SUSPICIOUS — bd53e9af9b71753a854c9fa165ab21ea81f38bce81519cc031a6275238f91d3a
SUSPICIOUS — bd53e9af9b71753a854c9fa165ab21ea81f38bce81519cc031a6275238f91d3a is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
bd53e9af9b71753a854c9fa165ab21ea81f38bce81519cc031a6275238f91d3a - SHA-1:
87879ca0fb6b5c7371cf871c802eee4921b9a17f - MD5:
7e15e0790fbe98aa1dbaa96ef2158827 - ssdeep:
384:w+OyFS0tjzbKhw9+1r0Mo+3/nQrspaXjW8iS9j3BFcE1IIwr1pTAtYN:w+Njt7X+1r0MoApazIN - TLSH:
T14B3231494D186F8F45D30B5EBB7878AB548599DB5BDDA2FD4DC88F0EB808C38910234A - Submitted as: bd53e9af9b71753a854c9fa165ab21ea81f38bce81519cc031a6275238f91d3a
- File type: html · Size: 46316 bytes
- Verdict: suspicious (54/100)
Detections (3 of 53 engines)
- Microsoft Defender: Exploit:VBS/MS06014.B
- Emsisoft (Emergency Kit): Trojan.StartPage.AAHD
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 54/100 is the fusion of 4 weighted signals:
- Obfuscated vbscript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 27 external host(s) at runtime (28 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: http://rozblog.com/temp/rang/like.png, http://www.lordrank.com, http://linkbox.lordrank.com - static signal, weight 0.35, confidence 0.60
- Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
276 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- settings-win.data.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
Embedded URLs
- http://rozblog.com/temp/rang/like.png
- http://www.lordrank.com
- http://linkbox.lordrank.com
- http://link.lordrank.com
- http://matalmusic.rozblog.com
- http://ebrahimkalate.rozblog.com
- http://online-shop.rozblog.com
- http://webhelp.rozfa.ir/
- http://webhelp.rozfa.ir/tag/%D8%A2%D9%86%DA%86%D9%87+%D8%B2%D9%86%D8%A7%D9%86+%D8%A8%D8%A7%DB%8C%D8%AF+%D8%AF%D8%B1%D8%A8%D8%A7%D8%B1%D9%87+%D9%85%D8%B1%D8%AF%D8%A7%D9%86+%D8%A8%D8%AF%D8%A7%D9%86%D9%86%D8%AF%21%21%21
- http://www.rozblog.com/theme/rozblog_v4/favi1.ico
- https://www.vistablog.ir
- http://www.rozsite.ir
- http://www.rozsite.ir.ir/update.php
- http://rozblog.com/temp/pro/ads_468.jpg
- http://webhelp.rozfa.ir/post/84
- http://online-shopiankala.com/ppicads/1299101297.jpg
- http://online-shopiankala.com/cat.php?id=1&
- http://online-shopiankala.com/subcat.php?zid=3&
- http://online-shopiankala.com/add2card.php?vendors=31130187&
- http://online-shopiankala.com/images/shop.gif
- http://www.rozblog.com/
- http://rozblog.com/images/ads/logo_ads.png
- http://webhelp.rozfa.ir/forget
- http://webhelp.rozfa.ir/post/1
- http://webhelp.rozfa.ir/post/2
Embedded domains
- rozblog.com
- www.lordrank.com
- lordrank.com
- linkbox.lordrank.com
- www.linkbox.lordrank.com
- link.lordrank.com
- www.link.lordrank.com
- matalmusic.rozblog.com
- www.matalmusic.rozblog.com
- www.ebrahimkalate.rozblog.com
- ebrahimkalate.rozblog.com
- online-shop.rozblog.com
- www.online-shop.rozblog.com
- webhelp.rozfa.ir
- www.rozblog.com
- www.vistablog.ir
- www.rozsite.ir
- www.rozsite.ir.ir
- online-shopiankala.com
- cooldl.net
- www.googletagmanager.com
Embedded IP addresses
- 4.150.223.105
- 52.123.252.220
- 4.230.171.124
- 85.210.193.152
- 4.144.132.223
- 4.144.132.114
- 74.179.77.204
- 52.168.117.168
- 74.178.240.51
- 20.112.250.133
- 52.123.128.14
- 4.207.44.64
- 52.123.252.197
- 172.178.240.161
- 203.26.79.13
- 52.123.252.192
- 74.179.71.159
- 52.148.114.188
- 52.110.12.15
- 52.110.12.33
- 92.223.78.30
- 51.105.71.136
- 72.154.7.108
- 172.170.180.133
- 13.89.179.15
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report