MALICIOUS — e2997d6cc82daa1bf2a1b6db443fda197cbb92dcb9955333f01d14356f747f18
MALICIOUS — e2997d6cc82daa1bf2a1b6db443fda197cbb92dcb9955333f01d14356f747f18 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 50 detection engines flagged it.
Identification
- SHA-256:
e2997d6cc82daa1bf2a1b6db443fda197cbb92dcb9955333f01d14356f747f18 - SHA-1:
f1d8b585181658210747517320c1bad602532304 - MD5:
d74f8997011c4835d720fc18b6b1baba - ssdeep:
3072:EU9ndFo36bmiT/VEGNuVuKVdww29MY2n7T+3ZP:79DWVdVdwi2 - TLSH:
T1ED3E3C17F708356A04A0D431AA9D9BD090C9C34FEA7246EDE5D6BE84CC3CDE4686D81B - Submitted as: e2997d6cc82daa1bf2a1b6db443fda197cbb92dcb9955333f01d14356f747f18
- File type: html · Size: 142473 bytes
- Verdict: malicious (96/100)
Detections (4 of 50 engines)
- ClamAV (daily): Html.Exploit.Agent-6598769-0
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
- Microsoft Defender: TrojanClicker:JS/Faceliker.H
- Emsisoft (Emergency Kit): JS:Trojan.JS.Likejack.A
Why this verdict
The malicious score of 96/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Html.Exploit.Agent-6598769-0 (rule
Html.Exploit.Agent-6598769-0) - engine signal, weight 0.90, confidence 0.95 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://www.blogger.com/openid-server.g, http://jombacejom.blogspot.com/ - static signal, weight 0.35, confidence 0.60
Dynamic analysis (windows)
1 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://www.blogger.com/openid-server.g
- http://jombacejom.blogspot.com/
- http://jombacejom.blogspot.com/2017/06/masih-ingat-lelaki-ini-dalam-filem-god.html
- http://schema.org
- http://jombacejom.blogspot.com/feeds/posts/default
- http://jombacejom.blogspot.com/feeds/posts/default?alt=rss
- http://www.blogger.com/feeds/8700337207830512022/posts/default
- http://3.bp.blogspot.com/-HHgpFjbPMcc/VqmCFa5pMSI/AAAAAAAABnQ/seB6t8hTDgo/s72-c/1.jpg
- https://plus.google.com/xxxxx/posts
- https://plus.google.com/xxxxx/about
- https://plus.google.com/xxxxx
- http://3.bp.blogspot.com/-HHgpFjbPMcc/VqmCFa5pMSI/AAAAAAAABnQ/seB6t8hTDgo/s640/1.jpg
- https://www.facebook.com/URL-PROFILE-FB
- https://www.facebook.com/URL-FANPAGE-FB
- https://4.bp.blogspot.com/-cmZSAe4hgWI/V0K-3C5xiHI/AAAAAAAAG90/2btatUgRsM4qf8HIc7QweuToTkRqRNeuACLcB/s1600/delete.png
- http://4.bp.blogspot.com/-R2WTW6O9E1o/VX7dqIGT1eI/AAAAAAAACc4/pyvQDMMLX3E/s1600/repeat-bg.png
- http://2.bp.blogspot.com/-fjaZBtfvzac/UN1mw2tUamI/AAAAAAAADkc/XdKqt8hWZ6w/s1600/anon.jpg
- http://4.bp.blogspot.com/-jSUS8v5kwpQ/U8Z_6Ufr-PI/AAAAAAAAEYY/o4cQPKvt8vQ/s1600/loading.gif
- http://3.bp.blogspot.com/-fr42e67HG4I/Vky8HLexiEI/AAAAAAAAM0I/MLMd2qwIH1E/s1600/avatar.png
- http://1.bp.blogspot.com/-htG7vy9vIAA/Tp0KrMUdoWI/AAAAAAAABAU/e7XkFtErqsU/s1600/grey.GIF
- https://maxcdn.bootstrapcdn.com/font-awesome/4.6.0/css/font-awesome.min.css
- https://www.blogger.com/dyn-css/authorization.css?targetBlogID=8700337207830512022&
- http://ajax.googleapis.com/ajax/libs/jquery/1.5.2/jquery.min.js
- http://schema.org/WPHeader
Embedded domains
- www.blogger.com
- jombacejom.blogspot.com
- schema.org
- 3.bp.blogspot.com
- plus.google.com
- www.facebook.com
- www.arlinadzgn.com
- 4.bp.blogspot.com
- 2.bp.blogspot.com
- a.tw
- 1.bp.blogspot.com
- e.link
- ajax.googleapis.com
- fonts.googleapis.com
- maxcdn.bootstrapcdn.com
- blogspot.com
- rdf.data-vocabulary.org
- twitter.com
- www.blogblog.com
- twemoji.maxcdn.com
- www.youtube.com
- apis.google.com
- pagead2.googlesyndication.com
- widgets.amung.us
- feedburner.google.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report