MALICIOUS — a8014f423457233312fb2ad71266eba9a727909a859916859353eafe8c12a9d2
MALICIOUS — a8014f423457233312fb2ad71266eba9a727909a859916859353eafe8c12a9d2 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the FKLR family. 1 of 54 detection engines flagged it.
Identification
- SHA-256:
a8014f423457233312fb2ad71266eba9a727909a859916859353eafe8c12a9d2 - SHA-1:
b7d1be68615550ac4bd31cd78ed96c5f7673587c - MD5:
123be52934cbcd391db84150845ba84d - ssdeep:
1536:e4ECBz59R+SdFIQVmN6N2JxNONANVNmN7NJNbNwRxS9:dB99EST/mN6N2JxNONANVNmN7NJNbNwi - TLSH:
T1E739A31AA1F47D4F424554CE6094164D8DA6ACFF7022B0ED9EE88F87489CFA2F439463 - Submitted as: a8014f423457233312fb2ad71266eba9a727909a859916859353eafe8c12a9d2
- File type: html · Size: 85916 bytes
- Verdict: malicious (84/100) · Family: FKLR
Detections (1 of 54 engines)
- Emsisoft (Emergency Kit): Trojan.Agent.FKLR
Why this verdict
The malicious score of 84/100 is the fusion of 6 weighted signals:
- Emsisoft (Emergency Kit) flagged Trojan.Agent.FKLR (rule
Trojan.Agent.FKLR) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://1.bp.blogspot.com/-WyZwYgWIfLw/YYypVctsP_I/AAAAAAAABUE/NF_otXBlBGIcRsH-qL1jpGKcU1TOnfx1QCLcBGAsYHQ/s16000/og.jpg, https://abb-bank.az/en, https://cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js - static signal, weight 0.35, confidence 0.60
- Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
279 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- login.live.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- licensing.mp.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- fe3cr.delivery.mp.microsoft.com
- settings-win.data.microsoft.com
- v10.events.data.microsoft.com
Embedded URLs
- https://1.bp.blogspot.com/-WyZwYgWIfLw/YYypVctsP_I/AAAAAAAABUE/NF_otXBlBGIcRsH-qL1jpGKcU1TOnfx1QCLcBGAsYHQ/s16000/og.jpg
- https://abb-bank.az/en
- https://cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js
- https://cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js
- https://cdn.jsdelivr.cc/npm/sweetalert2@10.16.0/dist/sweetalert2.all.min.js
- https://cdn.jsdelivr.cc/npm/lazyload@2.0.0-rc.2/lazyload.min.js
- https://cdn.jsdelivr.cc/npm/popper.js@1.16.1/dist/umd/popper.min.js
- https://cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css
- https://1.bp.blogspot.com/-2FAkGnDCWR4/YYypVbQ2m9I/AAAAAAAABUU/01-yGqtogZggGu7dgMnVZkeO2r1tNT6FgCLcBGAsYHQ/s16000/fav.jpg
- https://www.googletagmanager.com/gtag/js?id=G-1R9F3H2MHD
- https://1.bp.blogspot.com/-TrFW9TY7jLU/YYypVaAYASI/AAAAAAAABUA/Re8psAjTCAsVtWWttDcGhorXaSzjfJwpQCLcBGAsYHQ/s16000/left.jpg
- https://1.bp.blogspot.com/-kvRHT4-fMh0/YYypVdWMeJI/AAAAAAAABUI/GZAyr_dp7BMwvmHpKMGHZoybs07xga91ACLcBGAsYHQ/s16000/right.jpg
- https://1.bp.blogspot.com/-swKdIbaG6mA/YYypVYwwmEI/AAAAAAAABUQ/JEbJSNHJY8IG5fG-ZzJgSI5ByXlItUBBgCLcBGAsYHQ/s16000/show.jpg
- https://1.bp.blogspot.com/-muNdymRwkwM/YYypVbEUcLI/AAAAAAAABUM/g-UazUWvQaM_dEEMu_WKUmitUqkcZ-TCwCLcBGAsYHQ/s16000/show2.jpg
- https://1.bp.blogspot.com/-tgdyzabxuJ4/YKpjmQ_UJKI/AAAAAAAABfk/VqO0bIY6vq0EZ9BvCyHwfUT8owQt7dzWwCLcBGAsYHQ/s16000/United-States_outbox.png
- https://1.bp.blogspot.com/-0txA7_j4j7U/YOljJ3X_nAI/AAAAAAAACM0/SLeI287PqMINCf-zv3NZqN_1wpPnnqfqQCLcBGAsYHQ/s16000/box1.png
- https://1.bp.blogspot.com/-6RBY_FwbBKs/YOljJxa5dbI/AAAAAAAACMw/_C9L75FtOBcH3_C7YpfPJIiUlSv0OLwBQCLcBGAsYHQ/s16000/box2.png
- https://1.bp.blogspot.com/-RC32duKA6Wo/YKpjmBkVOEI/AAAAAAAABfg/PraKjCk35xQl-wrsLztkUt-VUrh547z7wCLcBGAsYHQ/s16000/United-States_inbox.png
- https://1.bp.blogspot.com/-yTXh4bzpmdo/YOljKmROY2I/AAAAAAAACM4/GPtpik1-snUZn4UGa2HcasabC_9183b_ACLcBGAsYHQ/s16000/box3.png
- https://uprimp.com/bnr.php?section=General&pub=593174&format=300x50&ga=g
- https://1.bp.blogspot.com/--4xBHLsL3tA/YUXMy7E1DwI/AAAAAAAAGQE/8KCEBCxsgp86kzYqjbF4aQG09RyKfS6wQCLcBGAsYHQ/s0/126213603_730552200891932_8097881791719697756_n.jpg
- https://1.bp.blogspot.com/-CetoSX8poj4/YUXM0WHyp3I/AAAAAAAAGQQ/kogGnftLjBEN1XFomQbodpCRCszyvfg_QCLcBGAsYHQ/s320/64624200_158106888575197_5775058187782717440_n.jpg
- https://1.bp.blogspot.com/-l3sDVMxD0Ck/YUXMy30hWjI/AAAAAAAAGQA/prHIBy8bH3g3-FQQpFnyKHMO8vbJ3l_mACLcBGAsYHQ/s320/157925570_133306992030166_7501703254048777350_n.jpg
- https://1.bp.blogspot.com/-HnoOSyA0Ss4/YUXMzNHnduI/AAAAAAAAGQI/2-0ew8Nipt4KRSAIRlrKSFQ2yRutpLQmwCLcBGAsYHQ/s320/139560249_1134848683635296_1242912194971943727_n.jpg
- https://1.bp.blogspot.com/-v4PobNUDJqo/YUXMzwngEQI/AAAAAAAAGQM/Y5gAMJiDQZcaR0oxqSgbqZIwcpwT4g4GQCLcBGAsYHQ/s320/59733536_602692060206598_1708515965756506112_n.jpg
Embedded domains
- 1.bp.blogspot.com
- cdn.jsdelivr.cc
- www.googletagmanager.com
- c.top
- benfly.net
- uprimp.com
- v.gapis.xyz
- www.w3.org
- hm.baidu.com
- abb-bank.az
Embedded IP addresses
- 41.17.79.44
- 4.150.223.106
- 52.123.252.231
- 20.247.184.197
- 4.230.171.124
- 20.165.94.54
- 4.247.188.224
- 74.178.76.128
- 52.168.117.171
- 92.223.78.30
- 72.154.7.103
- 52.148.114.188
- 52.110.12.3
- 52.110.12.19
More FKLR samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report