SUSPICIOUS — a4721e51de2d7dea5212016ddd8c03564c21dbaf9d283bafa1b7fa3904ecfd0e
SUSPICIOUS — a4721e51de2d7dea5212016ddd8c03564c21dbaf9d283bafa1b7fa3904ecfd0e is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 50 detection engines flagged it.
Identification
- SHA-256:
a4721e51de2d7dea5212016ddd8c03564c21dbaf9d283bafa1b7fa3904ecfd0e - SHA-1:
027ef8a7e42dc96b6906f19651b561a887fb7875 - MD5:
1f6c5468cdead8ab8f8340afadba53e2 - ssdeep:
3072:XIRYZsvsYNxsRsDuVxI1XGbnD3r8AxH9d9HDNX1oBFIiD/F3fkv5Djzd:W85Djx - TLSH:
T193484F0443176ECF8BD98C0DF5480DAE941DF6EF9A24A0F15B81DF9CA42AD71E4AB142 - Submitted as: a4721e51de2d7dea5212016ddd8c03564c21dbaf9d283bafa1b7fa3904ecfd0e
- File type: html · Size: 384385 bytes
- Verdict: suspicious (54/100)
Detections (1 of 50 engines)
- Microsoft Defender: Trojan:JS/Redirector.AD!AMTB
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec (layers: base64+concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://www.121signs.com/media/favicon/default/LOGO_121_1.png, https://www.121signs.com/js/blank.html, https://www.121signs.com/js/spacer.gif - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd
- http://www.w3.org/1999/xhtml
- https://www.121signs.com/media/favicon/default/LOGO_121_1.png
- https://www.121signs.com/js/blank.html
- https://www.121signs.com/js/spacer.gif
- https://www.121signs.com/js/calendar/calendar-win2k-1.css
- https://www.121signs.com/js/belvg/jquery/cloud-zoom/cloud-zoom.css
- https://www.121signs.com/js/belvg/jquery/fancybox/fancybox-2.1.5/jquery.fancybox.css
- https://www.121signs.com/js/belvg/jquery/fancybox/fancybox-2.1.5/helpers/jquery.fancybox-buttons.css
- https://www.121signs.com/js/belvg/jquery/fancybox/fancybox-2.1.5/helpers/jquery.fancybox-thumbs.css
- https://www.121signs.com/skin/frontend/default/default/css/styles.css
- https://www.121signs.com/skin/frontend/base/default/css/widgets.css
- https://www.121signs.com/skin/frontend/default/121signs/css/owl.carousel.css
- https://www.121signs.com/skin/frontend/default/121signs/css/signs.css
- https://www.121signs.com/skin/frontend/default/121signs/css/responsive.css
- https://www.121signs.com/skin/frontend/default/121signs/css/add.css
- https://www.121signs.com/skin/frontend/base/default/ced_sociallogin/google/css/button.css
- https://www.121signs.com/skin/frontend/base/default/ced_sociallogin/linkedin/css/button.css
- https://www.121signs.com/skin/frontend/default/121signs/ajaxminicart/ajaxcart.css
- https://www.121signs.com/skin/frontend/default/121signs/css/magestore/bannerslider/popup.css
- https://www.121signs.com/skin/frontend/default/121signs/css/mirasvit/searchautocomplete/amazon.css
- https://www.121signs.com/skin/frontend/default/121signs/css/mirasvit_searchindex.css
- https://www.121signs.com/skin/frontend/default/121signs/ves_vendors/checkout/styles.css
- https://www.121signs.com/skin/frontend/base/default/css/dailydeal.css
- https://www.121signs.com/skin/frontend/default/121signs/js/amasty/amconf/css/tooltipster.css
Embedded domains
- www.w3.org
- 121signs.com
- www.121signs.com
- google-analytics.com
- schema.org
- www.linkedin.com
- accounts.google.com
- 570485591896-p7ahfn2irt7jnqv1op5bhilbb0oi5i95.apps.googleusercontent.com
- what-is-121signs.com
- www.qoo10.sg
- www.chnservices.com.sg
- www.magentocommerce.com
- v2.zopim.com
- www.googleadservices.com
- googleads.g.doubleclick.net
- www.google-analytics.com
- 8words.xyz
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report