MALICIOUS — edd6faa330b31b3263e1b42694fbf42af4dfdd2baa4af56ec28fcc9662b34940

MALICIOUS — edd6faa330b31b3263e1b42694fbf42af4dfdd2baa4af56ec28fcc9662b34940 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the Wacatac family. 1 of 54 detection engines flagged it.

Identification

SHA-256: edd6faa330b31b3263e1b42694fbf42af4dfdd2baa4af56ec28fcc9662b34940
SHA-1: 86f17f357caa60c86311729055f06a262b6daa8b
MD5: 103fe6474b6a5e2ea5c03bb876236b7d
ssdeep: 768:qpIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZNt:qpIRIOITIwIgIiKZgNDfIwIGI5IVJ7Sp
TLSH: T1E02D94C7779ECCC6D5CC63D091D415085CE7AD0B1921ECC9C16CEBB4ACAFB6161A888A
Submitted as: edd6faa330b31b3263e1b42694fbf42af4dfdd2baa4af56ec28fcc9662b34940
File type: html · Size: 27830 bytes
Verdict: malicious (84/100) · Family: Wacatac

Detections (1 of 54 engines)

Microsoft Defender: Trojan:Script/Wacatac.B!ml

Why this verdict

The malicious score of 84/100 is the fusion of 6 weighted signals:

Microsoft Defender flagged Trojan:Script/Wacatac.B!ml (rule Trojan:Script/Wacatac.B!ml) - engine signal, weight 0.55, confidence 0.85
Obfuscated javascript script: dynamic-exec (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 1 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://ogp.me/ns/fb#, https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js, http://twitter.com/share?url=https://loadatwork140.weebly.com/1/post/2018/12/skachatj-mod-na-fs-17-zima.html - static signal, weight 0.35, confidence 0.60
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

279 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

9df288d7098c73a9fa5fd19c46ca81266b7c841420ea36617cd9587196703e54 - 9df288d7098c73a9fa5fd19c46ca81266b7c841420ea36617cd9587196703e54

Embedded URLs

http://ogp.me/ns/fb#
http://www.fs2017mod.com/wp-content/uploads/2017/11/realistic-seasons-v-1-2-fs-17-2.jpg
http://loadatwork140.weebly.com/1/post/2018/12/skachatj-mod-na-fs-17-zima.html
https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
https://www.google.com/recaptcha/api.js
https://loadatwork140.weebly.com/1/post/2018/12/skachatj-mod-na-fs-17-zima.html
http://twitter.com/share?url=https://loadatwork140.weebly.com/1/post/2018/12/skachatj-mod-na-fs-17-zima.html
http://loadatwork140.weebly.com/blog/skachatj-mod-na-fs-17-zima&is_mobile=&r=3&is_light=1
https://www.weebly.com/signup?utm_source=internal&utm_medium=footer
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

ogp.me
www.fs2017mod.com
loadatwork140.weebly.com
cdn2.editmysite.com
fonts.googleapis.com
cdn1.editmysite.com
ajax.googleapis.com
www.weebly.com
www.google.com
twitter.com
google-analytics.com
test.name
ec.editmysite.com
connect.facebook.net
tter.com
oneclient.sfx.ms

Embedded IP addresses

52.110.12.50
20.52.64.200
20.247.185.124
4.230.171.124
52.123.128.14
48.211.4.16
72.153.5.128
52.148.114.188
52.110.12.8
52.110.12.24

More Wacatac samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report