MALICIOUS — d3242974285610810d3644452360034d0028950c373840f3c0c63a9240bc397c
MALICIOUS — d3242974285610810d3644452360034d0028950c373840f3c0c63a9240bc397c is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the TrojanClicker family. 2 of 54 detection engines flagged it.
Identification
- SHA-256:
d3242974285610810d3644452360034d0028950c373840f3c0c63a9240bc397c - SHA-1:
0ecbb7dec503699064d023c4a1515d1247f5a58f - MD5:
d070e5c7540a2abec3e8f84a4aafd273 - ssdeep:
768:vTQODKOV+ledJTflleC7kFH4F2QlqxTkjQZ11q2CaT:vTt2KFe0kFH4F2Qlqx4jQZ11tT - TLSH:
T17635D76B325176CB04C0D451F6FC5EE451DAC26BEA2280A7F272EF48D87CC649849C5B - Submitted as: d3242974285610810d3644452360034d0028950c373840f3c0c63a9240bc397c
- File type: html · Size: 58254 bytes
- Verdict: malicious (92/100) · Family: TrojanClicker
Detections (2 of 54 engines)
- Microsoft Defender: TrojanClicker:JS/Faceliker.M
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 92/100 is the fusion of 7 weighted signals:
- Microsoft Defender flagged TrojanClicker:JS/Faceliker.M (rule
TrojanClicker:JS/Faceliker.M) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://video-bokep-perawan.blogspot.com/favicon.ico, http://video-bokep-perawan.blogspot.com/feeds/posts/default - static signal, weight 0.35, confidence 0.60
- Extracted generic config (9 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
280 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- licensing.mp.microsoft.com
- www.bing.com
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://video-bokep-perawan.blogspot.com/favicon.ico
- http://video-bokep-perawan.blogspot.com/2013/12/di-sepong-abg-smp.html
- http://video-bokep-perawan.blogspot.com/feeds/posts/default
- http://video-bokep-perawan.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/6993835079008754637/posts/default
- http://video-bokep-perawan.blogspot.com/feeds/8290927583820147016/comments/default
- http://video.google.com/ThumbnailServer2?app=blogger&contentid=f0f0fe835aeb6b4d&offsetms=5000&itag=w160&sigh=R7GQCVh0mYX0Lrx14PO3dvGAewE
- https://lh6.googleusercontent.com/proxy/9pg07IyDSTkQOSmh_g8zgskjX3rg3TzDWDKP9-8nTeJaFTbnAHPr6I_X6_7U_GstVHjca1QHDqeB5Jw58DZEaVeE4VzB9ffR12flSQULbwXs16OyXnlDAZNwLqVIrpXFd45KsMNnDdmlwc5PDlmnGK5pHtItHj94IP9IjVbtph1efxP5qw0fpnoym-_A00lRZ75XNUmYCu5ckBJ9Bw=w1200-h630-p-k-no-nu
- http://fonts.googleapis.com/css?family=Droid+Sans:400
- http://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js
- http://www.soratemplates.com
- http://creativecommons.org/licenses/by/3.0
- https://lh4.googleusercontent.com/-x0UzaYSChzI/UK97BzPBDbI/AAAAAAAAEk0/t2ndYUMn5j4/s400/body-pattern.gif
- https://lh4.googleusercontent.com/-nXN1liqCeps/UK97Jql20tI/AAAAAAAAEnA/ubU_BZVZZTg/s40/tail-top.gif
- https://lh6.googleusercontent.com/-0j4a1nBqz4M/UK97IULlKUI/AAAAAAAAEmo/DBB9x8MoW_A/s50/nav-tail.gif
- https://lh6.googleusercontent.com/-nhSZ69XFZBQ/UK97H6HP4EI/AAAAAAAAEmg/EgzenCR4I88/s50/nav-divider.gif
- https://lh3.googleusercontent.com/-_IToQvja6wA/UK97Htl9-AI/AAAAAAAAEmc/EXTWHPHzeu8/s50/nav-current.gif
- https://lh4.googleusercontent.com/-M2OQPqaDYs0/UK97HK3InRI/AAAAAAAAEmU/BlbpdnlMUmc/s50/nav-current-right.gif
- https://lh5.googleusercontent.com/-hlWfYRje0X8/UK97JDS9_BI/AAAAAAAAEm4/gKxks67iCAE/s154/sub-nav-tail.gif
- https://lh6.googleusercontent.com/-axFyD6_EAJw/UK97IyL7ONI/AAAAAAAAEm0/ePF26-rzmww/sub-nav-divider.gif
Embedded domains
- www.w3.org
- www.google.com
- www.blogger.com
- video-bokep-perawan.blogspot.com
- video.google.com
- lh6.googleusercontent.com
- fonts.googleapis.com
- ajax.googleapis.com
- www.soratemplates.com
- creativecommons.org
- lh4.googleusercontent.com
- lh3.googleusercontent.com
- lh5.googleusercontent.com
- blogspot.com
- v5.cache1.googlevideo.com
- bokepabgperawan.blogspot.com
- resources.blogblog.com
- www.facebook.com
- vert.top
- www.thehitsusa.com
- poponclick.com
- topeuro.biz
- apis.google.com
- www.netvibes.com
- add.my.yahoo.com
Embedded IP addresses
- 52.168.117.168
- 4.230.171.124
- 20.247.185.124
- 85.210.196.11
- 172.66.2.5
- 20.184.175.9
- 20.184.175.10
- 20.42.179.204
- 72.145.35.109
- 52.148.114.188
- 52.110.12.11
- 52.110.12.42
More TrojanClicker samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report