MALICIOUS — b1c39147e289079f0891640c1d70b1b5f98d8c484016eee30b2036213eaec557
MALICIOUS — b1c39147e289079f0891640c1d70b1b5f98d8c484016eee30b2036213eaec557 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 3 of 54 detection engines flagged it.
Identification
- SHA-256:
b1c39147e289079f0891640c1d70b1b5f98d8c484016eee30b2036213eaec557 - SHA-1:
73dd36c865b52fa528d0fdb27779b8b92fb575b5 - MD5:
be26e7c4436c42fcc63cbb1f361d23d9 - ssdeep:
3072:pXci1+YMRBdUDc25lr7yhsOwAf/nyPmpaGc757ZtoctISwP1n1ckBBHGE/B9:pXci1+YMRBdUDc25lvyhsOwAf/nyfZz+ - TLSH:
T1DC41DF287F5F7F8630A0D917A5D40A9382D38237BA3BD4F5E563376151A0DA6AD0E803 - Submitted as: b1c39147e289079f0891640c1d70b1b5f98d8c484016eee30b2036213eaec557
- File type: html · Size: 187337 bytes
- Verdict: malicious (99/100)
Detections (3 of 54 engines)
- ClamAV (daily): Html.Exploit.Agent-6598769-0
- Microsoft Defender: TrojanClicker:JS/Faceliker.A
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 99/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Html.Exploit.Agent-6598769-0 (rule
Html.Exploit.Agent-6598769-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged TrojanClicker:JS/Faceliker.A (rule
TrojanClicker:JS/Faceliker.A) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://ialcars.blogspot.com/favicon.ico, http://ialcars.blogspot.com/feeds/posts/default - static signal, weight 0.35, confidence 0.60
- Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
288 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- officeclient.microsoft.com
- www.msn.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
Embedded URLs
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://ialcars.blogspot.com/2011/12/2012-ford-fusion.html
- http://ialcars.blogspot.com/favicon.ico
- http://ialcars.blogspot.com/feeds/posts/default
- http://ialcars.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/4726179998866654911/posts/default
- http://ialcars.blogspot.com/feeds/4115962868909648243/comments/default
- http://1.bp.blogspot.com/-h71LIwwR94g/Tp-bgBMARFI/AAAAAAAAErg/4gvs4ixg9Bk/s320/00068-21-2012-Ford-Fusion.jpg
- http://1.bp.blogspot.com/-h71LIwwR94g/Tp-bgBMARFI/AAAAAAAAErg/4gvs4ixg9Bk/w1200-h630-p-k-no-nu/00068-21-2012-Ford-Fusion.jpg
- http://visitthinknext.com/
- http://1.bp.blogspot.com/-WsvyIFhf92g/UYxts6tPL4I/AAAAAAAAJRE/jP8bNeUjFLg/s000/search_32x32-32.png
- http://1.bp.blogspot.com/-xyeOtoNgPoE/UYxtuVn4k2I/AAAAAAAAJRM/t1VqDJ_6P-s/s000/twitter_bird.png
- http://2.bp.blogspot.com/-DGAsYU4zLTc/UYxtwmuGooI/AAAAAAAAJRU/IP26z8wURDI/s000/facebook.png
- http://3.bp.blogspot.com/-I2_n8V1vWRs/UYxtyd3EOnI/AAAAAAAAJRc/3d34HwCDyPg/s000/rss.png
- http://fonts.googleapis.com/css?family=Open+Sans
- http://w.sharethis.com/button/buttons.js
- http://code.jquery.com/jquery-1.10.2.min.js
- http://1.bp.blogspot.com/-o93us1UFU5E/Ue-X5xK0i4I/AAAAAAAAAPs/OB3h007Wuts/s798/idool%255B1%255D.png
- https://www.blogger.com/dyn-css/authorization.css?targetBlogID=4726179998866654911&
- http://ialcars.blogspot.com/
- http://feeds.feedburner.com/YOUR_USERNAME
- http://twitter.com/YOUR_USERNAME
- http://www.facebook.com/YOUR_USERNAME
- http://ialcars.blogspot.com/search/
- http://ialcars.blogspot.com/search/label/Ford
Embedded domains
- www.blogger.com
- blogspot.com
- ialcars.blogspot.com
- 1.bp.blogspot.com
- visitthinknext.com
- djogzs.blogspot.com
- 2.bp.blogspot.com
- 3.bp.blogspot.com
- fonts.googleapis.com
- w.sharethis.com
- code.jquery.com
- feeds.feedburner.com
- twitter.com
- www.facebook.com
- img2.blogblog.com
- 4.bp.blogspot.com
- www.autoblog.com
- www.theophiluschin.com
- apis.google.com
- www.beckerlemedia.com
- blogger.com
- ads.clicksor.com
- www.yesadvertising.com
- www.blogblog.com
- x1.c.lencr.org
Embedded IP addresses
- 20.42.73.24
- 4.230.171.124
- 52.230.60.54
- 48.211.4.16
- 40.84.85.40
- 74.179.77.204
- 74.178.76.54
- 4.207.44.72
- 20.42.65.91
- 40.84.97.4
- 162.159.142.9
- 72.145.35.111
- 52.110.12.38
- 52.110.12.51
- 52.148.114.188
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report