MALICIOUS — c828ed8736a781c9cab0cfecae84fcdcabd89320767c19272f9e06c0166b8079

MALICIOUS — c828ed8736a781c9cab0cfecae84fcdcabd89320767c19272f9e06c0166b8079 is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100). 2 of 54 detection engines flagged it.

Identification

• SHA-256: c828ed8736a781c9cab0cfecae84fcdcabd89320767c19272f9e06c0166b8079
• SHA-1: 0d4ec09c8c217236e2d3ee5b2cb9cded9fd1d63b
• MD5: 4ccac192e65617ee0520a65d9a34e47e
• ssdeep: 3072:9UZwlOExnuh5FP+V4SUAYcIbPfnBD63D64j1OEDz+K8KWstzf7D:9BllnOkmSbRIbPfn3jKWstzf
• TLSH: T12743F99E3D896FCFCD0D24977ECCA85E73130ED67AA5A4C482BCD7885DB48E0185841A
• Submitted as: c828ed8736a781c9cab0cfecae84fcdcabd89320767c19272f9e06c0166b8079
• File type: script · Size: 220411 bytes
• Verdict: malicious (87/100)

Detections (2 of 54 engines)

• Microsoft Defender: Trojan:JS/Agent.AG!MSR
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 87/100 is the fusion of 4 weighted signals:

• Microsoft Defender flagged Trojan:JS/Agent.AG!MSR (rule Trojan:JS/Agent.AG!MSR) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• Obfuscated powershell script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: http://modernizr.com/download/#-fontface-backgroundsize-borderimage-borderradius-boxshadow-opacity-rgba-textshadow-cssanimations-csstransitions-shiv-cssclasses-prefixed-testprop-testallprops-domprefixes-load, http://labs.anthonygarand.com/sticky, http://img.youtube.com/vi/ - static signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

1413 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• desktop-hsgcbep._dosvc._tcp.local
• desktop-hsgcbep(1)._dosvc._tcp.local
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• 23.40.52.209
• 151.101.30.172
• 23.11.37.157
• 20.190.167.148
• 52.123.252.229 AU · Sydney · AS8075 Microsoft Corporation
• 23.33.238.178
• 52.110.12.50 AU · Sydney · AS8075 Microsoft Corporation
• 4.230.171.124 KR · Seoul · AS8075 Microsoft Corporation
• 40.84.85.40 US · Boydton · AS8075 Microsoft Corporation

Dropped files

• ce225d64589e14f8ca17792329a6c75f6c1f0b006ae3a0a193ee780e49530be3 - ce225d64589e14f8ca17792329a6c75f6c1f0b006ae3a0a193ee780e49530be3

Embedded URLs

• http://modernizr.com/download/#-fontface-backgroundsize-borderimage-borderradius-boxshadow-opacity-rgba-textshadow-cssanimations-csstransitions-shiv-cssclasses-prefixed-testprop-testallprops-domprefixes-load
• http://labs.anthonygarand.com/sticky
• http://img.youtube.com/vi/
• http://vimeo.com/api/v2/video/
• http://www.youtube.com/embed/
• http://player.vimeo.com/video/
• https://github.com/paulirish/infinite-scroll
• http://infinite-scroll.com/
• http://www.no-margin-for-errors.com
• http://www.apple.com/qtactivex/qtplugin.cab
• http://www.apple.com/quicktime/download/
• http://twitter.com/share
• http://platform.twitter.com/widgets.js
• http://isotope.metafizzy.co
• http://bit.ly/getsizebug1
• http://twbs.github.com/bootstrap/javascript.html#carousel
• http://www.apache.org/licenses/LICENSE-2.0
• https://github.com/imakewebthings/jquery-waypoints/blob/master/licenses.txt
• http://github.com/davist11/jQuery-One-Page-Nav
• http://trevordavis.net
• http://jquery.org/license
• https://github.com/ded/bonzo
• http://www.codrops.com
• http://www.opensource.org/licenses/mit-license.php
• http://markdalgleish.com/projects/stellar.js

Embedded domains

• modernizr.com
• labs.anthonygarand.com
• e.prototype.to
• this.to
• b.property.name
• a.property.name
• img.youtube.com
• vimeo.com
• www.youtube.com
• player.vimeo.com
• b.prototype.to
• github.com
• infinite-scroll.com
• www.no-margin-for-errors.com
• www.apple.com
• twitter.com
• platform.twitter.com
• www.facebook.com
• youtu.be
• c.top
• o.top
• n.top
• isotope.metafizzy.co
• bit.ly
• t.to

Embedded IP addresses

• 72.145.35.106
• 52.168.117.175
• 52.123.252.229
• 52.110.12.50
• 4.230.171.124
• 40.84.85.40
• 4.144.132.223
• 20.42.73.24
• 172.215.188.232
• 52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report