SUSPICIOUS — f2bff6a28692bac0071cf8a2ea13bbe915018c94e678253f3292d6e59a10947a

SUSPICIOUS — f2bff6a28692bac0071cf8a2ea13bbe915018c94e678253f3292d6e59a10947a is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 53 detection engines flagged it.

Identification

• SHA-256: f2bff6a28692bac0071cf8a2ea13bbe915018c94e678253f3292d6e59a10947a
• SHA-1: 4ad77d8cacc5bf49b7edfc7c8feef8c1f2ff25be
• MD5: 8233060acc068a9593cabd33780ae6ae
• ssdeep: 384:rDL2uKua8/5eSS4Hnz9PODMwrTaGgpXilazzOqkUrUoosIz9ZG1a+/WMWfthqECJ:rDL2uKkpXiU9Mk2aItp74bcB1U
• TLSH: T1E92DA71253E66A0F4C65120ED366889D4888BDCA9573B9EFD62E4A471C1CF3358FA00F
• Submitted as: f2bff6a28692bac0071cf8a2ea13bbe915018c94e678253f3292d6e59a10947a
• File type: html · Size: 27341 bytes
• Verdict: suspicious (54/100)

Detections (1 of 53 engines)

• Microsoft Defender: flagged

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: http://dtinsani.com/template/dtinsani/plugin/flexslider/flexslider.css, http://dtinsani.com/template/dtinsani/css/style.css, http://dtinsani.com/template/dtinsani/plugin/smoothscroller/jquery.mCustomScrollbar.css - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://dtinsani.com/template/dtinsani/plugin/flexslider/flexslider.css
• http://dtinsani.com/template/dtinsani/css/style.css
• http://dtinsani.com/template/dtinsani/plugin/smoothscroller/jquery.mCustomScrollbar.css
• http://dtinsani.com/template/dtinsani/plugin/fancybox/source/jquery.fancybox.css?v=2.1.5
• http://dtinsani.com/template/dtinsani/plugin/fancybox/source/helpers/jquery.fancybox-buttons.css?v=1.0.5
• http://dtinsani.com/template/dtinsani/plugin/fancybox/source/helpers/jquery.fancybox-thumbs.css?v=1.0.7
• http://dtinsani.com
• http://dtinsani.com/about/profil
• http://dtinsani.com/about/visi-misi
• http://dtinsani.com/about/struktur-organisasi
• http://dtinsani.com/about/kebijakan-mutu
• http://dtinsani.com/about/manajemen
• http://dtinsani.com/program
• http://dtinsani.com/program/list/kat/1
• http://dtinsani.com/program/list/kat/2
• http://dtinsani.com/program/list/kat/3
• http://dtinsani.com/program/list/kat/4
• http://dtinsani.com/program/list/kat/5
• http://dtinsani.com/program/list/kat/6
• http://dtinsani.com/diskusi
• http://dtinsani.com/pelatihan
• http://dtinsani.com/alumni
• http://dtinsani.com/galeri
• http://dtinsani.com/video
• http://dtinsani.com/kontak

Embedded domains

• dtinsani.com
• google-analytics.com
• www.facebook.com
• twitter.com
• plus.google.com
• opi.yahoo.com
• mail.dtinsani.com
• schema.org

Embedded IP addresses

• 65.154.226.165

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report