MALICIOUS — a6d622955c2bab36867a9fd7ba0928d62a26e436b1c5155f186b64cc7e9459da
MALICIOUS — a6d622955c2bab36867a9fd7ba0928d62a26e436b1c5155f186b64cc7e9459da is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 3 of 54 detection engines flagged it.
Identification
- SHA-256:
a6d622955c2bab36867a9fd7ba0928d62a26e436b1c5155f186b64cc7e9459da - SHA-1:
e78e186eced47d3603c45f95722e040c2ec54b84 - MD5:
6bcabfd983368a069e2d5710084daf40 - ssdeep:
3072:lLOieCkUE6DGUcjvG8rMs14cJ1t8aNASwUTXddXEMhclT:lLOieCkUE6Dadt8aNAp - TLSH:
T1553D1C5736B03C8F48F85557699D0AC960DE89DBA83147E4E2B26F88E834C705D8C86F - Submitted as: a6d622955c2bab36867a9fd7ba0928d62a26e436b1c5155f186b64cc7e9459da
- File type: html · Size: 127072 bytes
- Verdict: malicious (99/100)
Detections (3 of 54 engines)
- ClamAV (daily): Win.Trojan.Crypt-291
- Microsoft Defender: TrojanDownloader:JS/Inor
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 99/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Crypt-291 (rule
Win.Trojan.Crypt-291) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged TrojanDownloader:JS/Inor (rule
TrojanDownloader:JS/Inor) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://fonts.googleapis.com/css?family=Oswald, http://fonts.googleapis.com/css?family=Marvel - static signal, weight 0.35, confidence 0.60
- Extracted generic config (8 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
280 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- desktop-hsgcbep
- login.live.com
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- windows.msn.com
- officeclient.microsoft.com
- www.msn.com
- odc.officeapps.live.com
- www.bing.com
- assets.msn.com
- settings-win.data.microsoft.com
- edge.microsoft.com
- ctldl.windowsupdate.com
- time.windows.com
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://fonts.googleapis.com/css?family=Oswald
- http://fonts.googleapis.com/css?family=Marvel
- http://fonts.googleapis.com/css?family=Play
- http://fonts.googleapis.com/css?family=Lobster
- http://fonts.googleapis.com/css?family=Shadows+Into+Light
- http://fonts.googleapis.com/css?family=Droid+Sans:bold
- http://fonts.googleapis.com/css?family=Droid+Serif:bold
- http://fonts.googleapis.com/css?family=Raleway:100
- http://mawardimasuraijambi.blogspot.com/favicon.ico
- http://mawardimasuraijambi.blogspot.com/2014/08/buku-pegangan-guru-matematika-kelas.html
- http://mawardimasuraijambi.blogspot.com/feeds/posts/default
- http://mawardimasuraijambi.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/750122639028910351/posts/default
- http://mawardimasuraijambi.blogspot.com/feeds/5134470833166824578/comments/default
- http://1.bp.blogspot.com/-TNtOylNJBCc/UkSRX1AC2cI/AAAAAAAAAAY/Nle6PE2j7Yw/s1600/wrapper.png
- http://1.bp.blogspot.com/-cH2qWn4QyKI/UkSRYzEmRII/AAAAAAAAAAg/hA7SbLUkZtg/s1600/outer-wrapper.png
- http://2.bp.blogspot.com/-Kbjm1XjtE_4/UccePlMnzxI/AAAAAAAAB6g/uVGw6MR6fdg/s1600/h2.jpg
- http://1.bp.blogspot.com/-3lNtLBgMe24/TymBqycue0I/AAAAAAAAC8U/g5MEdEJoWVU/s1600/post.png
- http://2.bp.blogspot.com/-MukJE3TVH4U/ThlGuAuWhhI/AAAAAAAAAYs/un2cfPTJyjM/s1600/postcont.png
- http://4.bp.blogspot.com/-6J8CUtCBbec/ThHXMg86LaI/AAAAAAAAAVs/KIoQ7g5m_Rk/s1600/sidebar.png
Embedded domains
- www.w3.org
- www.google.com
- www.blogger.com
- fonts.googleapis.com
- mawardimasuraijambi.blogspot.com
- www.deluxetemplates.net
- 1.bp.blogspot.com
- 2.bp.blogspot.com
- 4.bp.blogspot.com
- 3.bp.blogspot.com
- ajax.googleapis.com
- www.opensource.org
- www.gnu.org
- users.tpg.com.au
- jquery.malsup.com
- malsup.com
- blogspot.com
- apis.google.com
- pagead2.googlesyndication.com
- schema.org
- www.scribd.com
- resources.blogblog.com
- auth.name
- entry.link
- comment.link
Embedded IP addresses
- 199.167.134.163
- 96.44.147.234
- 178.159.0.11
- 103.28.148.18
- 31.193.140.14
- 202.58.243.252
- 202.129.186.43
- 20.42.65.89
- 52.230.60.54
- 52.123.252.197
- 4.230.171.124
- 20.42.179.204
- 85.210.196.11
- 72.153.5.137
- 52.148.114.188
- 92.223.78.30
- 52.110.12.55
- 52.110.12.11
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report