MALICIOUS — dd4fe4a3442ef9e108816f64b07a895e1b33a5da332715d586fba5ee9b3683d6

MALICIOUS — dd4fe4a3442ef9e108816f64b07a895e1b33a5da332715d586fba5ee9b3683d6 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (70/100). 0 of 54 detection engines flagged it.

Identification

• SHA-256: dd4fe4a3442ef9e108816f64b07a895e1b33a5da332715d586fba5ee9b3683d6
• SHA-1: 3a445d6e1a6fd4b0bfbc51659e36bc23b53208c7
• MD5: fbcf800b43411430267fc4cb0ba0b072
• ssdeep: 768:fRBj6zqLot8rp2/PY1CgGM0/qvEN0/e2rSpDC0+KzNZkM0jQJLt35z2wKor:fRV6OLy89agTpvEKxmx7PkEJLt35eor
• TLSH: T1653675A536667E8B18E04516591C4E85D0CAC263E97397E2E3A6FF48D438CF0980ECD7
• Submitted as: dd4fe4a3442ef9e108816f64b07a895e1b33a5da332715d586fba5ee9b3683d6
• File type: html · Size: 67491 bytes
• Verdict: malicious (70/100)

Detections (0 of 54 engines)

No engine flagged this sample.

Why this verdict

The malicious score of 70/100 is the fusion of 5 weighted signals:

• Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Contacted 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css, http://bestmp3playeronthemarket.blogspot.com/favicon.ico, http://bestmp3playeronthemarket.blogspot.com/ - static signal, weight 0.35, confidence 0.60
• Extracted generic config (12 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

281 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• ctldl.windowsupdate.com
• login.live.com
• update.googleapis.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• settings-win.data.microsoft.com
• licensing.mp.microsoft.com
• config.edge.skype.com
• officeclient.microsoft.com
• windows.msn.com
• odc.officeapps.live.com
• www.msn.com

Dropped files

• 9df288d7098c73a9fa5fd19c46ca81266b7c841420ea36617cd9587196703e54 - 9df288d7098c73a9fa5fd19c46ca81266b7c841420ea36617cd9587196703e54

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css
• http://bestmp3playeronthemarket.blogspot.com/favicon.ico
• http://bestmp3playeronthemarket.blogspot.com/
• http://bestmp3playeronthemarket.blogspot.com/feeds/posts/default
• http://bestmp3playeronthemarket.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/7684005952816261424/posts/default
• https://www.blogger.com/profile/18370760415793956726
• https://www.blogger.com/static/v1/jsbin/403901366-ieretrofit.js
• https://www.blogger.com/dyn-css/authorization.css?targetBlogID=7684005952816261424&amp
• https://www.blogger.com/go/adspersonalization
• https://apis.google.com/js/plusone.js
• http://schema.org/Blog
• http://schema.org/BlogPosting
• http://bestmp3playeronthemarket.blogspot.com/2012/12/tools-screenshot-download-snapfiles.html
• http://cdn.canadiancontent.net/t/screenshot/750/ashkon-mp3-tag-editor.jpg
• http://4.bp.blogspot.com/-oSgyhhhiKjk/TtHMRXZrEDI/AAAAAAAAAs8/VWWH88oLSuk/s1600/music_sequncer.jpg
• http://massid3lib.sourceforge.net/images/mttv1.2main.gif
• http://images.snapfiles.com/screenfiles/mp3tagtools2.png
• http://i.computer-bild.de/imgs/2/7/3/6/5/4/4/Screenshot-4-Mp3-Tag-Tools-587x455-779899a88f68b81d.jpg
• http://www.tagtuner.com/images/tag-editor.jpg
• http://bestfreedown.de/wp-content/uploads/2011/10/Mp3-Tag-Tools_2.png

Embedded domains

• www.w3.org
• www.google.com
• www.blogger.com
• bestmp3playeronthemarket.blogspot.com
• www.blogblog.com
• blogspot.com
• apis.google.com
• pagead2.googlesyndication.com
• schema.org
• cdn.canadiancontent.net
• 4.bp.blogspot.com
• massid3lib.sourceforge.net
• images.snapfiles.com
• i.computer-bild.de
• www.tagtuner.com
• bestfreedown.de
• www.filetransit.com
• www.easybuywholesale.com
• resources.blogblog.com
• images.best-mall.co.uk
• www.bizrice.com
• top-gadget.org
• www.best-globalgift.com
• cdn.cnet.com.au
• i00.i.aliimg.com

Embedded IP addresses

• 52.168.117.171
• 48.211.4.16
• 4.144.132.114
• 4.247.188.224
• 4.230.171.124
• 74.179.77.204
• 74.179.77.164
• 52.168.112.66
• 74.178.240.61
• 104.18.33.89
• 172.66.2.5
• 125.56.205.24
• 125.56.205.17
• 72.145.35.111
• 52.148.114.188
• 52.110.12.10
• 52.110.12.11

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report