MALICIOUS — e29308680896081c825fecc3752651c1870f14a16c90599a56d7372fd05b0371

MALICIOUS — e29308680896081c825fecc3752651c1870f14a16c90599a56d7372fd05b0371 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 3 of 50 detection engines flagged it.

Identification

• SHA-256: e29308680896081c825fecc3752651c1870f14a16c90599a56d7372fd05b0371
• SHA-1: 94cb84312a6c9194511abf426393c409f3863c6c
• MD5: e4cf2daab8be33fc648e2a87c1dda3ae
• ssdeep: 768:4P8xlkvgOriWNzvoQgGHc4seEJeF0VkQVrJOawjeJuDFs727QuM:4U4/9c4seEJeTjeYDFsj
• TLSH: T14D35A50E3AB06A4F08F05619246DC6E920C6D6B7E53393F8D276DF48D92CD70A548C9B
• Submitted as: e29308680896081c825fecc3752651c1870f14a16c90599a56d7372fd05b0371
• File type: html · Size: 59932 bytes
• Verdict: malicious (93/100)

Detections (3 of 50 engines)

• ClamAV (daily): Html.Exploit.Agent-6598769-0
• Microsoft Defender: TrojanClicker:JS/Faceliker.A
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 93/100 is the fusion of 3 weighted signals:

• ClamAV (daily) flagged Html.Exploit.Agent-6598769-0 (rule Html.Exploit.Agent-6598769-0) - engine signal, weight 0.90, confidence 0.95
• Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css, http://naaktstrand.blogspot.com/favicon.ico, http://naaktstrand.blogspot.com/search/label/pure%20desi%20nude%20mega%20pics%20collection - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css
• http://naaktstrand.blogspot.com/favicon.ico
• http://naaktstrand.blogspot.com/search/label/pure%20desi%20nude%20mega%20pics%20collection
• http://naaktstrand.blogspot.com/feeds/posts/default
• http://naaktstrand.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/1719147633000767786/posts/default
• https://www.blogger.com/profile/12866562871349636702
• https://www.blogger.com/static/v1/jsbin/403901366-ieretrofit.js
• http://www.blogblog.com/1kt/awesomeinc/body_background_dark.png
• http://www.blogblog.com/1kt/awesomeinc/body_gradient_dark.png
• http://ajax.googleapis.com/ajax/libs/jquery/1.6.2/jquery.min.js
• https://www.blogger.com/dyn-css/authorization.css?targetBlogID=1719147633000767786&amp
• https://apis.google.com/js/plusone.js
• http://naaktstrand.blogspot.com/
• http://ads.clicksor.com/newServing/showAd.php?nid=1&amp
• http://www.yesadvertising.com
• http://naaktstrand.blogspot.com/2013/03/adriana-deville-hardcore-anal-sex.html
• http://1.bp.blogspot.com/-MsAehuAM624/ULfI1pvlJwI/AAAAAAAAERg/9YxQLJOR6c0/w72-h72-p-k-no-nu/XstreamingX%2BAdriana%2BHardcore%2B2.jpg
• http://naaktstrand.blogspot.com/2013/03/blonde-milfs-anal-sex-gallery.html
• http://4.bp.blogspot.com/-s71mnUz38D8/UDEAt-D3tbI/AAAAAAAAGSU/qCoWnFLr4Yc/w72-h72-p-k-no-nu/brazzers-milfs-anal-sex-gallery+%2810%29.jpg
• http://naaktstrand.blogspot.com/2013/03/sex-image.html

Embedded domains

• www.w3.org
• www.google.com
• www.blogger.com
• naaktstrand.blogspot.com
• tinachen.org
• header.padding.top
• header.margin.top
• widget.padding.top
• widget.outer.margin.top
• date.header.border.radius.top
• date.space
• date.first.border.radius.top
• post.first.padding.top
• pager.border.radius.top
• pager.space.top
• www.blogblog.com
• ajax.googleapis.com
• blogspot.com
• apis.google.com
• pagead2.googlesyndication.com
• ads.clicksor.com
• www.yesadvertising.com
• 1.bp.blogspot.com
• 4.bp.blogspot.com
• 2.bp.blogspot.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report