MALICIOUS — b6eecd4f274f1286da647cfb0792c66a53b40f4328e778d2558588a62f2b2fe7
MALICIOUS — b6eecd4f274f1286da647cfb0792c66a53b40f4328e778d2558588a62f2b2fe7 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100). 2 of 54 detection engines flagged it.
Identification
- SHA-256:
b6eecd4f274f1286da647cfb0792c66a53b40f4328e778d2558588a62f2b2fe7 - SHA-1:
828e1880dc941bdc64818b13af797063002735a5 - MD5:
5fa97d17658a5cf8275ea695c2d087b7 - ssdeep:
768:1+UhAktSlC2+uN4PTikT7h7FlfFo7FAmW:sUhAkQlT+e43h7Fno7FAmW - TLSH:
T1362CC5156FB55D8FC0500105A03964108CD4FEEFD819B9E7C7A8EF8BA419E6098BE4EB - Submitted as: b6eecd4f274f1286da647cfb0792c66a53b40f4328e778d2558588a62f2b2fe7
- File type: html · Size: 25910 bytes
- Verdict: malicious (91/100)
Detections (2 of 54 engines)
- Microsoft Defender: TrojanDownloader:JS/FakejQuery.A!bit
- Emsisoft (Emergency Kit): Trojan.FakeJquery.1
Why this verdict
The malicious score of 91/100 is the fusion of 6 weighted signals:
- Microsoft Defender flagged TrojanDownloader:JS/FakejQuery.A!bit (rule
TrojanDownloader:JS/FakejQuery.A!bit) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.FakeJquery.1 (rule
Trojan.FakeJquery.1) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: http://ogp.me/ns#, http://html5shiv.googlecode.com/svn/trunk/html5.js, https://nisekorafting.com/en/spring-rafting-in-niseko/116-niseko-earlybird-rafting-plan/ - static signal, weight 0.35, confidence 0.60
- Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
279 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- settings-win.data.microsoft.com
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- officeclient.microsoft.com
- www.msn.com
- odc.officeapps.live.com
- www.bing.com
Embedded URLs
- http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd
- http://ogp.me/ns#
- http://www.w3.org/1999/xhtml
- http://html5shiv.googlecode.com/svn/trunk/html5.js
- https://nisekorafting.com/en/spring-rafting-in-niseko/116-niseko-earlybird-rafting-plan/
- https://ajax.googleapis.com/ajax/libs/jqueryui/1.10.3/jquery-ui.min.js
- http://eastwestdevelopments.com/js/jquery.min.php
- https://plus.google.com/114987735605069425991
- http://www.noasc.com/index.php/ja/niseko-summer/niseko-rafting38
- http://www.noasc.com/index.php/ja/?Itemid=476
- https://nisekorafting.com/images/demo/header1.jpg
- https://nisekorafting.com/images/demo/header2.jpg
- https://nisekorafting.com/images/demo/header3.jpg
- https://nisekorafting.com/images/demo/header4.jpg
- https://nisekorafting.com/images/demo/header5.jpg
- https://nisekorafting.com/images/demo/header6.jpg
- https://nisekorafting.com/modules/mod_hot_full_carousel/js/jquery.easing-1.3.js
- https://nisekorafting.com/modules/mod_hot_full_carousel/js/jquery.heroCarousel-1.3.min.js
- http://www.noasc.com/index.php/ja/noasc-home/noasc-blog-list-2/itemlist/category/117-noasc-members-rafting-ducky-blog?format=feed
- https://www.noasc.com/noasc-blog/item/565-winter-rafting-in-niseko-hokkaido-japan
- https://www.noasc.com/noasc-blog/item/543-noasc-ducky-inflatable-kayak-tours-have-started
- https://www.noasc.com/noasc-blog/item/537-3-rivers-rafting-let-s-go
- https://www.noasc.com/noasc-blog/item/534-come-whitewater-rafting-in-niseko-during-golden-week-from-april-29th-to-may-8th
- https://schema.org/Article
- http://www.noasc.com
Embedded domains
- www.w3.org
- ogp.me
- html5shiv.googlecode.com
- nisekorafting.com
- www.nisekorafting.com
- ajax.googleapis.com
- eastwestdevelopments.com
- www.google-analytics.com
- plus.google.com
- www.noasc.com
- schema.org
- twitter.com
- www.facebook.com
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 20.42.65.84
- 57.155.101.212
- 172.215.188.225
- 20.247.185.124
- 20.165.94.63
- 135.232.92.97
- 20.184.175.13
- 74.178.76.128
- 4.230.171.124
- 172.64.154.167
- 20.42.65.94
- 72.153.5.134
- 52.148.114.188
- 52.110.12.15
- 52.110.12.8
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report