MALICIOUS — df06c5adecf680baeeaa72ae3dea9a8550c9d3d45a17f8d987a1c1d3cb56220e

MALICIOUS — df06c5adecf680baeeaa72ae3dea9a8550c9d3d45a17f8d987a1c1d3cb56220e is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (73/100). 0 of 53 detection engines flagged it.

Identification

SHA-256: df06c5adecf680baeeaa72ae3dea9a8550c9d3d45a17f8d987a1c1d3cb56220e
SHA-1: 53dd11f35377ff3e33b8e3f4e30251341fc07092
MD5: f78de86ea69ea3b833ff500921bdf1c7
ssdeep: 24:50kiJCGGTnrWsrLkNcC84n3vHIQEcsbi+p7G/xMTu4rlf65Psjk+GTJ9CYQvA4ru:qkiJ9wnZnxsD9dwf0tKNpW
TLSH: T174147441267173E0A46CF903D1B478A75286D94C5169239DCD6863912CB8FD1F8494AA
Submitted as: df06c5adecf680baeeaa72ae3dea9a8550c9d3d45a17f8d987a1c1d3cb56220e
File type: html · Size: 1903 bytes
Verdict: malicious (73/100)

Detections (0 of 53 engines)

No engine flagged this sample.

Why this verdict

The malicious score of 73/100 is the fusion of 4 weighted signals:

Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Contacted 22 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://d.rmgserving.com/rmgjsc/zcFilters.js?1, http://billiongng.ga/?ga=rHOu36CUb2sXIsCf%2BEngwSHMuQtStx1gyhMK40RkZFDzIaRqaU5fuUps%2FYNkFHHwGbEtqH7WJwH7ie9B47TG2qGHDc7KqCm8UeHUCOuKmMHQQTnuCnLpGEYRLj%2BDaocWOkGs7tz50GR7Umbc2S4Dkyvdc3UdGNQvAmoyIvlLMc0%3D&gerf=ei0z%2BDCSdqg69GuNxQbcC3vbdnB%2B6SG%2FZ1ZLOyRiUCU%3D&guro=1pRUcZ1%2BF1WPetvF2ZJNgBqU9jQAg5AzOFJ8LVhr1GN1jHtJ3ckrT%2B1b9boCfPEVRHvupakDtpK732vWS0tU8Q%3D%3D&, http://billiongng.ga/rg-erdr.php?_rpo=t - static signal, weight 0.35, confidence 0.60
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

277 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://d.rmgserving.com/rmgjsc/zcFilters.js?1
http://billiongng.ga/?ga=rHOu36CUb2sXIsCf%2BEngwSHMuQtStx1gyhMK40RkZFDzIaRqaU5fuUps%2FYNkFHHwGbEtqH7WJwH7ie9B47TG2qGHDc7KqCm8UeHUCOuKmMHQQTnuCnLpGEYRLj%2BDaocWOkGs7tz50GR7Umbc2S4Dkyvdc3UdGNQvAmoyIvlLMc0%3D&gerf=ei0z%2BDCSdqg69GuNxQbcC3vbdnB%2B6SG%2FZ1ZLOyRiUCU%3D&guro=1pRUcZ1%2BF1WPetvF2ZJNgBqU9jQAg5AzOFJ8LVhr1GN1jHtJ3ckrT%2B1b9boCfPEVRHvupakDtpK732vWS0tU8Q%3D%3D&
http://billiongng.ga/rg-erdr.php?_rpo=t
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787885766&P2=404&P3=2&P4=f3Ck%2bzzL65x1o2wU9YB9%2fPpZiRM%2fdrXBW9OTxyvdAh6lHq0%2f1WpfJPseiYgpEJ0qNPI4DkNQ1usm5jHJJr7a0w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787885855&P2=404&P3=2&P4=OPDG5Ic7nw%2bOlja9a%2bbg%2f%2bNKLQGqG9cao0X1PMe4wlDHgoLZr2qvaFVnVgzcdGM6TctnjoElScB2lcTgP%2b1l5w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

d.rmgserving.com
billiongng.ga

Embedded IP addresses

48.211.4.16
20.42.65.91
4.247.188.233
20.247.184.142
4.230.171.124
20.165.94.63
20.165.94.54
20.184.175.4
51.105.71.137
20.112.250.133
40.104.4.2
40.99.133.242
40.99.134.2
52.123.128.14
203.26.79.13
135.233.45.221
172.66.2.5
135.232.92.34
52.148.114.188
72.154.7.108
52.110.12.26
52.110.12.24

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report