SUSPICIOUS — d2788288608b68197e014997020e800dce935c2e66911fde80c8a256a243523b
SUSPICIOUS — d2788288608b68197e014997020e800dce935c2e66911fde80c8a256a243523b is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (45/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
d2788288608b68197e014997020e800dce935c2e66911fde80c8a256a243523b - SHA-1:
ad5a544cbc5728a3359132599c4e70566d35bd29 - MD5:
5ac145fbc116caa1d63380e7a983735f - ssdeep:
6144:jCVkxrdgCxf3ITZR4NAoUeMnZvK5rUiP/gCaY9836MsC7COumRfiGAvPwhx:jC2BnmZWNAor8p0rUitayi6MD7CEhx - TLSH:
T1394682AE65593EEF560758CD3C04265F5A2F25D1382838C43ED8CB4A8663E81F826D37 - Submitted as: d2788288608b68197e014997020e800dce935c2e66911fde80c8a256a243523b
- File type: script · Size: 307497 bytes
- Verdict: suspicious (45/100)
Detections (3 of 50 engines)
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
- Microsoft Defender: Trojan:JS/Agent.AG!MSR
- Emsisoft (Emergency Kit): GT:JS.Injected.1.9E5147B7
Why this verdict
The suspicious score of 45/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec, defense-evasion (layers: char-code+concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 4 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Dynamic analysis (linux)
852 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- 250.255.255.239.in-addr.arpa
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- desktop-hsgcbep
- ntp.ubuntu.com
- 224.0.0.251
- ff02::fb
- ff02::1:3
- 224.0.0.252
- 10.240.0.255
- 10.240.0.1
- 169.254.255.255
- ff02::16
- 239.255.255.250
- 185.125.190.56
- ff02::1:ff12:3456
- ff02::1
- 224.0.0.22
Dropped files
- tmp_tmp.qbmXNggWiB -
505a239dd24b5c5ccc919d358d52bd8a27837afd48b74e680577a26ccf6bcc53
Embedded domains
- o.name
- t.name
- i.detection.current.name
- this.name
- n.name
- u.to
- c.to
- e.to
- www.youtube.com
- a.vimeocdn.com
- b.style.top
- chakshubooks.com
Embedded IP addresses
- 135.233.95.144
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report