SUSPICIOUS — 9fff1a774a85a191dd95c19f580cb9c108a3b15f35b81ca6026a59449a74f33f
SUSPICIOUS — 9fff1a774a85a191dd95c19f580cb9c108a3b15f35b81ca6026a59449a74f33f is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 53 detection engines flagged it.
Identification
- SHA-256:
9fff1a774a85a191dd95c19f580cb9c108a3b15f35b81ca6026a59449a74f33f - SHA-1:
d1f497496f8fefa59e0991f72f812020bcecc613 - MD5:
fc5904db97ad6f88d0f37668ed75b3f5 - ssdeep:
768:yA4fQXfpveXzb9rzb9ipo2wY3zYkqsYaxFLi5JInJ0pb/ft6uOwN+x:yAfpozb9rzb9im2wY3zYkqhabiJInJ0y - TLSH:
T154323050B2BCDA49C1C01BF1F5A93516D8807D5B742168D2853CCB4DAEEEA21F0B9CDA - Submitted as: 9fff1a774a85a191dd95c19f580cb9c108a3b15f35b81ca6026a59449a74f33f
- File type: html · Size: 47124 bytes
- Verdict: suspicious (54/100)
Detections (1 of 53 engines)
- Microsoft Defender: Trojan:JS/Redirector.YBAA!MTB
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec (layers: char-code) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: http://gmpg.org/xfn/11, https://finefinishesil.com/feed/, https://finefinishesil.com/comments/feed/ - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://schema.org/WebPage
- http://gmpg.org/xfn/11
- https://finefinishesil.com/feed/
- https://finefinishesil.com/comments/feed/
- https://finefinishesil.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.0.5
- https://finefinishesil.com/wp-content/themes/oceanwp/assets/css/third/font-awesome.min.css?ver=4.7.0
- https://finefinishesil.com/wp-content/themes/oceanwp/assets/css/third/simple-line-icons.min.css?ver=2.4.0
- https://finefinishesil.com/wp-content/themes/oceanwp/assets/css/third/magnific-popup.min.css?ver=1.0.0
- https://finefinishesil.com/wp-content/themes/oceanwp/assets/css/style.min.css?ver=1.5.21
- https://finefinishesil.com/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=2.6.6
- https://finefinishesil.com/wp-content/uploads/elementor/css/post-483.css?ver=1564339055
- https://finefinishesil.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ver=5.3.0
- https://finefinishesil.com/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=2.6.6
- https://finefinishesil.com/wp-content/uploads/elementor/css/global.css?ver=1564079268
- https://finefinishesil.com/wp-content/uploads/elementor/css/post-23.css?ver=1587158202
- https://finefinishesil.com/wp-content/plugins/rich-reviews/css/rich-reviews.css?ver=4.9.18
- https://finefinishesil.com/wp-content/plugins/ocean-extra/assets/css/widgets.css?ver=4.9.18
- https://fonts.googleapis.com/css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7COpen+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&
- https://finefinishesil.com/wp-includes/js/jquery/jquery.js?ver=1.12.4
- https://finefinishesil.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
- https://finefinishesil.com/wp-content/plugins/rich-reviews/js/rich-reviews.min.js?ver=4.9.18
- https://api.w.org/
- https://finefinishesil.com/wp-json/
- https://finefinishesil.com/xmlrpc.php?rsd
- https://finefinishesil.com/wp-includes/wlwmanifest.xml
Embedded domains
- schema.org
- gmpg.org
- fonts.googleapis.com
- s.w.org
- finefinishesil.com
- api.w.org
- a.site
- site-header.top
- www.youtube.com
- www.w3.org
- www.facebook.com
- www.instagram.com
- lobbydesires.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report