SUSPICIOUS — c49848a3c78fcc46cbe8c8c5e02f7f94bd7d103c0777a10e6ef8d1740e4dc9f3

SUSPICIOUS — c49848a3c78fcc46cbe8c8c5e02f7f94bd7d103c0777a10e6ef8d1740e4dc9f3 is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: c49848a3c78fcc46cbe8c8c5e02f7f94bd7d103c0777a10e6ef8d1740e4dc9f3
• SHA-1: e54a3094ed21d08ed20466d9b982c74273382e76
• MD5: 1fcba72b11f8da83066c3aacacc0d2f5
• ssdeep: 1536:fUoTZWLyt96lLV35I00ytezfURlR/TgXrCn2kCA79hJUWpyLBYAyXEaan7Jd8dFo:fUoTZIymlEv6vGylDddi5knbIP
• TLSH: T1D840D69A394EDDCCCC0C86AB2ED8747B77271D6576B240C4D2BEC3145DE48A06CE981A
• Submitted as: c49848a3c78fcc46cbe8c8c5e02f7f94bd7d103c0777a10e6ef8d1740e4dc9f3
• File type: script · Size: 174015 bytes
• Verdict: suspicious (54/100)

Detections (2 of 53 engines)

• Microsoft Defender: Trojan:JS/Agent.AG!MSR
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec, defense-evasion (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://connect.facebook.net/ - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.w3.org/2000/svg
• https://connect.facebook.net/

Embedded domains

• zloirock.ru
• h.store
• s.name
• n.top
• t.top
• www.w3.org
• i.top
• r.top
• a.top
• o.top
• connect.facebook.net
• sebooconsulting.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report