MALICIOUS — af088a66e5f53eda956ebdd8c023a313fb48a792c314f33133e8b7d1727ea25e
MALICIOUS — af088a66e5f53eda956ebdd8c023a313fb48a792c314f33133e8b7d1727ea25e is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the Wacatac family. 1 of 54 detection engines flagged it.
Identification
- SHA-256:
af088a66e5f53eda956ebdd8c023a313fb48a792c314f33133e8b7d1727ea25e - SHA-1:
a881f81831b48d28aad82aa0ddb5521a0e69ad78 - MD5:
30b95c054e6e444c78caf5b80c7249e7 - ssdeep:
1536:EFIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7S4Rg:sRp+zPBjQ9nN0zTwt6b5fvstgL - TLSH:
T1613CE8866BE68FF15BCADE4041C56C343CA0B80A59617C5769ACDA80BCBBBD470046DF - Submitted as: af088a66e5f53eda956ebdd8c023a313fb48a792c314f33133e8b7d1727ea25e
- File type: html · Size: 117517 bytes
- Verdict: malicious (84/100) · Family: Wacatac
Detections (1 of 54 engines)
- Microsoft Defender: Trojan:Script/Wacatac.B!ml
Why this verdict
The malicious score of 84/100 is the fusion of 6 weighted signals:
- Microsoft Defender flagged Trojan:Script/Wacatac.B!ml (rule
Trojan:Script/Wacatac.B!ml) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: http://ogp.me/ns/fb#, http://www.chestermachinetools.com/ekmps/shops/juliechuk2/images/bristol-vs-br-variable-speed-lathe-4035-p.jpg, http://www.anticsonline.co.uk/l.aspx?k=1036969 - static signal, weight 0.35, confidence 0.60
- Extracted generic config (11 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
280 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- desktop-hsgcbep
- login.live.com
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
Embedded URLs
- http://ogp.me/ns/fb#
- http://www.chestermachinetools.com/ekmps/shops/juliechuk2/images/bristol-vs-br-variable-speed-lathe-4035-p.jpg
- http://www.anticsonline.co.uk/l.aspx?k=1036969
- http://www.cwplant.co.uk/wp-content/uploads/2015/01/VOLVO-IMAGE-940x385.jpg
- http://i00.i.aliimg.com/img/pb/403/809/613/613809403_622.jpg
- http://coosanbound.strefa.pl/images/photo/kim-kardashian-4538748.jpg
- http://www.dieselbarracuda.com/data/articles/Kim_Kardashian_Sketch.jpg
- http://www.onlineservicemanagementsoftware.com/images/screenshots/customer-sales-order-search.jpg
- http://www.configur8or.com/Media/ExampleProducts/Catering/fastfoodonline/fastfoodburgerproduct.jpg
- http://bluechillies.com/graphics/screens/Bytescout_BarCode_Generator_SDK-201964.gif
- https://depts.washington.edu/foster/wp-content/uploads/2015/10/rankings_oct20.png
- http://nationsoftware.weebly.com/
- https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
- http://nationsoftware.weebly.com/blog/power-tool-shops-in-bristol
- http://nationsoftware.weebly.com/blog/power-tool-shops-in-bristol#comments
- https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js
- http://nationsoftware.weebly.com/1/post/2016/12/power-tool-shops-in-bristol.html
- http://twitter.com/share?url=http://nationsoftware.weebly.com/1/post/2016/12/power-tool-shops-in-bristol.html
- http://nationsoftware.weebly.com/blog/jin-ding-power-tools
- http://nationsoftware.weebly.com/blog/jin-ding-power-tools#comments
- http://nationsoftware.weebly.com/1/post/2016/12/jin-ding-power-tools.html
- http://twitter.com/share?url=http://nationsoftware.weebly.com/1/post/2016/12/jin-ding-power-tools.html
- http://nationsoftware.weebly.com/blog/kim-kardashian-rapidshare
- http://nationsoftware.weebly.com/blog/kim-kardashian-rapidshare#comments
- http://nationsoftware.weebly.com/1/post/2016/12/kim-kardashian-rapidshare.html
Embedded domains
- ogp.me
- www.chestermachinetools.com
- www.anticsonline.co.uk
- www.cwplant.co.uk
- i00.i.aliimg.com
- coosanbound.strefa.pl
- www.dieselbarracuda.com
- www.onlineservicemanagementsoftware.com
- www.configur8or.com
- bluechillies.com
- depts.washington.edu
- nationsoftware.weebly.com
- cdn2.editmysite.com
- fonts.googleapis.com
- cdn1.editmysite.com
- ajax.googleapis.com
- www.weebly.com
- twitter.com
- round1.com.br
- hotmail.com
- asp.net
- in.net
- simplest.net
- a.net
- www.businessadministrationinformation.com
Embedded IP addresses
- 20.184.175.2
- 4.230.171.124
- 20.247.184.142
- 172.66.2.5
- 52.110.12.47
- 52.110.12.20
- 57.154.63.210
- 4.150.223.103
- 92.223.78.30
- 4.207.44.70
- 40.84.97.4
- 72.145.35.101
- 52.148.114.188
- 52.110.12.11
- 52.110.12.48
More Wacatac samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report