SUSPICIOUS — b60c7d126a80a223c5e18877d468fa6d2dc5a68988088c161af81a568cc7c7c0
SUSPICIOUS — b60c7d126a80a223c5e18877d468fa6d2dc5a68988088c161af81a568cc7c7c0 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 50 detection engines flagged it.
Identification
- SHA-256:
b60c7d126a80a223c5e18877d468fa6d2dc5a68988088c161af81a568cc7c7c0 - SHA-1:
18a5527e501cc454b9061f9f5ef0619714240cb0 - MD5:
522f1975b111d8b1496a07374a2292e6 - ssdeep:
1536:ZhIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7S47i:v7TUF3YIXiXJdAXSX3XaXYCOzwjrL - TLSH:
T1CD3B1A86E3D1140183EF5F52C29B4F0054C6AF2F54909CA7C1A99E94F2EABB3446CC9B - Submitted as: b60c7d126a80a223c5e18877d468fa6d2dc5a68988088c161af81a568cc7c7c0
- File type: html · Size: 109901 bytes
- Verdict: suspicious (54/100)
Detections (1 of 50 engines)
- Microsoft Defender: Trojan:Script/Wacatac.B!ml
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated powershell script: dynamic-exec, defense-evasion (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: http://ogp.me/ns/fb#, https://i.ytimg.com/vi/rswQ3kGFGCQ/hqdefault.jpg, https://i.ytimg.com/vi/5-nJE4AdnZo/hqdefault.jpg - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://ogp.me/ns/fb#
- https://i.ytimg.com/vi/rswQ3kGFGCQ/hqdefault.jpg
- https://i.ytimg.com/vi/5-nJE4AdnZo/hqdefault.jpg
- http://ia.media-imdb.com/images/M/MV5BMjE1OTQyMzk2OF5BMl5BanBnXkFtZTcwNDIwMTY1Mw@@._V1._SX260_SY400_.jpg
- http://images-thumbs.thefullwiki.org/D/O/V/DOV@2D102@2C677.png
- http://cdn01.cdn.justjared.com/wp-content/uploads/headlines/2016/03/eva-longoria-covers-vvv-mag-issue.jpg
- http://cdn02.cdn.justjared.com/wp-content/uploads/2013/12/aaron-visits/aaron-taylor-johnson-visits-wife-sam-taylor-wood-on-fifty-shades-set-13.jpg
- http://i.dailymail.co.uk/i/pix/2016/09/01/18/37CCAB0000000578-0-image-a-34_1472750332630.jpg
- http://www.gamewpp.com/wp-content/uploads/2013/03/Gear-Of-War-Judgement-Wallpaper-1920x1080.jpg
- http://web-dl.net/wp-content/uploads/2015/06/223-600x338.jpg
- http://web-dl.net/wp-content/uploads/2015/01/232.jpg
- http://fileunderground336.weebly.com/
- https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
- http://fileunderground336.weebly.com/blog/watch-official-trailer-online-2016-rogue-one-una-historia-de-star-wars
- http://fileunderground336.weebly.com/blog/watch-official-trailer-online-2016-rogue-one-una-historia-de-star-wars#comments
- https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js
- http://fileunderground336.weebly.com/1/post/2016/12/watch-official-trailer-online-2016-rogue-one-una-historia-de-star-wars.html
- http://twitter.com/share?url=http://fileunderground336.weebly.com/1/post/2016/12/watch-official-trailer-online-2016-rogue-one-una-historia-de-star-wars.html
- http://fileunderground336.weebly.com/blog/nocturnal-animals-2016-online-film-watch
- http://fileunderground336.weebly.com/blog/nocturnal-animals-2016-online-film-watch#comments
- http://fileunderground336.weebly.com/1/post/2016/12/nocturnal-animals-2016-online-film-watch.html
- http://twitter.com/share?url=http://fileunderground336.weebly.com/1/post/2016/12/nocturnal-animals-2016-online-film-watch.html
- http://fileunderground336.weebly.com/blog/watch-online-movie-star-wars-2016-1080p
- http://fileunderground336.weebly.com/blog/watch-online-movie-star-wars-2016-1080p#comments
- http://web-dl.net/wp-content/uploads/2015/08/392.jpg
Embedded domains
- ogp.me
- i.ytimg.com
- ia.media-imdb.com
- images-thumbs.thefullwiki.org
- cdn01.cdn.justjared.com
- cdn02.cdn.justjared.com
- i.dailymail.co.uk
- www.gamewpp.com
- web-dl.net
- fileunderground336.weebly.com
- cdn2.editmysite.com
- fonts.googleapis.com
- cdn1.editmysite.com
- ajax.googleapis.com
- www.weebly.com
- twitter.com
- www.youtube.com
- img.xcitefun.net
- desktopwallpapers.us
- www.hd.club.tw
- www.comics2film.com
- www.flickeringmyth.com
- image.tmdb.org
- images.everyeye.it
- www.featurepics.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report