MALICIOUS — bd57e462fa7bca008c0417e41082909b8b7b22d6e8ff7d2f10aeef0f2ac54f0d

MALICIOUS — bd57e462fa7bca008c0417e41082909b8b7b22d6e8ff7d2f10aeef0f2ac54f0d is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the Iframe family. 4 of 53 detection engines flagged it.

Identification

SHA-256: bd57e462fa7bca008c0417e41082909b8b7b22d6e8ff7d2f10aeef0f2ac54f0d
SHA-1: 4f67dcf6b0278e89cf97c609fd17baf3bd47a698
MD5: 38d266935bf12d7fbb4ec0560f0b5a17
ssdeep: 768:FxIU1/C25lF5lQ5lC5lM5lK5lR5lA5lD5lP5lz5lg5ln5lj5lq5l4lehl6El/hlV:FxIU1/C2VAyc6BQz/Dw3TabgS
TLSH: T1032E55E702141BFFBEC512553408851CAA52BDDECA2074E45ED2CD8DAD9CAC2D8B9363
Submitted as: bd57e462fa7bca008c0417e41082909b8b7b22d6e8ff7d2f10aeef0f2ac54f0d
File type: html · Size: 30392 bytes
Verdict: malicious (94/100) · Family: Iframe

Detections (4 of 53 engines)

ClamAV (daily): Html.Trojan.Iframe-74
Microsoft Defender: Exploit:HTML/IframeRef.gen
Trellix Stinger (McAfee): Exploit-IFrame.gen.ah
Kaspersky (KVRT): Trojan-Downloader.HTML.IFrame.aje

Why this verdict

The malicious score of 94/100 is the fusion of 3 weighted signals:

ClamAV (daily) flagged Html.Trojan.Iframe-74 (rule Html.Trojan.Iframe-74) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Contacted 23 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

279 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/TR/html4/loose.dtd
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787832641&P2=404&P3=2&P4=b4OjCG9bBT8yUskhm%2fiLuwW4yEVRroj3lKw6Z%2bdL6CK2m6dh5lAOsCauE6eve5spifqJ20hUA5Osz%2bzYlTLpfg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787832692&P2=404&P3=2&P4=YmAx0xT2M0YGe%2b4kMAwQDX4DAbhVpamhPoM68Bleaptxy7jigsiA9lVrDiG0dsynfk1a4uxPacf7A%2fi%2bykq1mA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787229444&P2=404&P3=2&P4=m8yLU90d8KSY1FE9s6EeRXW9Rfp%2bIiyMFcq%2bACkfo0j7SJ3p5BduXcl8KpX6yKSdpmqSdgkQ8%2faIkYRhmG3HJA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787228909&P2=404&P3=2&P4=BI6Nj0IicFLTcNAiercSihUJdN6aiELfiwuVfDzHHL5yHWbxbzLmng9yexQ822NY4%2beaWHzcaMFBKvv70bTj0g%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.w3.org
mozilla.org
vschina.cn

Embedded IP addresses

4.150.223.99
20.247.184.142
4.230.171.124
85.210.196.11
20.165.94.46
135.233.95.144
135.233.95.135
4.207.44.73
92.223.78.30
20.236.44.162
52.123.128.14
52.123.129.14
40.103.64.226
172.66.2.5
203.26.79.13
135.234.160.246
52.148.114.188
72.145.35.111
172.170.180.133
20.50.73.5
20.184.175.9
52.110.12.25
52.110.12.28

More Iframe samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report