MALICIOUS — f3a05b3e6f07af7eeb7835c877cd2315dea9205fdd9557b894cef9c912af1bc3
MALICIOUS — f3a05b3e6f07af7eeb7835c877cd2315dea9205fdd9557b894cef9c912af1bc3 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (70/100). 0 of 54 detection engines flagged it.
Identification
- SHA-256:
f3a05b3e6f07af7eeb7835c877cd2315dea9205fdd9557b894cef9c912af1bc3 - SHA-1:
4ebcf8e7be91d1f66bad6b3d4f48e159b0256ede - MD5:
0818ed5a6091c3bc506549c588cddb24 - ssdeep:
1536:OzG0vwpBrYvIvx5VQX7XhdXTXsXvXmXxXYX9X8uAY1q4Gag4x:r04TrYvYQX7XhdXTXsXvXmXxXYX9X8i/ - TLSH:
T1C839B40BA7F0298F875650867094514E4CA27DE72413B0EED96C9F874C9DFB2B4B84A3 - Submitted as: f3a05b3e6f07af7eeb7835c877cd2315dea9205fdd9557b894cef9c912af1bc3
- File type: html · Size: 89356 bytes
- Verdict: malicious (70/100)
Detections (0 of 54 engines)
No engine flagged this sample.
Why this verdict
The malicious score of 70/100 is the fusion of 5 weighted signals:
- Obfuscated javascript script: dynamic-exec (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://www.shoprite.com//, https://cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js, https://cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js - static signal, weight 0.35, confidence 0.60
- Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
279 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- officeclient.microsoft.com
- www.msn.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
Embedded URLs
- https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTMG5TM68CJK7-1dS5qrsdVps58u6h_EcByMQ&usqp=CAU
- https://www.shoprite.com//
- https://cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js
- https://cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js
- https://cdn.jsdelivr.cc/npm/sweetalert2@10.16.0/dist/sweetalert2.all.min.js
- https://cdn.jsdelivr.cc/npm/lazyload@2.0.0-rc.2/lazyload.min.js
- https://cdn.jsdelivr.cc/npm/popper.js@1.16.1/dist/umd/popper.min.js
- https://cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css
- https://criticaloutput.top/JK07C7fA/flipkarttest/static/sur.css
- http://surveyurl.site/shoprite-mo/get.php
- https://1.bp.blogspot.com/-E8350Q0TD5w/YOmTBWcnLJI/AAAAAAAACOo/E1JU4kaMHmIGWAwTG4jOt9N0VfBw-LPqgCLcBGAsYHQ/s16000/favicon-americanas.webp
- https://draft.blogger.com/profile/11256903007374519918
- https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSWnuP22L6DnTk6jhfJ_HYr_cRkKJwcPuIqmQ&usqp=CAU
- https://i.imgur.com/istJ9a1.jpg
- https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRMR2jGDEfNwFUUHAq8BgbMHFqD2l3Greei4w&usqp=CAU
- https://i.imgur.com/zctaFsD.png
- https://1.bp.blogspot.com/-YkICnu0MND8/YOmSgYEBdmI/AAAAAAAACNo/lX5TkKBkOXUPD4JeiQEmCiIabMSMSBK9QCLcBGAsYHQ/s16000/box1.png
- https://1.bp.blogspot.com/-dlZWmXsBRtk/YOmSgcn-MbI/AAAAAAAACNk/akitNN8HwGk_odCfiBIsjfxiSpCZa_VKwCLcBGAsYHQ/s16000/box2.png
- https://i.imgur.com/Q0kYffi.png
- https://1.bp.blogspot.com/-Ey83XmOz6dc/YOmShEWbJdI/AAAAAAAACNw/h_oUcvOE8b0DQgJ9XOJAa2T1PPoH0bUKwCLcBGAsYHQ/s16000/box3.png
- https://1.bp.blogspot.com/-gnowbA64T7U/YMciQ4Jqp_I/AAAAAAAACBw/7wq2f5P9qlINQi1KzrUF5Cn6tIxo4R2MgCLcBGAsYHQ/s16000/show.png
- https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTIFm14xrIyRbCYwNX4gr2X4DI5Du63h9dNCQ&usqp=CAU
- https://uprimp.com/bnr.php?section=inter&pub=886613&format=300x50&ga=g
- https://1.bp.blogspot.com/-YrZ1qtO3KGE/YHgCjAGdgJI/AAAAAAAAA-8/dGN_EUs3E-kxQrFjBZtOcxMLKj-_E5f8ACLcBGAsYHQ/s16000/17.jpg
- https://1.bp.blogspot.com/-afclJF5HbbU/YHgCjqvvkhI/AAAAAAAAA_Q/TdiT3kQj_OMXVdWNq9K5sRfWdZHvj394wCLcBGAsYHQ/s16000/20.jpg
Embedded domains
- encrypted-tbn0.gstatic.com
- www.shoprite.com
- cdn.jsdelivr.cc
- criticaloutput.top
- surveyurl.site
- c.top
- 1.bp.blogspot.com
- draft.blogger.com
- blogspot.com
- i.imgur.com
- uprimp.com
- share-sharafdg.blogspot.com
- v.gapis.xyz
- www.w3.org
- hm.baidu.com
- r.line-me.vip
- www.webasicview.com
- bigprize-here-now2.life
- s10.histats.com
- sstatic1.histats.com
- href.li
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 41.17.79.44
- 51.104.15.252
- 52.123.252.236
- 4.230.171.124
- 40.84.85.40
- 135.232.92.97
- 20.247.184.197
- 135.232.92.137
- 4.150.223.107
- 20.247.185.124
- 52.110.12.37
- 52.110.12.46
- 72.154.7.98
- 52.148.114.188
- 92.223.78.30
- 52.110.12.10
- 52.110.12.38
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report