MALICIOUS — b6ef4e501e4405466475d4ac1ecc08e2e4f99ab77316cbb057af29383fb58daf
MALICIOUS — b6ef4e501e4405466475d4ac1ecc08e2e4f99ab77316cbb057af29383fb58daf is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the TrojanClicker family. 2 of 54 detection engines flagged it.
Identification
- SHA-256:
b6ef4e501e4405466475d4ac1ecc08e2e4f99ab77316cbb057af29383fb58daf - SHA-1:
7d2c9f00c4fd62f3edc7ce9383bdf3742e734dc2 - MD5:
d3a0cd2120c75fe8a7d658c0e2f7526f - ssdeep:
1536:UdwJ1I95HplfQYtpXkbUxNbQKL3FmJQJ1T+7IOnImIb3px7RAE8dONEhIAt0ofSZ:ywJUlfiVRIOnImIbZx7RWdLIAt0ofmz - TLSH:
T1913B1F582F3AB54628A0D14B7C8C2ED482835329FE33C4F5E4737B8592B4DA96D0F946 - Submitted as: b6ef4e501e4405466475d4ac1ecc08e2e4f99ab77316cbb057af29383fb58daf
- File type: html · Size: 103125 bytes
- Verdict: malicious (92/100) · Family: TrojanClicker
Detections (2 of 54 engines)
- Microsoft Defender: TrojanClicker:JS/Faceliker.M
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 92/100 is the fusion of 7 weighted signals:
- Microsoft Defender flagged TrojanClicker:JS/Faceliker.M (rule
TrojanClicker:JS/Faceliker.M) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec, defense-evasion (layers: base64+concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 1 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://ipoenkfans.blogspot.com/favicon.ico, http://ipoenkfans.blogspot.com/feeds/posts/default - static signal, weight 0.35, confidence 0.60
- Extracted generic config (15 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
278 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- windows.msn.com
- www.msn.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
Dropped files
- 65a386c6294704ffe0fd70f4a128a267ad63416429f5845a988d85dc01cfa5c9 -
65a386c6294704ffe0fd70f4a128a267ad63416429f5845a988d85dc01cfa5c9
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://ipoenkfans.blogspot.com/favicon.ico
- http://ipoenkfans.blogspot.com/2013/11/tina-arena-reset-2013-320kbps-cbr-mp3.html
- http://ipoenkfans.blogspot.com/feeds/posts/default
- http://ipoenkfans.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/1477817736644580662/posts/default
- http://ipoenkfans.blogspot.com/feeds/3681882767577046996/comments/default
- http://dyncdn.me/static/20/img/16x16/download.png
- https://lh4.googleusercontent.com/proxy/Gu0qK5N2ylkTAIXW9_4B-z7E0M3WvZsgXXjzNvjpqUwNEp9WEzeYfUoiSr39a2NxUOcTMwC8j6LnUIY9nk9vab-f8Vhj=w1200-h630-p-k-no-nu
- http://www.evafashionstore.com/
- http://3.bp.blogspot.com/-hZBjr9-yh30/UbEPG29zPLI/AAAAAAAAC_0/agIqLpN1RKk/s1600/profile.png
- http://2.bp.blogspot.com/-_vEiXezzziA/UbFMGl1cSVI/AAAAAAAADAs/2Q5HraOfvpU/s1600/header1.jpg
- http://1.bp.blogspot.com/-YSkIwGIaQEc/UbFMGp7eZ3I/AAAAAAAADA4/6fWgcn2aTK4/s1600/header2.jpg
- http://2.bp.blogspot.com/-RA_SF-9GHOU/UbFMGhsFahI/AAAAAAAADAw/-GNwGHKM3SI/s1600/header3.jpg
- http://3.bp.blogspot.com/-hZBjr9-yh30/UbEPG29zPLI/AAAAAAAAC_0/agIqLpN1RKk/s80/profile.png
- http://4.bp.blogspot.com/-NIMT_StpX8o/UbFJabbbVrI/AAAAAAAADAg/RrIMjdIoSlQ/s50/silhouette.jpg
- http://3.bp.blogspot.com/-YGKlaF8KBfI/UbFFd6IWaFI/AAAAAAAADAE/bAOgM48e3bw/s1600/panah.jpg
- http://2.bp.blogspot.com/-DydnIcBVSoo/UbCfHlTQPpI/AAAAAAAAC_U/psUxs2P8CxY/s1600/cafe.jpg
- http://4.bp.blogspot.com/-AXibTuvQ4G0/UbLyCftqrjI/AAAAAAAADBQ/o7YdBxiLvFE/s1600/button.png
- http://4.bp.blogspot.com/_qJFbsMHBJNg/SoaUE7XY4hI/AAAAAAAAAJY/fQ02np_6CiY/s1600/libg300.png
- http://1.bp.blogspot.com/-KDiIVaDJSeI/Ua7HhpnYR9I/AAAAAAAAC-I/MITroumdRE0/s1600/search.png
Embedded domains
- www.w3.org
- www.google.com
- www.blogger.com
- ipoenkfans.blogspot.com
- dyncdn.me
- lh4.googleusercontent.com
- www.evafashionstore.com
- 3.bp.blogspot.com
- 2.bp.blogspot.com
- 1.bp.blogspot.com
- 4.bp.blogspot.com
- blogspot.com
- twitter.com
- platform.twitter.com
- apis.google.com
- pagead2.googlesyndication.com
- www.ppcindo.net
- www.facebook.com
- christiantatelu.blogspot.com
- www.rarbg.com
- rarbg.com
- ultraimg.com
- hush.com
- www.ultraimg.com
- img560.imageshack.us
Embedded IP addresses
- 110.139.24.240
- 20.42.65.93
- 4.247.188.233
- 4.230.171.124
- 4.144.132.114
- 20.165.94.63
- 74.179.77.164
- 20.184.175.13
- 20.42.65.88
- 104.18.33.89
- 52.110.12.19
- 52.110.12.8
- 48.211.4.16
- 72.145.35.103
- 52.148.114.188
- 52.110.12.37
More TrojanClicker samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report