MALICIOUS — f06f007e153d6cc5a17ced8c04431c4093ca002eeabd987f7eecf0dbdf62fc97

MALICIOUS — f06f007e153d6cc5a17ced8c04431c4093ca002eeabd987f7eecf0dbdf62fc97 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 3 of 50 detection engines flagged it.

Identification

• SHA-256: f06f007e153d6cc5a17ced8c04431c4093ca002eeabd987f7eecf0dbdf62fc97
• SHA-1: 19438c258ba8b720624d8810134813b401964bd3
• MD5: 29ca4d604530b4ba375a6b73ca09d604
• ssdeep: 1536:XVvD2TO+q9oOpCORSwYnvvoygy2ODB2fnaCWdu//FQLSn3VNSI+R4QBabffyAV1w:XVvD2anpCORSwYZgy242yCWdu/dz+VBj
• TLSH: T1E5383C2E76557A8F48A05612B9FC07D470C9D55BE93301EEEDA6EF88DD18C602C48C2B
• Submitted as: f06f007e153d6cc5a17ced8c04431c4093ca002eeabd987f7eecf0dbdf62fc97
• File type: html · Size: 83549 bytes
• Verdict: malicious (93/100)

Detections (3 of 50 engines)

• ClamAV (daily): Html.Exploit.Agent-6598769-0
• Microsoft Defender: TrojanClicker:JS/Faceliker.A
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 93/100 is the fusion of 3 weighted signals:

• ClamAV (daily) flagged Html.Exploit.Agent-6598769-0 (rule Html.Exploit.Agent-6598769-0) - engine signal, weight 0.90, confidence 0.95
• Obfuscated javascript script: dynamic-exec (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://fonts.googleapis.com/css?family=Cabin+Condensed:600, http://cientosdejuegos.blogspot.com/favicon.ico - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
• http://fonts.googleapis.com/css?family=Cabin+Condensed:600
• http://cientosdejuegos.blogspot.com/favicon.ico
• http://cientosdejuegos.blogspot.com/
• http://cientosdejuegos.blogspot.com/feeds/posts/default
• http://cientosdejuegos.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/1803198891776941019/posts/default
• https://www.blogger.com/profile/11376294510658232304
• http://4.bp.blogspot.com/-J62QtcNPS7E/T17iZft3GQI/AAAAAAAAAZ4/PjUf7uV0kdQ/s1600/cabezera.jpg
• http://3.bp.blogspot.com/-yhKAlr3RAUI/T0YNCHQ4jkI/AAAAAAAABOE/G6objIhGOSI/s000/quotes.gif
• http://2.bp.blogspot.com/-76I6yGpWluQ/T0YNCaxFSYI/AAAAAAAABOM/n1CKNq7W1O0/s000/menusep.png
• http://3.bp.blogspot.com/-cQwCWfZtmxU/T0YNCtD8lkI/AAAAAAAABOU/aH3FPACg7L4/s000/blockquote.png
• http://1.bp.blogspot.com/-YVz8f0IDAjw/T0YNC2adPzI/AAAAAAAABOc/2uQOO-PdeCE/s000/bullet.png
• http://1.bp.blogspot.com/-RMWFD9ND3JE/T0YNDATqzFI/AAAAAAAABOk/DrvjtcRCvgg/s000/user.png
• http://3.bp.blogspot.com/-pqhrE2oU5YA/T0YNEgQxfUI/AAAAAAAABOs/-5PEhNsbpVU/s000/comment.png
• http://2.bp.blogspot.com/-R1PUXhIU23k/T0YNEsCUQMI/AAAAAAAABO0/yAUWAd_1KTc/s000/no-avatar.png
• https://lh4.googleusercontent.com/-u-KlYSq0mNU/T0vAfos-vcI/AAAAAAAAALY/igkWIJmoG4k/h120/sidebarhead.png
• http://1.bp.blogspot.com/-tvWR39dgx3w/T0YNGQ86ejI/AAAAAAAABPE/SmVQbOUeA68/s000/footerbg.png
• http://3.bp.blogspot.com/-xfUwWAIthHQ/T0YNGmf-7GI/AAAAAAAABPM/edOi0u0CB00/s000/footerli.png
• http://1.bp.blogspot.com/-2lXGJFhuHRY/T0YNG7XmZbI/AAAAAAAABPU/Kg7MCIspmik/s000/slider-shadow.png
• http://4.bp.blogspot.com/-5oTr2IwDPlo/T0YNHBwBVCI/AAAAAAAABPc/fGFrdTh4hlY/s000/loading.png

Embedded domains

• www.w3.org
• www.google.com
• www.blogger.com
• fonts.googleapis.com
• cientosdejuegos.blogspot.com
• 4.bp.blogspot.com
• 3.bp.blogspot.com
• 2.bp.blogspot.com
• 1.bp.blogspot.com
• lh4.googleusercontent.com
• li.top
• lh3.googleusercontent.com
• lh6.googleusercontent.com
• lh5.googleusercontent.com
• ciudadblogger.com
• lh6.ggpht.com
• dl.dropbox.com
• pazos-blogger.googlecode.com
• ajax.googleapis.com
• blogspot.com
• apis.google.com
• pagead2.googlesyndication.com
• dementor200.hostoi.com
• www.macromedia.com
• games.mochiads.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report