SUSPICIOUS — d27dd342cde9b0bf2733cc4161453b5011b10b262d86b03a8331b8c90ec40e77

SUSPICIOUS — d27dd342cde9b0bf2733cc4161453b5011b10b262d86b03a8331b8c90ec40e77 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: d27dd342cde9b0bf2733cc4161453b5011b10b262d86b03a8331b8c90ec40e77
• SHA-1: 7681cdda68ae8b11038ed56ee5af157f0058f397
• MD5: b254de461924796736f66bd34373e6fd
• ssdeep: 768:yIRIOITIwIgIJKZgNDPIwIGI5IyJ7SGIRIOITIwIgIiKZgNDqIwIGI5IEJ7SOXSL:yIRIOITIwIgIJKZgNDPIwIGI5IyJ7SG4
• TLSH: T187336445BE8B8C8A80CF169D82510F84B489AD0A04A1EBDFE0E49E6BDD5F711D27C4D7
• Submitted as: d27dd342cde9b0bf2733cc4161453b5011b10b262d86b03a8331b8c90ec40e77
• File type: html · Size: 48402 bytes
• Verdict: suspicious (54/100)

Detections (2 of 53 engines)

• Microsoft Defender: Trojan:HTML/Phish.B!atmn
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec (layers: char-code+concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: http://ogp.me/ns/fb#, http://du0tsrdospf80.cloudfront.net/images/en/elaws_regs_010219_e-12.gif, https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://ogp.me/ns/fb#
• http://du0tsrdospf80.cloudfront.net/images/en/elaws_regs_010219_e-12.gif
• http://setiopolisfactor.weebly.com/1/post/2018/02/csa-b52-mechanical-refrigeration-code-pdf.html
• https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
• https://www.google.com/recaptcha/api.js
• https://setiopolisfactor.weebly.com/1/post/2018/02/csa-b52-mechanical-refrigeration-code-pdf.html
• http://twitter.com/share?url=https://setiopolisfactor.weebly.com/1/post/2018/02/csa-b52-mechanical-refrigeration-code-pdf.html
• http://setiopolisfactor.weebly.com/blog/csa-b52-mechanical-refrigeration-code-pdf&is_mobile=&r=3&is_light=1
• https://www.weebly.com/signup?utm_source=internal&utm_medium=footer

Embedded domains

• ogp.me
• du0tsrdospf80.cloudfront.net
• setiopolisfactor.weebly.com
• cdn2.editmysite.com
• fonts.googleapis.com
• cdn1.editmysite.com
• ajax.googleapis.com
• www.weebly.com
• www.google.com
• twitter.com
• google-analytics.com
• test.name
• ec.editmysite.com
• connect.facebook.net
• tter.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report