MALICIOUS — df0fe01fe12fe5f7d4441269962249bcfd1326616b6c658091e4a716bedf4530

MALICIOUS — df0fe01fe12fe5f7d4441269962249bcfd1326616b6c658091e4a716bedf4530 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the HideLink family. 3 of 53 detection engines flagged it.

Identification

SHA-256: df0fe01fe12fe5f7d4441269962249bcfd1326616b6c658091e4a716bedf4530
SHA-1: bc596213a837cc74a547dd67045290864b0e315a
MD5: f7f7df8f6256f37d218e3c9ccfb360bc
ssdeep: 1536:6EpK2LSpEXNiD4D3nCW0ADwHOYs8WxaRI1X:yqXNiD4D3nCW0UCOYsBxaRI1X
TLSH: T1973BA78F47197BAFB9E0512A731CB4BF11D2D5C39E9B9CF19680CA4D880CE20985E257
Submitted as: df0fe01fe12fe5f7d4441269962249bcfd1326616b6c658091e4a716bedf4530
File type: html · Size: 105671 bytes
Verdict: malicious (97/100) · Family: HideLink

Detections (3 of 53 engines)

ClamAV (daily): Js.Trojan.Obfus-633
Microsoft Defender: Trojan:JS/HideLink.A
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 97/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Js.Trojan.Obfus-633 (rule Js.Trojan.Obfus-633) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Obfuscated javascript script: dynamic-exec (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 26 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://popup.foxlearn.ir/pop.js, http://fcesteghlal-news.rzb.ir/, http://rozblog.com/temp/pp/starrating.png - static signal, weight 0.35, confidence 0.60
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

280 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://popup.foxlearn.ir/pop.js
http://fcesteghlal-news.rzb.ir/
http://rozblog.com/temp/pp/starrating.png
http://panoshsong.ir/
http://panoshsong.ir
http://fcesteghlal-news.rzb.ir/rss.xml
http://rozblog.com/temp/pp/script.js
http://rozblog.com/temp/pp/ticker.js
http://rozblog.com/temp/pp/blue.css
http://rozblog.com/temp/pp/pagenum.css
http://rozblog.com/temp/pp/skitter.css
http://rozblog.com/temp/pp/jquery-1.5.2.min.js
http://rozblog.com/temp/pp/jquery.easing.1.3.js
http://rozblog.com/temp/pp/jquery.animate-colors-min.js
http://rozblog.com/temp/pp/jquery.skitter.min.js
http://panoshsong.ir/files/uploads/1364968886.02.jpg
http://fcesteghlal-news.rzb.ir/login
http://fcesteghlal-news.rzb.ir/register
http://panoshsong.ir/files/uploads/1364968240.01.jpg
http://rozblog.com/temp/pp/Headline_bala_vasat.gif
http://google.com/search
http://rozblog.com/temp/pp/7px.gif
http://rozblog.com/temp/pp/search_bg.gif
http://fcesteghlal-news.rzb.ir/contact
http://fcesteghlal-news.rzb.ir/forum

Embedded domains

popup.foxlearn.ir
fcesteghlal-news.rzb.ir
rozblog.com
panoshsong.ir
www.01movie20013.tk
www.02movie20013.tk
kamyaba.vcp.ir
www.graphickade.rzb.ir
fcesteghlal-news.rozblog.com
s3.picofile.com
www.google.com
www5.varzesh3.com
www.fcesteghlal.ir
abieteh.com
t0.gstatic.com
www.ghaleb-weblog.ugig.ir
esteghlal16.rozblog.com
www.mozilla.org
www.opera.com
www.apple.com
www.rozblog.com
www.graphickade.rozblog.com
www.googletagmanager.com
google.com
www.meloodiuos.ir

Embedded IP addresses

4.150.223.104
40.84.97.4
4.230.171.124
20.42.179.204
4.144.132.114
135.233.95.144
20.184.175.23
20.112.250.133
52.123.128.14
20.165.94.54
135.232.92.137
51.132.193.105
135.233.45.222
74.178.232.29
52.123.252.222
92.223.78.30
203.26.79.13
85.210.196.11
52.148.114.188
52.110.12.37
52.110.12.47
51.116.253.168
48.199.12.1
72.153.5.137
52.110.12.8

More HideLink samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report