SUSPICIOUS — b322a0759ac785bdf46e882d418225d84094ddbc459f1f3bbd2ebcda90f0398a

SUSPICIOUS — b322a0759ac785bdf46e882d418225d84094ddbc459f1f3bbd2ebcda90f0398a is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 53 detection engines flagged it.

Identification

SHA-256: b322a0759ac785bdf46e882d418225d84094ddbc459f1f3bbd2ebcda90f0398a
SHA-1: 87526d41837dd2c0b20283506c77943fee2d9160
MD5: 9c2027c384aa2358fac75522754f99ef
ssdeep: 768:pIRIOITIwIgIBKZgNDfIwIGI5I0J7S8IRIOITIwIgIfKZgNDfIwIGI5ILJ7SI1CZ:pIRIOITIwIgIBKZgNDfIwIGI5I0J7S8Z
TLSH: T15C324245AE878D8E908B155C92520FC0B499ED0A00D2DBDBE0E48E6FDE5F710D2AD4DB
Submitted as: b322a0759ac785bdf46e882d418225d84094ddbc459f1f3bbd2ebcda90f0398a
File type: html · Size: 47026 bytes
Verdict: suspicious (54/100)

Detections (2 of 53 engines)

Microsoft Defender: Trojan:HTML/Phish.B!atmn
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 54/100 is the fusion of 4 weighted signals:

Obfuscated javascript script: dynamic-exec, defense-evasion (layers: char-code+concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 27 external host(s) at runtime (17 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://ogp.me/ns/fb#, http://gadgetspassl.weebly.com/uploads/1/2/7/4/127469754/845674848_orig.jpg, http://gadgetspassl.weebly.com/uploads/1/2/7/4/127469754/858987030_orig.jpg - static signal, weight 0.35, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

277 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://ogp.me/ns/fb#
http://gadgetspassl.weebly.com/uploads/1/2/7/4/127469754/845674848_orig.jpg
http://gadgetspassl.weebly.com/uploads/1/2/7/4/127469754/858987030_orig.jpg
http://gadgetspassl.weebly.com/uploads/1/2/7/4/127469754/629489749_orig.jpg
http://gadgetspassl.weebly.com/2/post/2020/09/westinghouse-smart-tv-error-codes.html
https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
https://www.google.com/recaptcha/api.js
https://gadgetspassl.weebly.com/2/post/2020/09/westinghouse-smart-tv-error-codes.html
http://twitter.com/share?url=https://gadgetspassl.weebly.com/2/post/2020/09/westinghouse-smart-tv-error-codes.html
http://gadgetspassl.weebly.com/blog/westinghouse-smart-tv-error-codes&is_mobile=&r=3&is_light=1
https://www.weebly.com/signup?utm_source=internal&utm_medium=footer
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787914889&P2=404&P3=2&P4=EFI%2fd0dFQq3IqVOvRqJFVQdrprLSc0TnZtDxt4W5I12o5CgkG6vtAx6EGsdlwPexSggCSwj6%2blLGTEApXN8XcA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ogp.me
gadgetspassl.weebly.com
cdn2.editmysite.com
fonts.googleapis.com
cdn1.editmysite.com
ajax.googleapis.com
www.weebly.com
www.google.com
twitter.com
google-analytics.com
test.name
ec.editmysite.com
connect.facebook.net
tter.com

Embedded IP addresses

4.150.223.114
52.123.252.226
85.210.196.11
4.230.171.124
20.247.184.142
74.178.76.128
20.184.175.4
135.232.92.97
20.231.239.246
40.99.133.226
40.99.133.242
52.123.128.14
52.123.129.14
4.150.223.113
172.178.240.161
52.123.252.233
52.123.252.203
135.233.95.80
203.26.79.13
52.148.114.188
48.211.4.16
20.184.175.16
20.184.175.2
135.234.160.246
52.110.12.53

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report