MALICIOUS — virussign.com_a914e6ceabd08d83094d21f2ee432400.vir

MALICIOUS — virussign.com_a914e6ceabd08d83094d21f2ee432400.vir is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100). 0 of 53 detection engines flagged it.

Identification

SHA-256: cdd4a1addfc9100345c2bbf1dce8b834799635ebbea380871b7c8d46ac6fc972
SHA-1: 37e8e77a236e66aecb12475f7a4b64392babab75
MD5: a914e6ceabd08d83094d21f2ee432400
ssdeep: 6144:4zTzcEA3W540wZU3zOF7qUpOs46KrHK+3:N3W4ZU3zOi
TLSH: T1C7474F1D0BB47DCFE7C5244EB45A984D48B8A2CFE920B4F14AC5EF0E9816CB1D0598A7
Submitted as: virussign.com_a914e6ceabd08d83094d21f2ee432400.vir
File type: html · Size: 343479 bytes
Verdict: malicious (84/100)

Source: VirusSign · first seen 2026-08-18T00:00:00.000Z · SHA-256 verified

Detections (0 of 53 engines)

No engine flagged this sample.

Why this verdict

The malicious score of 84/100 is the fusion of 5 weighted signals:

Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 29 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha3/dist/css/bootstrap.min.css, https://cdn.jsdelivr.net/npm/bootstrap-icons@1.10.3/font/bootstrap-icons.css, https://img.viva88athenae.com//icomoon/style.css - static signal, weight 0.35, confidence 0.60
Extracted generic config (9 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

288 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha3/dist/css/bootstrap.min.css
https://cdn.jsdelivr.net/npm/bootstrap-icons@1.10.3/font/bootstrap-icons.css
https://img.viva88athenae.com//icomoon/style.css
https://cdn.jsdelivr.net/npm/driver.js@1.3.1/dist/driver.css
https://cdn.jsdelivr.net/npm/driver.js@1.3.1/dist/driver.js.iife.js
https://tokeslot88.com/
https://iili.io/dusuhQf.webp
https://tokeslot88.com/images/upload-Slides-20210701225758.jpg
https://happy.t0k3sl0t88.com/
https://www.googletagmanager.com/gtag/js?id=G-G4FSS1VK0K
https://schema.org/
http://schema.org
https://schema.org
https://iili.io/duiQD3F.webp
https://connect.facebook.net/en_US/fbevents.js
https://www.facebook.com/tr?id=1336098231383311&ev=PageView&noscript=1
https://s21-def.ap4r.com/kos/s101/nlav112572/pixel/events.js
https://s21-def.ks-la.net/kos/s101/nlav112572/pixel/events.js
https://www.facebook.com/tr?id=905844818651083&ev=PageView&noscript=1
https://www.facebook.com/tr?id=901829122256675&ev=PageView&noscript=1
https://www.facebook.com/tr?id=1687057932544108&ev=PageView&noscript=1
https://www.facebook.com/tr?id=1539274347940891&ev=PageView&noscript=1
https://img.viva88athenae.com//icon-togel1.png
https://img.viva88athenae.com//icon-kupon1.png
https://img.viva88athenae.com//slot-prag.png

Embedded domains

cdn.jsdelivr.net
img.viva88athenae.com
tokeslot88.com
iili.io
happy.t0k3sl0t88.com
www.googletagmanager.com
schema.org
connect.facebook.net
www.facebook.com
s21-def.ap4r.com
s21-def.ks-la.net
wa.me
fkupon.com
cdn.sportnanoapi.com
rtp-tokeslot88.site
galery303.site
mengarahkan.site
ares88access.com
www.livechat.com
cdn.livechatinc.com
direct.lc.chat
mez.ink

Embedded IP addresses

20.165.94.46
20.184.175.14
4.230.171.124
172.215.188.232
20.247.184.142
135.232.92.137
74.178.240.51
4.150.223.100
20.112.250.133
52.123.129.14
52.123.128.14
20.42.72.131
203.26.79.13
172.178.240.162
52.123.252.222
52.123.252.248
48.199.12.1
52.148.114.188
52.110.12.52
4.247.188.224
4.247.188.233
52.110.12.54
72.145.35.107
135.233.45.223
4.207.44.71

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report