MALICIOUS — ca9a457a10d9b9ae64bf80d9cec74f6cdfd94c5aeb541293b15a437cec245d8f
MALICIOUS — ca9a457a10d9b9ae64bf80d9cec74f6cdfd94c5aeb541293b15a437cec245d8f is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (70/100). 0 of 54 detection engines flagged it.
Identification
- SHA-256:
ca9a457a10d9b9ae64bf80d9cec74f6cdfd94c5aeb541293b15a437cec245d8f - SHA-1:
ca5702c77055437d04e7d7b259ccce802892579f - MD5:
841d3ad6d1391e9fcf115323f94cf3e8 - ssdeep:
1536:jiXfh57+rS/xGmYkNzdGszuHGTDedOnUS3q3+bC8/Hp5HPt9bnZ7:jSfh57+r2xvTDedOp3q3+bCQHp5HPtT - TLSH:
T12E3C0A53519B2DCF48EA0101F03D06281D8FE0EF79A8788B99ACC7C8DDA8968D45D8D7 - Submitted as: ca9a457a10d9b9ae64bf80d9cec74f6cdfd94c5aeb541293b15a437cec245d8f
- File type: html · Size: 116400 bytes
- Verdict: malicious (70/100)
Detections (0 of 54 engines)
No engine flagged this sample.
Why this verdict
The malicious score of 70/100 is the fusion of 5 weighted signals:
- Obfuscated javascript script: dynamic-exec (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: http://opengraphprotocol.org/schema/, https://yoast.com/wordpress/plugins/seo/, https://bond.com.vn/ - static signal, weight 0.35, confidence 0.60
- Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
281 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- login.live.com
- update.googleapis.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- settings-win.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- officeclient.microsoft.com
- windows.msn.com
- www.msn.com
- odc.officeapps.live.com
Embedded URLs
- http://opengraphprotocol.org/schema/
- http://www.facebook.com/2008/fbml
- https://yoast.com/wordpress/plugins/seo/
- https://bond.com.vn/
- https://www.facebook.com/nguyen.t.nguyen.3150
- https://schema.org
- https://bond.com.vn/#organization
- https://bond.com.vn/#logo
- https://bond.com.vn/wp-content/uploads/2021/09/1FBAE74D-C367-4E8A-A3A4-B14EFCCC2486.jpeg
- https://bond.com.vn/#website
- https://bond.com.vn/#webpage
- https://bond.com.vn/#breadcrumb
- https://bond.com.vn/wp-content/uploads/2019/07/Bond-Packaging-Logo.png
- https://bond.com.vn/wp-content/plugins/wp-rocket/inc/front/img/youtube.png
- https://api.w.org/
- https://bond.com.vn/du-an/
- https://bond.com.vn/dich-vu/
- https://bond.com.vn/blog/
- https://bond.com.vn/gioi-thieu/
- https://bond.com.vn/lien-he/
- https://www.w3.org/2000/svg
- https://www.w3.org/1999/xlink
- https://bond.com.vn/lien-he
- https://bond.com.vn/gioi-thieu
- https://bond.com.vn/visual-brand-strategy/
Embedded domains
- opengraphprotocol.org
- www.facebook.com
- yoast.com
- fonts.googleapis.com
- schema.org
- js.hs-scripts.com
- ajax.googleapis.com
- cdnjs.cloudflare.com
- netdna.bootstrapcdn.com
- fonts.gstatic.com
- www.google-analytics.com
- www.googletagmanager.com
- maps.google.com
- use.fontawesome.com
- api.w.org
- www.w3.org
- issuu.com
- drive.google.com
- zalo.me
- i.ytimg.com
- www.youtube.com
- wp-rocket.me
- bond.com.vn
- x1.c.lencr.org
- x2.c.lencr.org
Embedded IP addresses
- 51.116.253.169
- 57.155.101.212
- 52.253.84.76
- 4.230.171.124
- 20.42.179.204
- 135.232.92.97
- 20.184.175.22
- 74.178.76.128
- 74.179.77.204
- 162.159.142.9
- 92.223.78.30
- 52.110.12.8
- 52.148.114.188
- 72.153.5.131
- 52.110.12.21
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report