SUSPICIOUS — da4b31ce51bdfcb864659c6c45eeb1a9e76f875191b29e05b32f623fbd5a7f02

SUSPICIOUS — da4b31ce51bdfcb864659c6c45eeb1a9e76f875191b29e05b32f623fbd5a7f02 is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: da4b31ce51bdfcb864659c6c45eeb1a9e76f875191b29e05b32f623fbd5a7f02
• SHA-1: 1a85977edff619d3c55a88ee4d4c27767ebb8a95
• MD5: d497667511e16d551132c63e812f4974
• ssdeep: 1536:lERCxqmeXKVZVb9BqI1xz8sQ3SeugaB7r3WrgqYZ3RSo+fY9QHqD+fxX5Ylw+Xez:6INOm+0ESVPA
• TLSH: T18238F766390CDDDCCC0D466B6FA835AB7707A971A5B284C4C2BDC3543EE4CA06CA6C19
• Submitted as: da4b31ce51bdfcb864659c6c45eeb1a9e76f875191b29e05b32f623fbd5a7f02
• File type: script · Size: 83009 bytes
• Verdict: suspicious (54/100)

Detections (2 of 50 engines)

• Microsoft Defender: Trojan:JS/Agent.AG!MSR
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec, defense-evasion (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://www.youtube-nocookie.com, https://player.vimeo.com/api/player.js, https://www.youtube.com/iframe_api - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://www.youtube-nocookie.com
• https://player.vimeo.com/api/player.js
• https://www.youtube.com/iframe_api

Embedded domains

• e.constructor.name
• www.youtube-nocookie.com
• vimeo.com
• e.zoom.in
• player.vimeo.com
• www.youtube.com
• s.name
• t.name
• mtmusicaemercado.com.br

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report