MALICIOUS — ba669491637c25f360da4feadbc69141a41aa87244030cd161f1d11374fb4de9

MALICIOUS — ba669491637c25f360da4feadbc69141a41aa87244030cd161f1d11374fb4de9 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the HideLink family. 4 of 50 detection engines flagged it.

Identification

• SHA-256: ba669491637c25f360da4feadbc69141a41aa87244030cd161f1d11374fb4de9
• SHA-1: a88c0756894d81af0c89ab8e737f73724d4ac4a2
• MD5: 83f79332a07dde1d909ebb6cd3ac9902
• ssdeep: 384:+ikleEPJ19LR6RcLoj4P+injhSd8Jm8lsjh2VoruXlUYvsMlWyKIwxKk4qXHErn7:3yvPJLLURUdnj9RyVZ5Mk53ErniZI
• TLSH: T1C92CBB2476B9359214D4861FE049486CC0A1FE0BA23735F1DAEEA6C2541EF705CDF26B
• Submitted as: ba669491637c25f360da4feadbc69141a41aa87244030cd161f1d11374fb4de9
• File type: html · Size: 25875 bytes
• Verdict: malicious (99/100) · Family: HideLink

Detections (4 of 50 engines)

• ClamAV (daily): Js.Trojan.Obfus-633
• Microsoft Defender: Trojan:JS/HideLink.A
• Emsisoft (Emergency Kit): Trojan.JS.HideLink.F
• Kaspersky (KVRT): Trojan-Downloader.JS.Agent.hbs

Why this verdict

The malicious score of 99/100 is the fusion of 6 weighted signals:

• ClamAV (daily) flagged Js.Trojan.Obfus-633 (rule Js.Trojan.Obfus-633) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:JS/HideLink.A (rule Trojan:JS/HideLink.A) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.JS.HideLink.F (rule Trojan.JS.HideLink.F) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Trojan-Downloader.JS.Agent.hbs (rule Trojan-Downloader.JS.Agent.hbs) - engine signal, weight 0.55, confidence 0.85
• Obfuscated javascript script: dynamic-exec, defense-evasion (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: http://gmpg.org/xfn/11, http://gossipandglam.com/xmlrpc.php, http://gossipandglam.com/wp-content/themes/scrappy/js/html5.js - static signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

1 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• http://gmpg.org/xfn/11
• http://gossipandglam.com/xmlrpc.php
• http://gossipandglam.com/wp-content/themes/scrappy/js/html5.js
• http://gossipandglam.com/wp-content/plugins/i-love-social-bookmarking/includes/style.css
• http://gossipandglam.com/feed/
• http://gossipandglam.com/comments/feed/
• http://gossipandglam.com/tag/instyle-com/feed/
• http://gossipandglam.com/wp-content/themes/scrappy/style.css?ver=3.3.2
• http://fonts.googleapis.com/css?family=Rochester%7CUnna%7CAlegreya%3A400italic%2C700italic%2C400%2C700&#038
• http://gossipandglam.com/wp-includes/js/jquery/jquery.js?ver=1.7.1
• http://gossipandglam.com/wp-content/plugins/i-love-social-bookmarking/includes/ilsb.js?ver=0.3
• http://gossipandglam.com/xmlrpc.php?rsd
• http://gossipandglam.com/wp-includes/wlwmanifest.xml
• http://gossipandglam.com/wp-content/themes/scrappy/img/polkadots.gif
• http://cashadvances2two.com/payday-loans/advance-payday-loans
• http://fastcashloans2two.com/
• http://paydayadvanceloans2two.com/payday-loans/loans-until-payday
• http://statelicensedcashadvances2two.com/cash-advance/online-cash-advance-loans
• http://paydaycashadvance2two.com/cash-loan/easy-cash-loan
• http://guaranteedpaydayadvancerates2two.com/
• http://onlinecashadvance2two.com/cash-advance/paycheck-cash-advance
• http://statelicensedpaydayloans2two.com/fast-cash/fast-cash-loan-laws-requirements
• http://emergencycash2two.com/pay-day-loans/loans-pay-day
• http://paydayadvancelenders2two.com/
• http://nofaxpaydayloans2two.com/

Embedded domains

• instyle.com
• gmpg.org
• gossipandglam.com
• fonts.googleapis.com
• cashadvances2two.com
• fastcashloans2two.com
• paydayadvanceloans2two.com
• statelicensedcashadvances2two.com
• paydaycashadvance2two.com
• guaranteedpaydayadvancerates2two.com
• onlinecashadvance2two.com
• statelicensedpaydayloans2two.com
• emergencycash2two.com
• paydayadvancelenders2two.com
• nofaxpaydayloans2two.com
• paydayloan2two.com
• paydayadvanceonline2two.com
• paydayloansonlinekw.co.uk
• safepaydayadvances2two.com
• pagead2.googlesyndication.com
• www.instyle.com
• www.kmart.com
• www.bouncingneuron.com
• www.prweb.com
• gamepazzo.org

More HideLink samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report