MALICIOUS — aa76cad4e56bc0df1ffdd2b7e079dac9491d27273192d35efca7bee35ac06c4e

MALICIOUS — aa76cad4e56bc0df1ffdd2b7e079dac9491d27273192d35efca7bee35ac06c4e is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the Phonzy family. 1 of 54 detection engines flagged it.

Identification

SHA-256: aa76cad4e56bc0df1ffdd2b7e079dac9491d27273192d35efca7bee35ac06c4e
SHA-1: 9d5ef74278d3161d3a01e8b754bdb32b48ea2fc9
MD5: e9367218cb92b7a043f2ad09ccc5ab78
ssdeep: 768:rpIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7S44R:rpIRIOITIwIgIiKZgNDfIwIGI5IVJ7Sr
TLSH: T15E30F88637AA8E85D5DC678781E44D0078D6AE4B1533DCE9806DE7F0786FB601098B8F
Submitted as: aa76cad4e56bc0df1ffdd2b7e079dac9491d27273192d35efca7bee35ac06c4e
File type: html · Size: 38157 bytes
Verdict: malicious (84/100) · Family: Phonzy

Detections (1 of 54 engines)

Microsoft Defender: Trojan:Script/Phonzy.A!ml

Why this verdict

The malicious score of 84/100 is the fusion of 6 weighted signals:

Microsoft Defender flagged Trojan:Script/Phonzy.A!ml (rule Trojan:Script/Phonzy.A!ml) - engine signal, weight 0.55, confidence 0.85
Obfuscated javascript script: dynamic-exec (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 1 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://ogp.me/ns/fb#, http://www.irismonument.be/570.streets.10401158_W07.JPG, http://www.africamuseum.be/about-us/img/congoleesdorp2 - static signal, weight 0.35, confidence 0.60
Extracted generic config (4 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

279 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://ogp.me/ns/fb#
http://www.irismonument.be/570.streets.10401158_W07.JPG
http://www.africamuseum.be/about-us/img/congoleesdorp2
http://www.culturamavzw.be/fileadmin/user_upload/AT/triomfboog_vlag_.jpg
http://alexfile604.weebly.com/1/post/2017/01/koning-leopold-ii-op-de-tentoonstelling-in-tervuren-1897.html
https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
https://www.google.com/recaptcha/api.js
https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js
http://twitter.com/share?url=http://alexfile604.weebly.com/1/post/2017/01/koning-leopold-ii-op-de-tentoonstelling-in-tervuren-1897.html
http://alexfile604.weebly.com/blog/koning-leopold-ii-op-de-tentoonstelling-in-tervuren-1897&is_mobile=&r=3&is_light=1
https://www.weebly.com/signup?utm_source=internal&utm_medium=footer
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

ogp.me
www.irismonument.be
www.africamuseum.be
www.culturamavzw.be
alexfile604.weebly.com
cdn2.editmysite.com
fonts.googleapis.com
cdn1.editmysite.com
ajax.googleapis.com
www.weebly.com
www.google.com
twitter.com
google-analytics.com
test.name
ec.editmysite.com
connect.facebook.net
tter.com

Embedded IP addresses

20.42.73.27
52.230.59.222
4.230.171.124
52.182.143.212
52.110.12.38
52.110.12.16
40.84.97.4
40.84.85.40
72.153.5.134
52.148.114.188
52.110.12.44

More Phonzy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report