MALICIOUS — ef8efc795be190e85c56d902df1ede0300b4322ee1990826d56a07af277f34eb

MALICIOUS — ef8efc795be190e85c56d902df1ede0300b4322ee1990826d56a07af277f34eb is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 2 of 54 detection engines flagged it.

Identification

SHA-256: ef8efc795be190e85c56d902df1ede0300b4322ee1990826d56a07af277f34eb
SHA-1: 580756969ae1d5804169c2c24f7ea7749c556501
MD5: e6ee3eece30738afc25e7f86d69a5b8a
ssdeep: 768:TIRIOITIwIgIJKZgNDPIwIGI5IyJ7SGIRIOITIwIgIiKZgNDqIwIGI5IEJ7SRjhO:TIRIOITIwIgIJKZgNDPIwIGI5IyJ7SGd
TLSH: T16F32F145AE8B8D8A908B159D82510F84B459ED0A00D2EBCFF0E49D2BDE5F750C2BD4DB
Submitted as: ef8efc795be190e85c56d902df1ede0300b4322ee1990826d56a07af277f34eb
File type: html · Size: 46355 bytes
Verdict: malicious (92/100)

Detections (2 of 54 engines)

Microsoft Defender: Trojan:HTML/Phish.B!atmn
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 92/100 is the fusion of 7 weighted signals:

Microsoft Defender flagged Trojan:HTML/Phish.B!atmn (rule Trojan:HTML/Phish.B!atmn) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
Obfuscated javascript script: dynamic-exec (layers: char-code+concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://ogp.me/ns/fb#, http://i.ebayimg.com/images/i/172940491931-0-1/s-l1000.jpg, https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js - static signal, weight 0.35, confidence 0.60
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

280 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

ab619a4fcd4b20ee15b319afdda0a8af0c30881ec2c2d996d88ade01c1e87724 - ab619a4fcd4b20ee15b319afdda0a8af0c30881ec2c2d996d88ade01c1e87724

Embedded URLs

http://ogp.me/ns/fb#
http://i.ebayimg.com/images/i/172940491931-0-1/s-l1000.jpg
http://retuhunt.weebly.com/2/post/2019/05/sigma-seriennummernsuchesigma-serial-number-lookup.html
https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
https://www.google.com/recaptcha/api.js
https://retuhunt.weebly.com/2/post/2019/05/sigma-seriennummernsuchesigma-serial-number-lookup.html
http://twitter.com/share?url=https://retuhunt.weebly.com/2/post/2019/05/sigma-seriennummernsuchesigma-serial-number-lookup.html
http://retuhunt.weebly.com/blog/sigma-seriennummernsuchesigma-serial-number-lookup&is_mobile=&r=3&is_light=1
https://www.weebly.com/signup?utm_source=internal&utm_medium=footer
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

ogp.me
i.ebayimg.com
retuhunt.weebly.com
cdn2.editmysite.com
fonts.googleapis.com
cdn1.editmysite.com
ajax.googleapis.com
www.weebly.com
www.google.com
twitter.com
google-analytics.com
test.name
ec.editmysite.com
connect.facebook.net
tter.com

Embedded IP addresses

20.184.175.0
4.144.132.223
52.123.252.231
4.230.171.124
172.215.188.225
72.145.35.109
52.148.114.188
52.110.12.22
52.110.12.18

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report