MALICIOUS — e0dd608c77e678e46f45daedb8f19c1f3bd163678670d03929c75c72aeca7636

MALICIOUS — e0dd608c77e678e46f45daedb8f19c1f3bd163678670d03929c75c72aeca7636 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Autolike family. 3 of 53 detection engines flagged it.

Identification

• SHA-256: e0dd608c77e678e46f45daedb8f19c1f3bd163678670d03929c75c72aeca7636
• SHA-1: 535ae961195f06e2233b564638329da695112c97
• MD5: 102c3c531498a0c3ba69be72b1d9f407
• ssdeep: 1536:Ep08b8VSeO39WoTgK1F0Nv5LpLnHbkGC30hsMk0eiYNPtL6jOaS6cgRr0ul4G:IeO39WoTVul5LpQ3DMreiEkj7Sul4G
• TLSH: T17346C890BF3E7B5A70B1E12BA6D846D0E2A052B6F167C1F5E093379341A0D25AD0FC46
• Submitted as: e0dd608c77e678e46f45daedb8f19c1f3bd163678670d03929c75c72aeca7636
• File type: html · Size: 317134 bytes
• Verdict: malicious (96/100) · Family: Autolike

Detections (3 of 53 engines)

• ClamAV (daily): Js.Malware.Autolike-1
• Microsoft Defender: TrojanClicker:JS/Faceliker.C
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Js.Malware.Autolike-1 (rule Js.Malware.Autolike-1) - engine signal, weight 0.90, confidence 0.95
• Obfuscated powershell script: dynamic-exec, defense-evasion (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Contacted 26 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/204402360-widget_css_bundle.css, http://creativecommons.org/licenses/by/3.0/, http://1.bp.blogspot.com/-9FCgC3SpZ00/UPMiEedG1VI/AAAAAAAACl0/zLgl3K6_d3I/s1600/arrow_right.gif - static signal, weight 0.35, confidence 0.60
• Extracted generic config (15 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

285 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• ctldl.windowsupdate.com
• login.live.com
• ocsp.digicert.com
• desktop-hsgcbep
• config.edge.skype.com
• v20.events.data.microsoft.com
• windows.msn.com
• licensing.mp.microsoft.com
• oneocsp.microsoft.com
• www.msn.com

Embedded URLs

• https://www.blogger.com/static/v1/widgets/204402360-widget_css_bundle.css
• https://www.google.com/
• http://creativecommons.org/licenses/by/3.0/
• http://1.bp.blogspot.com/-9FCgC3SpZ00/UPMiEedG1VI/AAAAAAAACl0/zLgl3K6_d3I/s1600/arrow_right.gif
• http://2.bp.blogspot.com/-QB-QrnRTSJI/UPMiEYKozJI/AAAAAAAAClw/ieBOFWLIqlM/s1600/arrow_down.gif
• http://3.bp.blogspot.com/-LzmPTNyR6po/TwETZufjSTI/AAAAAAAAATo/oisHmXUjmSY/s1600/arrow_white.gif
• http://4.bp.blogspot.com/-tk5hQcNMq6M/T8zPEwjH-RI/AAAAAAAAGm0/t8xkrJitkxg/s1600/batas.gif
• http://4.bp.blogspot.com/-Bt0JYGRHfpk/T7ZpN5RNSQI/AAAAAAAAGJQ/zQtrWVZwgHA/s1600/bullet.png
• http://3.bp.blogspot.com/-kci2j8VxzNY/UPw8jUo8hzI/AAAAAAAABNw/xV9j7En07ew/s1600/feed+icon.gif
• http://1.bp.blogspot.com/-zt3csy2DqGo/U661h1iTakI/AAAAAAAAAFc/v5tUjZIJDHs/s1600/mas-icons.png
• http://code.jquery.com/jquery-2.1.1.js
• http://ajax.googleapis.com/ajax/libs/jqueryui/1.9.2/jquery-ui.min.js
• http://2.bp.blogspot.com/-p8kDUeH5uV8/U91peIPWx5I/AAAAAAAAAAk/C3kiFW0RYzA/s150/Idool.jpg
• https://www.blogger.com/dyn-css/authorization.css?targetBlogID=3838844169565079662&amp
• http://luanafiorelli.blogspot.com/
• http://1.bp.blogspot.com/-9pktr5ue54o/U91rjM_1pMI/AAAAAAAAAAw/Qhk2b8QV-U4/s1600/Idool.jpg
• https://apis.google.com/js/plusone.js
• https://www.blogger.com
• http://www.onceuponatimetv.info?href=http://www.onceuponatimetv.info&layout=standard&show_faces=false&width=20&action=like&font=tahoma&colorscheme=light&height=20
• http://luanafiorelli.blogspot.com/2014/09/fruto-proibido.html
• http://4.bp.blogspot.com/-FV1t_0oKPew/TuXYS3CYgtI/AAAAAAAAAtY/rS4DHToDyLs/s72-c/98772158_smallssss.jpg
• http://luanafiorelli.blogspot.com/2010/07/big-hot-girls-loves-under-heat-sun-part.html
• http://4.bp.blogspot.com/_ryPBcsjplLs/TCj37Mi9LhI/AAAAAAAAATw/KyYxJ8KqPJM/s72-c/6088_101663077684_556327684_2294172_8130730_n.jpg
• http://luanafiorelli.blogspot.com/2013/09/hump-day-hottie-kat-kelley.html
• http://1.bp.blogspot.com/-acZ6vsNASxw/UkJxJ1dAZZI/AAAAAAAAPaA/CkvrhPZvDeI/s72-c/Kat69.jpg

Embedded domains

• www.blogger.com
• www.google.com
• creativecommons.org
• 1.bp.blogspot.com
• 2.bp.blogspot.com
• 3.bp.blogspot.com
• 4.bp.blogspot.com
• code.jquery.com
• ajax.googleapis.com
• blogspot.com
• luanafiorelli.blogspot.com
• apis.google.com
• pagead2.googlesyndication.com
• www.onceuponatimetv.info
• icontainer.style.top
• www.facebook.com
• twitter.com
• plus.google.com
• pinterest.com
• www.youtube.com
• feeds.feedburner.com
• www.blogblog.com

Embedded IP addresses

• 52.253.84.76
• 20.52.64.200
• 4.230.171.124
• 20.42.179.204
• 52.123.252.216
• 135.233.95.144
• 135.232.92.97
• 51.104.15.252
• 52.123.129.14
• 20.112.250.133
• 52.123.128.14
• 40.99.134.18
• 40.104.4.2
• 203.26.79.13
• 172.178.240.161
• 20.165.94.46
• 92.223.78.30
• 52.110.12.4
• 52.148.114.188
• 72.153.5.137
• 172.175.111.170
• 52.168.117.168
• 20.50.201.205
• 20.184.175.9
• 52.110.12.55

More Autolike samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report