAAAAAG0Q/1v-Dx1BhS2A/s1600/Praxair-Global-Market-Share.jpg
http://f.tqn.com/y/collegeapps/1/S/a/I/-/-/southern-illinois-edwardsville-Illinois2011-wiki.jpg
http://www.immortal.org/wp-content/uploads/2015/09/pills-530372_1280.jpg
http://www.washingtonpost.com/blogs/the-fix/files/2013/07/snap.jpg
http://elle.it/var/elleit/storage/images/moda/shopping/halle-berry-michael-kors-world-food-programm/halle-berry-assieme-a-michael-kors-per-il-world-food-programm/13806786-1-ita-IT/Halle-Berry-assieme-a-Michael-Kors-per-il-World-Food-Programm_box4cgrid.jpg
http://bittorrenttodays836.weebly.com/1/post/2017/01/share-illinois-food-program.html
https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
https://www.google.com/recaptcha/api.js
https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js
http://twitter.com/share?url=http://bittorrenttodays836.weebly.com/1/post/2017/01/share-illinois-food-program.html
http://bittorrenttodays836.weebly.com/blog/share-illinois-food-program&is_mobile=&r=3&is_light=1
https://www.weebly.com/signup?utm_source=internal&utm_medium=footer
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

ogp.me
2.bp.blogspot.com
f.tqn.com
www.immortal.org
www.washingtonpost.com
elle.it
bittorrenttodays836.weebly.com
cdn2.editmysite.com
fonts.googleapis.com
cdn1.editmysite.com
ajax.googleapis.com
www.weebly.com
www.google.com
twitter.com
google-analytics.com
test.name
ec.editmysite.com
connect.facebook.net
tter.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.97
52.230.59.222
20.42.179.204
4.230.171.124
40.84.85.40
74.178.76.54
20.42.65.84
74.178.76.128
74.178.240.61
20.42.73.28
52.110.12.46
52.110.12.24
52.148.114.188
72.145.35.110

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report