MALICIOUS — df0a31d8bfaccf9f0d717e588e1e54141a9ba6ee63354838e42032f9fa9b838c

MALICIOUS — df0a31d8bfaccf9f0d717e588e1e54141a9ba6ee63354838e42032f9fa9b838c is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (83/100). 0 of 53 detection engines flagged it.

Identification

• SHA-256: df0a31d8bfaccf9f0d717e588e1e54141a9ba6ee63354838e42032f9fa9b838c
• SHA-1: a2a68662b4ca47a6a10bd8d216319fa91ee1e1d8
• MD5: 75aeba601484773de953b0f5e8fbe0b4
• ssdeep: 768:Y1ApKVAqnd+qq9o7B2L0+NoOoaVM2BUR2:Y1WKVhnd+xmBA0+yOoaV3
• TLSH: T1E62E1831B6592AD908D081172FED499055CF861BA1B740F8ECA7BF84F818C7275D48EE
• Submitted as: df0a31d8bfaccf9f0d717e588e1e54141a9ba6ee63354838e42032f9fa9b838c
• File type: html · Size: 29807 bytes
• Verdict: malicious (83/100)

Detections (0 of 53 engines)

No engine flagged this sample.

Why this verdict

The malicious score of 83/100 is the fusion of 5 weighted signals:

• Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
• Obfuscated javascript script: dynamic-exec (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Contacted 31 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, https://dhenriefakes.blogspot.com/favicon.ico, https://dhenriefakes.blogspot.com/search/label/Maya - static signal, weight 0.35, confidence 0.60
• Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

276 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• ctldl.windowsupdate.com
• login.live.com
• ocsp.digicert.com
• settings-win.data.microsoft.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• licensing.mp.microsoft.com
• windows.msn.com
• oneocsp.microsoft.com

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
• https://dhenriefakes.blogspot.com/favicon.ico
• https://dhenriefakes.blogspot.com/search/label/Maya
• https://dhenriefakes.blogspot.com/feeds/posts/default
• https://dhenriefakes.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/3465747327246447250/posts/default
• https://www.blogger.com/profile/15413690670328369733
• https://99cools99.blogspot.com/p/anature.html
• http://www.blogger.com/
• https://www.blogger.com/dyn-css/authorization.css?targetBlogID=3465747327246447250&amp
• https://dhenriefakes.blogspot.com/
• https://99cools99.blogspot.com/p/nature.html
• https://dhenriefakes.blogspot.com/2013/06/abstract-graffiti-luna-maya.html
• https://lh4.googleusercontent.com/proxy/f1q5gTgsGcFHEsUlkXlXOQi6sT5Fgt_sBD_ALHCFH7PrSkBVVyoXxCxBX0PvywRYt3DbJh_Pt91jcnzujoUGTcERJ40de0FGJ3qpBW44cjE=s0-d
• https://lh6.googleusercontent.com/proxy/nyU0JXW9DPZRjUk6IHHcOiPiTEEGSnJwRa3Ze5d5pmM9qkYcOpZtsRYV57xMVs4K55WObQPxwMlNbECFV67Ig3XPb0juF8F0iZrGI8LHQGw=s0-d
• http://www.zigzaglens.com
• https://lh3.googleusercontent.com/proxy/w_NN40s8Ur9pN3vNKfALDi_uocng1MDMgj7lw89_bEZjMm04umR31SzkGxOa5BdTTuw9Eawzo5aLA_lNAPf7Abua8B3ZbbtS_qM3IIbkNTA=s0-d
• https://dhenriefakes.blogspot.com/search/label/Maya?updated-max=2013-06-07T18:34:00-07:00&amp
• https://www.blogger.com/static/v1/widgets/1140752822-widgets.js
• https://dhenriefakes.blogspot.com/search
• https://www.blogger.com

Embedded domains

• www.w3.org
• www.google.com
• www.blogger.com
• dhenriefakes.blogspot.com
• industry.it
• 99cools99.blogspot.com
• 4.bp.blogspot.com
• 3.bp.blogspot.com
• blogspot.com
• lh4.googleusercontent.com
• abstract-calligraphy.blogspot.com
• lh6.googleusercontent.com
• www.zigzaglens.com
• lh3.googleusercontent.com
• www.blogblog.com
• apis.google.com

Embedded IP addresses

• 4.247.188.224
• 4.150.223.97
• 52.123.252.245
• 4.144.132.223
• 4.230.171.124
• 74.178.76.128
• 4.207.44.72
• 74.178.240.51
• 52.123.128.14
• 52.123.129.14
• 20.231.239.246
• 51.116.253.169
• 172.178.240.163
• 172.66.2.5
• 52.123.252.239
• 52.123.252.225
• 74.178.76.44
• 203.26.79.13
• 52.110.12.38
• 52.110.12.48
• 52.148.114.188
• 48.211.4.16
• 20.184.175.2
• 51.116.246.104
• 48.192.143.121

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report