MALICIOUS — 9ee75b45dae56f41b1b22ad4ff01890f703f1434b12070378eb5c17834503315
MALICIOUS — 9ee75b45dae56f41b1b22ad4ff01890f703f1434b12070378eb5c17834503315 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100), attributed to the Redirector family. 2 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
9ee75b45dae56f41b1b22ad4ff01890f703f1434b12070378eb5c17834503315 - SHA-1:
6faf62d2e53291cd709a47700b495177ef97907b - MD5:
4ba14072c15f5b32e1bf40bca13cb455 - ssdeep:
1536:mPMEPDQyb98b98b98b98b98b98b98b98b98b98b98b98b98b98b98b98b98b98bk:yPEFmMzZi2Xzsn2aI7 - TLSH:
T1F5356428EA81E6C39D8D22B946FF0CA49C51C45B7D1AFCFD9C64EA4BA6D9D7004C850C - Submitted as: 9ee75b45dae56f41b1b22ad4ff01890f703f1434b12070378eb5c17834503315
- File type: html · Size: 61732 bytes
- Verdict: malicious (89/100) · Family: Redirector
Detections (2 of 51 engines)
- Microsoft Defender: Trojan:JS/Redirector.AYLB!MTB
- Emsisoft (Emergency Kit): Trojan.GenericKD.61151313
MITRE ATT&CK
Why this verdict
The malicious score of 89/100 is the fusion of 6 weighted signals:
- Microsoft Defender flagged Trojan:JS/Redirector.AYLB!MTB (rule
Trojan:JS/Redirector.AYLB!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.GenericKD.61151313 (rule
Trojan.GenericKD.61151313) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (layers: char-code) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: http://intraserv.com.br/wp-content/uploads/2017/06/favicon.png, https://yoast.com/wordpress/plugins/seo/, https://schema.org - static signal, weight 0.35, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
275 behavior events · 1 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- searchapp.bundleassets.example
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- desktop-hsgcbep
- config.edge.skype.com
- www.bing.com
- fd.api.iris.microsoft.com
- aps.prod.windows.com
- dns.msftncsi.com
- tas02.sls.update.microsoft.com
- settings-win.data.microsoft.com
- to-do.microsoft.com
- ctldl.windowsupdate.com
- staging.to-do.microsoft.com
- edge.microsoft.com
- teams.microsoft.com
Embedded URLs
- http://intraserv.com.br/wp-content/uploads/2017/06/favicon.png
- https://yoast.com/wordpress/plugins/seo/
- https://schema.org
- https://intraserv.com.br/#organization
- https://intraserv.com.br/
- https://intraserv.com.br/#logo
- https://intraserv.com.br/wp-content/uploads/2017/06/logo-intraserv.png
- https://intraserv.com.br/#website
- https://intraserv.com.br/feed/
- https://intraserv.com.br/comments/feed/
- https://intraserv.com.br/search/feed/rss2/
- https://intraserv.com.br/wp-includes/css/dist/block-library/style.min.css?ver=5.4.4
- https://intraserv.com.br/wp-content/themes/enfold/css/grid.css?ver=2
- https://intraserv.com.br/wp-content/themes/enfold/css/base.css?ver=2
- https://intraserv.com.br/wp-content/themes/enfold/css/layout.css?ver=2
- https://intraserv.com.br/wp-content/themes/enfold/css/shortcodes.css?ver=2
- https://intraserv.com.br/wp-content/themes/enfold/js/aviapopup/magnific-popup.css?ver=1
- https://intraserv.com.br/wp-content/themes/enfold/js/mediaelement/skin-1/mediaelementplayer.css?ver=1
- https://intraserv.com.br/wp-content/themes/enfold/css/print.css?ver=1
- https://intraserv.com.br/wp-content/uploads/dynamic_avia/core_marketing.css?ver=5f2869597bd56
- https://intraserv.com.br/wp-content/themes/enfold/css/custom.css?ver=2
- https://intraserv.com.br/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
- https://intraserv.com.br/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
- https://intraserv.com.br/wp-content/themes/enfold/js/avia-compat.js?ver=2
- https://api.w.org/
Embedded domains
- intraserv.com.br
- yoast.com
- schema.org
- maps.google.com
- s.w.org
- fonts.googleapis.com
- api.w.org
- gmpg.org
- www.google-analytics.com
- www.googletagmanager.com
- rdf.data-vocabulary.org
- br.wordpress.org
- coremarketing.com.br
- get.adobe.com
- mejs.live
- train.developfirstline.com
- staging.to-do.officeppe.com
More Redirector samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report