MALICIOUS — e0d52b918c062d989f5493ae0df1fb41f433d1cb120af1d30d1b08eb6054e4dc
MALICIOUS — e0d52b918c062d989f5493ae0df1fb41f433d1cb120af1d30d1b08eb6054e4dc is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (83/100), attributed to the StartPage family. 3 of 53 detection engines flagged it.
Identification
- SHA-256:
e0d52b918c062d989f5493ae0df1fb41f433d1cb120af1d30d1b08eb6054e4dc - SHA-1:
88c457dc1173ed56eab100688c7f1f517650cc6a - MD5:
974fd7b2d36479977e96054350bb36a1 - ssdeep:
384:KWOHj6FlpP3j6FnDjQFTLBvKnl7B4cNY8D+1rCdo/cma5kFzatJW8Rx9j3BFcE1J:KWPH9eyFVCB4uY8D+1rCdoXzaTVD - TLSH:
T1B03365570D11EB9F85D2068EA3B07C5B64D4A0CB6FECA1F589C49F8EED44E64A40334A - Submitted as: e0d52b918c062d989f5493ae0df1fb41f433d1cb120af1d30d1b08eb6054e4dc
- File type: html · Size: 48238 bytes
- Verdict: malicious (83/100) · Family: StartPage
Detections (3 of 53 engines)
- Microsoft Defender: Exploit:VBS/MS06014.B
- Emsisoft (Emergency Kit): Trojan.StartPage.AAHD
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 83/100 is the fusion of 5 weighted signals:
- Memory forensics: 2 finding(s), e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85 - Obfuscated vbscript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 29 external host(s) at runtime (31 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: http://rozblog.com/temp/rang/like.png, http://www.lordrank.com, http://linkbox.lordrank.com - static signal, weight 0.35, confidence 0.60
- Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
277 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- c.pki.goog
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
Embedded URLs
- http://rozblog.com/temp/rang/like.png
- http://www.lordrank.com
- http://linkbox.lordrank.com
- http://link.lordrank.com
- http://matalmusic.rozblog.com
- http://ebrahimkalate.rozblog.com
- http://online-shop.rozblog.com
- http://webhelp.r98.ir/
- http://webhelp.r98.ir/tag/%D9%85%D8%B1%DA%A9%D8%B2+%D9%85%D8%B4%D8%A7%D9%88%D8%B1%D9%87+%D8%A7%D8%B2%D8%AF%D9%88%D8%A7%D8%AC+%D8%B1%D8%A7%D9%8A%DA%AF%D8%A7%D9%86+%D8%AA%D9%87%D8%B1%D8%A7%D9%86
- http://www.rozblog.com/theme/rozblog_v4/favi1.ico
- https://www.vistablog.ir
- http://www.rozsite.ir
- http://www.rozsite.ir.ir/update.php
- http://rozblog.com/temp/pro/ads_468.jpg
- http://webhelp.r98.ir/post/98
- http://174.142.7.129/%7Eadspics/ppicads/1250858655.jpg
- http://online-shopiankala.com/cat.php?id=1&
- http://online-shopiankala.com/subcat.php?zid=3&
- http://online-shopiankala.com/add2card.php?vendors=17040005&
- http://online-shopiankala.com/images/shop.gif
- http://www.rozblog.com/
- http://rozblog.com/images/ads/logo_ads.png
- http://webhelp.r98.ir/forget
- http://webhelp.r98.ir/post/1
- http://webhelp.r98.ir/post/2
Embedded domains
- rozblog.com
- www.lordrank.com
- lordrank.com
- linkbox.lordrank.com
- www.linkbox.lordrank.com
- link.lordrank.com
- www.link.lordrank.com
- matalmusic.rozblog.com
- www.matalmusic.rozblog.com
- www.ebrahimkalate.rozblog.com
- ebrahimkalate.rozblog.com
- online-shop.rozblog.com
- www.online-shop.rozblog.com
- webhelp.r98.ir
- www.rozblog.com
- www.vistablog.ir
- www.rozsite.ir
- www.rozsite.ir.ir
- online-shopiankala.com
- cooldl.net
- www.googletagmanager.com
Embedded IP addresses
- 174.142.7.129
- 4.150.223.101
- 52.123.252.239
- 52.123.252.241
- 57.154.63.210
- 4.230.171.124
- 52.253.84.76
- 74.179.77.204
- 135.232.92.97
- 4.150.223.99
- 52.168.117.168
- 52.123.128.14
- 20.236.44.162
- 52.123.129.14
- 172.66.2.5
- 203.26.79.13
- 74.178.232.29
- 135.234.160.246
- 52.123.252.245
- 52.110.12.2
- 52.110.12.4
- 52.148.114.188
- 72.154.7.106
- 172.178.240.162
- 172.175.111.170
More StartPage samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report