MALICIOUS — bd5d583a67929a0df9d8f1369f921414da31823c8abd641c4df53267f5d4ce79
MALICIOUS — bd5d583a67929a0df9d8f1369f921414da31823c8abd641c4df53267f5d4ce79 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the HideLink family. 4 of 53 detection engines flagged it.
Identification
- SHA-256:
bd5d583a67929a0df9d8f1369f921414da31823c8abd641c4df53267f5d4ce79 - SHA-1:
168c3a92350a606ad9f73da5a38604d0984a8920 - MD5:
2f2f94927ebe07385346299311277131 - ssdeep:
1536:W7YinchaA2/KmjWuRRmq89QgAImzHtAiORRC/tme/500Y8iUdiiso61yqILrKNjM:BaAqKwWe0q82IQHtZtme/500Y8iUdii9 - TLSH:
T1ED370C9A971235CB40C51416E68C0CEDC4E8979FE93320BA8DA1DA4DE47DE30782EB47 - Submitted as: bd5d583a67929a0df9d8f1369f921414da31823c8abd641c4df53267f5d4ce79
- File type: html · Size: 70141 bytes
- Verdict: malicious (97/100) · Family: HideLink
Detections (4 of 53 engines)
- ClamAV (daily): Js.Trojan.Obfus-633
- Microsoft Defender: Trojan:JS/HideLink.A
- Emsisoft (Emergency Kit): Trojan.Script.641484
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 97/100 is the fusion of 6 weighted signals:
- ClamAV (daily) flagged Js.Trojan.Obfus-633 (rule
Js.Trojan.Obfus-633) - engine signal, weight 0.90, confidence 0.95 - Memory forensics: 2 finding(s), e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85 - Obfuscated javascript script: dynamic-exec, defense-evasion (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 27 external host(s) at runtime (28 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: http://ogp.me/ns#, https://calwatchdog.com/feed/, https://calwatchdog.com/comments/feed/ - static signal, weight 0.35, confidence 0.60
- Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
277 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
Embedded URLs
- http://ogp.me/ns#
- http://www.w3.org/1999/xhtml
- https://calwatchdog.com/feed/
- https://calwatchdog.com/comments/feed/
- https://calwatchdog.com/xmlrpc.php
- https://calwatchdog.com/2013/10/03/date-of-infamy-americas-100-years-in-income-tax-hell/
- https://www.facebook.com/CalWatchdog
- https://www.facebook.com/writejohnseiler
- https://calwatchdog.com/wp-content/uploads/2013/10/federal-spending-1789-2012.jpg
- https://schema.org
- https://calwatchdog.com/
- https://www.linkedin.com/company/calwatchdog/
- https://www.youtube.com/user/calwatchdog1
- https://twitter.com/CalWatchdog
- https://calwatchdog.com/#organization
- https://calwatchdog.com/wp-content/uploads/2015/04/CalWatchdogLogo1.png
- https://calwatchdog.com/wp-includes/css/dashicons.min.css?ver=20150819-01
- https://calwatchdog.com/wp-includes/js/thickbox/thickbox.css?ver=20150819-01
- https://calwatchdog.com/wp-includes/css/dist/block-library/style.min.css?ver=20150819-01
- https://calwatchdog.com/wp-content/plugins/wp-category-tag-could/css/wpctc.min.css?ver=1.7.1
- https://calwatchdog.com/wp-content/plugins/wp-pagenavi/pagenavi-css.css?ver=2.70
- https://fonts.googleapis.com/css?family=Roboto+Slab&
- https://calwatchdog.com/wp-content/themes/quadrum-theme/css/reset.css?ver=20150819-01
- https://calwatchdog.com/wp-content/themes/quadrum-theme/css/font-awesome.min.css?ver=20150819-01
- https://calwatchdog.com/wp-content/themes/quadrum-theme/css/main-stylesheet.min.css?ver=20150819-01
Embedded domains
- ogp.me
- www.w3.org
- calwatchdog.com
- connect.facebook.net
- www.facebook.com
- schema.org
- www.linkedin.com
- www.youtube.com
- twitter.com
- s0.wp.com
- ws.sharethis.com
- secure.gravatar.com
- fonts.googleapis.com
- maxcdn.bootstrapcdn.com
- s.w.org
- api.w.org
- wp.me
- v0.wordpress.com
- jetpack.wordpress.com
- s1.wp.com
- s2.wp.com
- public-api.wordpress.com
- 0.gravatar.com
- 1.gravatar.com
- 2.gravatar.com
Embedded IP addresses
- 52.123.252.231
- 20.184.175.12
- 52.230.59.222
- 57.154.63.210
- 4.230.171.124
- 74.179.77.204
- 74.178.76.54
- 20.236.44.162
- 52.123.128.14
- 52.123.129.14
- 40.99.133.226
- 20.184.175.16
- 40.84.85.40
- 172.178.240.162
- 135.233.95.80
- 203.26.79.13
- 52.148.114.188
- 51.116.253.169
- 52.110.12.24
- 52.110.12.42
- 4.150.223.103
- 48.199.12.1
- 72.145.35.103
- 52.168.112.67
- 52.182.141.63
More HideLink samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report