MALICIOUS — af308ff0e19f7abf4e36bb50b87c7b52af5662012b673e706a05ae2803b9fe7f
MALICIOUS — af308ff0e19f7abf4e36bb50b87c7b52af5662012b673e706a05ae2803b9fe7f is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the FKLR family. 1 of 53 detection engines flagged it.
Identification
- SHA-256:
af308ff0e19f7abf4e36bb50b87c7b52af5662012b673e706a05ae2803b9fe7f - SHA-1:
8a1ffc3840148cd07f5cbbc1e04d01d630b34250 - MD5:
29f04c474742936924a743fbbc9b4681 - ssdeep:
1536:JIza9mSqYQlmN6N2JxNONANVNmN7NJNbN/VTSQQ:JIW9mSqfmN6N2JxNONANVNmN7NJNbN/K - TLSH:
T1A639A416A5F07D4F468594CE6090125D8CA5ADFF7423B0ED9AE49F87489CFA2F839023 - Submitted as: af308ff0e19f7abf4e36bb50b87c7b52af5662012b673e706a05ae2803b9fe7f
- File type: html · Size: 86830 bytes
- Verdict: malicious (84/100) · Family: FKLR
Detections (1 of 53 engines)
- Emsisoft (Emergency Kit): Trojan.Agent.FKLR
Why this verdict
The malicious score of 84/100 is the fusion of 5 weighted signals:
- Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule
windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 28 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://1.bp.blogspot.com/-90EkAEfM5pY/YVMwdQETORI/AAAAAAAAG6k/O4ZQ3Hej0wEb8ayzlN8wpIDJf6oQ9idkQCLcBGAsYHQ/s16000/ogog.jpg, https://www.rbs.co.uk/, https://cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js - static signal, weight 0.35, confidence 0.60
- Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
279 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
Dropped files
- 2200e1f793ca4018d4ba4c420bf1a6efe4fb2e837a7464bb9eed89015ab14159 -
2200e1f793ca4018d4ba4c420bf1a6efe4fb2e837a7464bb9eed89015ab14159
Embedded URLs
- https://1.bp.blogspot.com/-90EkAEfM5pY/YVMwdQETORI/AAAAAAAAG6k/O4ZQ3Hej0wEb8ayzlN8wpIDJf6oQ9idkQCLcBGAsYHQ/s16000/ogog.jpg
- https://www.rbs.co.uk/
- https://cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js
- https://cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js
- https://cdn.jsdelivr.cc/npm/sweetalert2@10.16.0/dist/sweetalert2.all.min.js
- https://cdn.jsdelivr.cc/npm/lazyload@2.0.0-rc.2/lazyload.min.js
- https://cdn.jsdelivr.cc/npm/popper.js@1.16.1/dist/umd/popper.min.js
- https://cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css
- https://1.bp.blogspot.com/-C9avt6KEcPE/YVMscxaT5ZI/AAAAAAAAG50/li87GmYDZq04p5vRQeUCLD8Gsb2-fNpggCLcBGAsYHQ/s16000/favicon.jpg
- https://www.googletagmanager.com/gtag/js?id=G-J1FCZZMQR1
- https://1.bp.blogspot.com/-TlXAMJpmySI/YVMsdqtYnmI/AAAAAAAAG58/B37SPCcSTj09fyRlIcqOwwmQ6tqQ9Yt2QCLcBGAsYHQ/s16000/hekss.png
- https://1.bp.blogspot.com/-LY7fBBooOKc/YVMsc2u4AaI/AAAAAAAAG54/Gr7Nw3DwRccpjzhK3ff_Hr9Lw_q5GoiPQCLcBGAsYHQ/s16000/headdd.png
- https://1.bp.blogspot.com/-NwusXPgQ5XM/YVMsc51gf_I/AAAAAAAAG5w/yzxDwUu9EIARvfQzgLq1nMHfHqfGrqfVQCLcBGAsYHQ/s16000/heabbb.png
- https://1.bp.blogspot.com/-k1eTFj_gksc/YVMseIFZxxI/AAAAAAAAG6A/76ryosglwMgBdcJRxTDwi-nN5vnfeAdRgCLcBGAsYHQ/s16000/img.jpg
- https://1.bp.blogspot.com/-M7uLQ0VmF9M/YVMsePK-0MI/AAAAAAAAG6E/u_a8yynJHYQp4BSRiDb2waiNsR8w_FOsgCLcBGAsYHQ/s16000/logo.jpg
- https://1.bp.blogspot.com/-Zvz8MUJhQd8/YKsjY50KasI/AAAAAAAABgs/o_EK8ZiVbMQao5jkfesk20OrHxWDf8PGgCLcBGAsYHQ/s16000/Canada_outbox.png
- https://1.bp.blogspot.com/-25dvO3vfH4k/YUVqT8QYRGI/AAAAAAAAGK4/X1kluIyGrkYob5sWGI649A0LD991xBXugCLcBGAsYHQ/s16000/box1.png
- https://1.bp.blogspot.com/-qHMAzIhHnW4/YUVo-vs14TI/AAAAAAAAGKU/qcWLOR_AkVsTQQmm05QPB66EeoCVCsligCLcBGAsYHQ/s16000/box2.png
- https://1.bp.blogspot.com/-d21zH2LJidk/YKsjYotdIwI/AAAAAAAABgo/_cIc6G5N84QjTpb3BnAR1i2Ft0lxhEO0wCLcBGAsYHQ/s16000/Canada_inbox.png
- https://1.bp.blogspot.com/-LzmdlQ3vUso/YUVo-zx_qII/AAAAAAAAGKY/5XIqkhJD8V8duK-SoiidhBQZnSTBKZqPwCLcBGAsYHQ/s16000/box3.png
- https://uprimp.com/bnr.php?section=General&
- https://1.bp.blogspot.com/--4xBHLsL3tA/YUXMy7E1DwI/AAAAAAAAGQE/8KCEBCxsgp86kzYqjbF4aQG09RyKfS6wQCLcBGAsYHQ/s0/126213603_730552200891932_8097881791719697756_n.jpg
- https://1.bp.blogspot.com/-CetoSX8poj4/YUXM0WHyp3I/AAAAAAAAGQQ/kogGnftLjBEN1XFomQbodpCRCszyvfg_QCLcBGAsYHQ/s320/64624200_158106888575197_5775058187782717440_n.jpg
- https://1.bp.blogspot.com/-l3sDVMxD0Ck/YUXMy30hWjI/AAAAAAAAGQA/prHIBy8bH3g3-FQQpFnyKHMO8vbJ3l_mACLcBGAsYHQ/s320/157925570_133306992030166_7501703254048777350_n.jpg
- https://1.bp.blogspot.com/-HnoOSyA0Ss4/YUXMzNHnduI/AAAAAAAAGQI/2-0ew8Nipt4KRSAIRlrKSFQ2yRutpLQmwCLcBGAsYHQ/s320/139560249_1134848683635296_1242912194971943727_n.jpg
Embedded domains
- 1.bp.blogspot.com
- www.rbs.co.uk
- cdn.jsdelivr.cc
- www.googletagmanager.com
- c.top
- benfly.net
- uprimp.com
- v.gapis.xyz
- www.w3.org
- hm.baidu.com
Embedded IP addresses
- 41.17.79.44
- 20.50.201.195
- 57.154.63.210
- 4.230.171.124
- 172.215.188.232
- 52.253.84.76
- 20.165.94.63
- 135.232.92.97
- 51.132.193.104
- 135.233.95.144
- 20.112.250.133
- 52.123.128.14
- 52.123.129.14
- 172.178.240.161
- 203.26.79.13
- 135.232.92.34
- 162.159.142.9
- 52.148.114.188
- 48.192.143.121
- 20.52.64.201
- 72.153.5.140
- 20.42.73.30
- 20.42.179.204
- 20.184.175.16
- 4.150.223.101
More FKLR samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report