MALICIOUS — b68dba4d9436800f9dfbc2775f2afb2b581015d255e56f33f9fefd618a0fec89
MALICIOUS — b68dba4d9436800f9dfbc2775f2afb2b581015d255e56f33f9fefd618a0fec89 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the ScrInject family. 1 of 54 detection engines flagged it.
Identification
- SHA-256:
b68dba4d9436800f9dfbc2775f2afb2b581015d255e56f33f9fefd618a0fec89 - SHA-1:
c963597ad010d3e5486394a82a7f32b125700fcc - MD5:
3d26bf70749cde3b7e192f35422a930b - ssdeep:
12288:/XrUS25wbkU1tDGAz0R3ZryyNeUTrGWdLwPCtV3cF:/rUS25wbkU1tDGAz0R3ZryyNeUTrttVG - TLSH:
T1234BE9292EDE8E9F88049610B98C836C38B59DCFD4A414EEE6C9C4C9CC5CD707E69479 - Submitted as: b68dba4d9436800f9dfbc2775f2afb2b581015d255e56f33f9fefd618a0fec89
- File type: html · Size: 487484 bytes
- Verdict: malicious (84/100) · Family: ScrInject
Detections (1 of 54 engines)
- Microsoft Defender: Trojan:HTML/ScrInject.YYF!MTB
Why this verdict
The malicious score of 84/100 is the fusion of 6 weighted signals:
- Microsoft Defender flagged Trojan:HTML/ScrInject.YYF!MTB (rule
Trojan:HTML/ScrInject.YYF!MTB) - engine signal, weight 0.55, confidence 0.85 - Obfuscated powershell script: dynamic-exec, defense-evasion (layers: base64) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: http://ogp.me/ns#, https://curatiohealthcare.com/wp-content/themes/curatio/img/favicon.png, https://yoast.com/wordpress/plugins/seo/ - static signal, weight 0.35, confidence 0.60
- Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule
windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
289 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- licensing.mp.microsoft.com
- assets.msn.com
- www.bing.com
- settings-win.data.microsoft.com
- edge.microsoft.com
- watson.events.data.microsoft.com
- http://www.msftconnecttest.com/connecttest.txt
Embedded URLs
- http://ogp.me/ns#
- https://curatiohealthcare.com/wp-content/themes/curatio/img/favicon.png
- https://yoast.com/wordpress/plugins/seo/
- https://curatiohealthcare.com/
- https://schema.org
- https://curatiohealthcare.com/#organization
- https://curatiohealthcare.com/#website
- https://curatiohealthcare.com/#webpage
- https://fonts.gstatic.com
- https://curatiohealthcare.com/wp-content/plugins/contact-form-7/includes/css/../../images/ajax-loader.gif
- https://curatiohealthcare.com/wp-content/plugins/search-filter-pro2/public/assets/css/chosen-sprite.png
- https://curatiohealthcare.com/wp-content/plugins/search-filter-pro2/public/assets/css/chosen-sprite@2x.png
- https://curatiohealthcare.com/wp-content/plugins/search-filter-pro2/public/assets/css/../img/ui-icons_ffffff_256x240.png
- https://curatiohealthcare.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fcuratiohealthcare.com%2F
- https://curatiohealthcare.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fcuratiohealthcare.com%2F&
- http://www.w3.org/2000/svg
- https://curatiohealthcare.com/wp-content/themes/curatio/css/../fonts/fontawesome-webfont.eot?v=4.7.0
- https://curatiohealthcare.com/wp-content/themes/curatio/css/../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0
- https://curatiohealthcare.com/wp-content/themes/curatio/css/../fonts/fontawesome-webfont.woff2?v=4.7.0
- https://curatiohealthcare.com/wp-content/themes/curatio/css/../fonts/fontawesome-webfont.woff?v=4.7.0
- https://curatiohealthcare.com/wp-content/themes/curatio/css/../fonts/fontawesome-webfont.ttf?v=4.7.0
- https://curatiohealthcare.com/wp-content/themes/curatio/css/../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular
- https://curatiohealthcare.com/wp-content/themes/curatio/css/../fonts/Avenir-Medium.eot
- https://curatiohealthcare.com/wp-content/themes/curatio/css/../fonts/Avenir-Medium.eot?#iefix
- https://curatiohealthcare.com/wp-content/themes/curatio/css/../fonts/Avenir-Medium.woff2
Embedded domains
- ogp.me
- curatiohealthcare.com
- yoast.com
- schema.org
- fonts.gstatic.com
- li.no
- www.w3.org
- li.name
- face-bg.space
- child-bg.space
- www.googletagmanager.com
- www.facebook.com
- www.linkedin.com
- www.youtube.com
- instagram.com
- www.google.com
- product.link
- term.0.0.name
- post.link
- developer.mozilla.org
- developers.google.com
- botbuilder.engagely.ai
- wa.me
- wp-rocket.me
- www.hostingcloud.racing
Embedded IP addresses
- 20.184.175.17
- 20.247.184.197
- 4.230.171.124
- 85.210.196.11
- 135.233.45.223
- 52.110.12.54
- 184.84.165.136
- 52.110.12.18
More ScrInject samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report