SUSPICIOUS — a3b19300725028649baf4dbb8bda65557a880c56459399183f88c18c3721c63c

SUSPICIOUS — a3b19300725028649baf4dbb8bda65557a880c56459399183f88c18c3721c63c is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: a3b19300725028649baf4dbb8bda65557a880c56459399183f88c18c3721c63c
• SHA-1: 311378e8ee7f30451a1fa02b59d62b8c11429757
• MD5: edc07ffdc2245d44fd9aabca10bce54a
• ssdeep: 768:BcqRytxE4k41qvYY1WRZmmyQ1NMxzQ7raN6ue7ehgd6DGR0FqLwj6Z74J2ImXpCv:BDRA0F1zM/c1mYb6w1SVZao9Nhe6b+
• TLSH: T1B736D8E17842DCEC88160AE33D591F1BBB1E7A12396409F946B8C7D54DB7ED12888C9C
• Submitted as: a3b19300725028649baf4dbb8bda65557a880c56459399183f88c18c3721c63c
• File type: script · Size: 67642 bytes
• Verdict: suspicious (54/100)

Detections (2 of 50 engines)

• Microsoft Defender: Trojan:JS/Agent.AG!MSR
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://getbootstrap.com/, https://popper.js.org/ - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://getbootstrap.com/
• https://github.com/twbs/bootstrap/graphs/contributors
• https://github.com/twbs/bootstrap/blob/master/LICENSE
• https://popper.js.org/

Embedded domains

• getbootstrap.com
• github.com
• t.to
• e.to
• popper.js.org
• this.constructor.name
• wedrivers.ca

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report