SUSPICIOUS — db9c6b5396e033468bacf2d6e4b2a320e1b03415f462f3d3476676cbaff5a673

SUSPICIOUS — db9c6b5396e033468bacf2d6e4b2a320e1b03415f462f3d3476676cbaff5a673 is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: db9c6b5396e033468bacf2d6e4b2a320e1b03415f462f3d3476676cbaff5a673
• SHA-1: cd17de64038d55247b24f608f13893147452ec47
• MD5: d359e9873622fe90208edf25eb201174
• ssdeep: 384:hPlYUH+Pi6iCaUZJViOOiOOnqaardtt9NzWeiRttRtt055JPLq5M/1MlqDCBI52x:hPlYUH+Pi6iCaUZJViOOiOOnqaardtto
• TLSH: T1982B8E78781BAD98C3EB5440156D95F0EB305B1C5E73F6660BAC681CC616EF828CCA16
• Submitted as: db9c6b5396e033468bacf2d6e4b2a320e1b03415f462f3d3476676cbaff5a673
• File type: script · Size: 23563 bytes
• Verdict: suspicious (54/100)

Detections (2 of 50 engines)

• Microsoft Defender: Trojan:JS/Agent.AG!MSR
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://layerslider.kreaturamedia.com/, https://layerslider.kreaturamedia.com/licensing/ - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://layerslider.kreaturamedia.com/
• https://layerslider.kreaturamedia.com/licensing/

Embedded domains

• layerslider.kreaturamedia.com
• alliancehp.org

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report