SUSPICIOUS — dbb1a4f969175224150ae2359c3fa43156dddc976dbb27bf6bf86384bbbd4798
SUSPICIOUS — dbb1a4f969175224150ae2359c3fa43156dddc976dbb27bf6bf86384bbbd4798 is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 53 detection engines flagged it.
Identification
- SHA-256:
dbb1a4f969175224150ae2359c3fa43156dddc976dbb27bf6bf86384bbbd4798 - SHA-1:
18c61b7e1646fe7f6570e41f05264a65b3f06c30 - MD5:
685bd9f1db203a4284782c02d43f8b11 - ssdeep:
1536:cjwoHqzb9rzb9XjIvqeGWGQ6ant6eive9ke8xcvegvx/eQNIDWL:csoHwqqot6hvIkPmvpvFBNIDWL - TLSH:
T1B436742567C039CFC4D50165F4CA882D8C21D5CEB976C8FA5AA58F6C99A6D30C84F0DB - Submitted as: dbb1a4f969175224150ae2359c3fa43156dddc976dbb27bf6bf86384bbbd4798
- File type: script · Size: 68800 bytes
- Verdict: suspicious (54/100)
Detections (1 of 53 engines)
- Microsoft Defender: Trojan:JS/Redirector.YBAA!MTB
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec (layers: char-code) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: http://ogp.me/ns#, https://yoast.com/wordpress/plugins/seo/, http://pro-cosmetics-reviews.com/ - static signal, weight 0.35, confidence 0.60
Dynamic analysis (windows)
1106 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ntp.ubuntu.com
- desktop-hsgcbep
- 250.255.255.239.in-addr.arpa
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded URLs
- http://ogp.me/ns#
- http://schema.org/WebPage
- https://yoast.com/wordpress/plugins/seo/
- http://pro-cosmetics-reviews.com/
- http://pro-cosmetics-reviews.com/page/2/
- http://pro-cosmetics-reviews.com/feed/
- http://pro-cosmetics-reviews.com/wp-content/plugins/wp-social-likes/css/social-likes_classic.css?ver=4.8.17
- http://pro-cosmetics-reviews.com/wp-content/plugins/rich-reviews/css/rich-reviews.css?ver=4.8.17
- http://pro-cosmetics-reviews.com/wp-content/themes/virtue/assets/css/virtue.css?ver=302
- http://pro-cosmetics-reviews.com/wp-content/themes/virtue/assets/css/skins/default.css
- http://fonts.googleapis.com/css?family=Lato%3A400&
- http://pro-cosmetics-reviews.com/wp-includes/js/jquery/jquery.js?ver=1.12.4
- http://pro-cosmetics-reviews.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
- http://pro-cosmetics-reviews.com/wp-content/plugins/wp-social-likes/js/social-likes.min.js?ver=4.8.17
- http://pro-cosmetics-reviews.com/wp-content/plugins/rich-reviews/js/rich-reviews.min.js?ver=4.8.17
- https://api.w.org/
- http://pro-cosmetics-reviews.com/wp-json/
- http://pro-cosmetics-reviews.com/xmlrpc.php?rsd
- http://pro-cosmetics-reviews.com/wp-includes/wlwmanifest.xml
- http://pro-cosmetics-reviews.com/wp-content/themes/virtue/assets/js/vendor/respond.min.js
- http://schema.org/WPHeader
- http://pro-cosmetics-reviews.com/wp-content/uploads/2015/06/pro-cosmetic-reviews.png
- http://schema.org/SiteNavigationElement
- http://pro-cosmetics-reviews.com/loreal/
- http://pro-cosmetics-reviews.com/dimyoor/
Embedded domains
- ogp.me
- schema.org
- yoast.com
- pro-cosmetics-reviews.com
- fonts.googleapis.com
- s.w.org
- api.w.org
- www.kadencethemes.com
- lobbydesires.com
Embedded IP addresses
- 172.172.255.218
- 40.84.97.4
- 74.178.76.128
- 52.123.252.235
- 4.230.171.124
- 57.155.104.224
- 20.247.184.142
- 203.26.79.13
- 52.123.252.248
- 104.46.162.229
- 135.233.95.144
- 74.178.240.61
- 52.123.129.14
- 74.178.232.29
- 92.223.78.30
- 13.89.179.15
- 172.170.180.133
- 20.42.65.93
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report