MALICIOUS — ac92000ccf8301625e2ee51bb8b5c47fb5cf063ec84a195a84146542086a3132
MALICIOUS — ac92000ccf8301625e2ee51bb8b5c47fb5cf063ec84a195a84146542086a3132 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (85/100). 2 of 54 detection engines flagged it.
Identification
- SHA-256:
ac92000ccf8301625e2ee51bb8b5c47fb5cf063ec84a195a84146542086a3132 - SHA-1:
3a7a3be6046058d99334eb6fb980956c47667b70 - MD5:
fc4e230cceefce1d46a0d6dbf0b03783 - ssdeep:
48:DJNplR8u879C3yRPMIBPMLDgYCgr93nyd7voEzS3Sm:17H8Z+M0U0Jrpnc1zS3Sm - TLSH:
T1B414FD9F93A11F76C0A801A501ACC8A14BC3B63F1B546972CEFECD95888C0F2E4A0576 - Submitted as: ac92000ccf8301625e2ee51bb8b5c47fb5cf063ec84a195a84146542086a3132
- File type: html · Size: 1581 bytes
- Verdict: malicious (85/100)
Detections (2 of 54 engines)
- Microsoft Defender: Trojan:HTML/Phishing.NC!MTB
- Emsisoft (Emergency Kit): Generic.HTML.Phishing.O.552FA3F5
Why this verdict
The malicious score of 85/100 is the fusion of 5 weighted signals:
- Microsoft Defender flagged Trojan:HTML/Phishing.NC!MTB (rule
Trojan:HTML/Phishing.NC!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Generic.HTML.Phishing.O.552FA3F5 (rule
Generic.HTML.Phishing.O.552FA3F5) - engine signal, weight 0.55, confidence 0.85 - Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: http://petstop.com.sg/google_analytics_auto.js - static signal, weight 0.35, confidence 0.60
- Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
278 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- windows.msn.com
- odc.officeapps.live.com
- www.msn.com
- assets.msn.com
- www.bing.com
- settings-win.data.microsoft.com
- edge.microsoft.com
- time.windows.com
- geo.prod.do.dsp.mp.microsoft.com
Embedded URLs
- http://petstop.com.sg/google_analytics_auto.js
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- petstop.com.sg
Embedded IP addresses
- 52.168.117.169
- 20.247.185.124
- 4.230.171.124
- 40.84.97.4
- 40.84.85.40
- 52.110.12.44
- 52.148.114.188
- 52.110.12.24
- 72.145.35.97
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report