SUSPICIOUS — efdbaba9d5960c4065bd01f83744cb515e092fb99906ddb799b25b1fe017f871
SUSPICIOUS — efdbaba9d5960c4065bd01f83744cb515e092fb99906ddb799b25b1fe017f871 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 50 detection engines flagged it.
Identification
- SHA-256:
efdbaba9d5960c4065bd01f83744cb515e092fb99906ddb799b25b1fe017f871 - SHA-1:
c400b3790c4185bafaf3e776d7058ee24970c768 - MD5:
0aed149e3aeec368bcea3002bddfce8b - ssdeep:
3072:v7tqkqImWpB8QgyR+uG1oO4t+pF+AFW6:v7tq5ImWpBO - TLSH:
T1B83AC71D371BB6CA14D0957B65AC4BE880C1829BF933C2F1E663AFC99435C31AC8D856 - Submitted as: efdbaba9d5960c4065bd01f83744cb515e092fb99906ddb799b25b1fe017f871
- File type: html · Size: 99702 bytes
- Verdict: suspicious (54/100)
Detections (1 of 50 engines)
- Microsoft Defender: Trojan:HTML/Phish.GSL!MTB
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://meuteste00002.blogspot.com/favicon.ico, http://meuteste00002.blogspot.com/feeds/posts/default - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://meuteste00002.blogspot.com/favicon.ico
- http://meuteste00002.blogspot.com/2014/10/download-resident-evil-survivor-ps1.html
- http://meuteste00002.blogspot.com/feeds/posts/default
- http://meuteste00002.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/8926610912678024648/posts/default
- http://meuteste00002.blogspot.com/feeds/4323313845892406559/comments/default
- http://3.bp.blogspot.com/-f3fNKlaEgy8/VCzJdei1JXI/AAAAAAAACvo/KuV5jECWP48/s1600/resident_evil__survivor-1720261.jpg
- http://3.bp.blogspot.com/-f3fNKlaEgy8/VCzJdei1JXI/AAAAAAAACvo/KuV5jECWP48/w1200-h630-p-k-no-nu/resident_evil__survivor-1720261.jpg
- http://baixartemplatesnovos.blogspot.com
- http://elitedostorrent.blogspot.com.br/
- http://i.imgur.com/2S8ft.png
- http://3.bp.blogspot.com/-z-89vCF1kDY/UKRFn22FojI/AAAAAAAAC4M/m6PDgrPaU5k/s1600/Body.gif
- http://i.imgur.com/4qUD5.jpg
- http://i.imgur.com/Vnctg.gif
- http://i.imgur.com/tfN5p.png
- http://i.imgur.com/eDAWi.png
- http://i.imgur.com/aBmn5.png
- http://i.imgur.com/hlTs6.png
- http://i.imgur.com/OJmgP.gif
- http://i.imgur.com/X33F9.gif
Embedded domains
- www.w3.org
- www.google.com
- www.blogger.com
- meuteste00002.blogspot.com
- 3.bp.blogspot.com
- baixartemplatesnovos.blogspot.com
- elitedostorrent.blogspot.com.br
- i.imgur.com
- blogspot.com
- www.gstatic.com
- ajax.googleapis.com
- apis.google.com
- pagead2.googlesyndication.com
- 1.bp.blogspot.com
- 2.bp.blogspot.com
- www.youtube.com
- paste2.org
- 4.bp.blogspot.com
- www.gamesdown.com.br
- img2.blogblog.com
- acomments.com
- www.blogblog.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report