MALICIOUS — d32c242f0b306704ae125e11385bc2dc335e01549b306e16cc6cab2fc91a70cb

MALICIOUS — d32c242f0b306704ae125e11385bc2dc335e01549b306e16cc6cab2fc91a70cb is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (74/100). 0 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: d32c242f0b306704ae125e11385bc2dc335e01549b306e16cc6cab2fc91a70cb
• SHA-1: ca24dd87ac1593a3f6616bf526f266920b4043ac
• MD5: e0943790349762ebd1570efc4282b226
• ssdeep: 3072:oQE4FrRjmS8gg/QuHqCQYJkymWWWWWdKIpjSh9Iv:oQHdRjmLx/QuHqVO
• TLSH: T19A3E5329331252A704C17852F69C0EE560B5C16BA92290FDF2E1AFD4C93ADF0E4CD95B
• Submitted as: d32c242f0b306704ae125e11385bc2dc335e01549b306e16cc6cab2fc91a70cb
• File type: html · Size: 138352 bytes
• Verdict: malicious (74/100)

Detections (0 of 54 engines)

No engine flagged this sample.

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 74/100 is the fusion of 6 weighted signals:

• Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Contacted 27 external host(s) and 9 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css, http://vubest.blogspot.com/favicon.ico, http://vubest.blogspot.com/search/label/3%2Bbest%2Bsolved%2Bpapers%2Bof%2Beco401 - static signal, weight 0.35, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Extracted generic config (13 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

4946 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• 1.0.240.10.in-addr.arpa.
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• dns.msftncsi.com
• 85.52.40.23.in-addr.arpa.
• 209.52.40.23.in-addr.arpa.
• ecs.office.com
• desktop-hsgcbep
• update.googleapis.com
• self.events.data.microsoft.com
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 251.0.0.224.in-addr.arpa
• 1.0.240.10.in-addr.arpa

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css
• http://vubest.blogspot.com/favicon.ico
• http://vubest.blogspot.com/search/label/3%2Bbest%2Bsolved%2Bpapers%2Bof%2Beco401
• http://vubest.blogspot.com/feeds/posts/default
• http://vubest.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/8682882871286642023/posts/default
• https://www.blogger.com/static/v1/jsbin/403901366-ieretrofit.js
• https://thesoftdesign.com
• https://cdn.adf.ly/js/entry.js
• https://resources.blogblog.com/blogblog/data/1kt/simple/gradients_light.png
• https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.png
• https://resources.blogblog.com/blogblog/data/1kt/simple/paging_dot.png
• https://www.google-analytics.com/analytics.js
• https://www.blogger.com/dyn-css/authorization.css?targetBlogID=8682882871286642023&amp
• https://apis.google.com/js/platform.js
• http://schema.org/Blog
• http://vubest.blogspot.com/
• http://vubest.blogspot.com/p/learn-web-development.html
• http://vubest.blogspot.com/p/about-us.html
• http://vubest.blogspot.com/p/blog-page.html
• http://vubest.blogspot.com/p/interview-questions.html

Embedded domains

• www.w3.org
• www.google.com
• www.blogger.com
• vubest.blogspot.com
• asp.net
• thesoftdesign.com
• cdn.adf.ly
• fonts.gstatic.com
• resources.blogblog.com
• header.shadow.offset.top
• tabs.margin.top
• main.padding.top
• www.google-analytics.com
• blogspot.com
• apis.google.com
• schema.org
• www.fiverr.com
• 1.bp.blogspot.com
• adhitzads.com
• resources.infolinks.com
• www.opencart.com
• 2.bp.blogspot.com
• i.imgur.com
• w.sharethis.com
• adf.ly

Embedded IP addresses

• 4.150.223.99
• 52.123.129.14
• 203.26.79.13
• 20.165.94.46
• 40.84.85.40
• 72.145.35.111
• 52.148.114.188
• 20.42.73.25
• 72.145.35.96
• 104.46.162.231
• 72.145.35.97
• 4.150.223.114
• 57.154.63.210
• 20.184.175.5
• 57.155.101.212
• 51.105.71.136
• 20.184.175.14
• 40.84.97.4
• 13.89.179.12
• 172.172.255.217
• 20.184.175.20
• 4.150.223.98
• 135.234.160.244
• 20.50.73.14
• 4.247.188.233

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report