MALICIOUS — f55318e1740b929804e4e4c23b651c62c723662894dc2dfb989bb2b8cf6436b9
MALICIOUS — f55318e1740b929804e4e4c23b651c62c723662894dc2dfb989bb2b8cf6436b9 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
f55318e1740b929804e4e4c23b651c62c723662894dc2dfb989bb2b8cf6436b9 - SHA-1:
f467b3fe5333e9590d69380fee1affbe5f959164 - MD5:
f50c8a9b80bd21b30a554814ed80a22d - ssdeep:
1536:bGwhqpuh2CkZQP47MFi4o/LzMgn3g7MI9kzsWx/uz7OI2Fx:bFqccJ3g7lioY/aOI2Fx - TLSH:
T12E3773263E5ABE2508D04527749C8EE492C68317E93BD1F5EA173FE1E43CC25790A892 - Submitted as: f55318e1740b929804e4e4c23b651c62c723662894dc2dfb989bb2b8cf6436b9
- File type: html · Size: 74858 bytes
- Verdict: malicious (93/100)
Detections (2 of 50 engines)
- ClamAV (daily): Win.Trojan.Crypt-291
- Microsoft Defender: Trojan:JS/IframeInject
Why this verdict
The malicious score of 93/100 is the fusion of 3 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Crypt-291 (rule
Win.Trojan.Crypt-291) - engine signal, weight 0.90, confidence 0.95 - Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://georgiatechhts.blogspot.com/favicon.ico, http://georgiatechhts.blogspot.com/feeds/posts/default - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://georgiatechhts.blogspot.com/favicon.ico
- http://georgiatechhts.blogspot.com/2014/09/georgia-tech-library-now-open-247.html
- http://georgiatechhts.blogspot.com/feeds/posts/default
- http://georgiatechhts.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/7224898312568815039/posts/default
- http://georgiatechhts.blogspot.com/feeds/4410603997177938087/comments/default
- http://4.bp.blogspot.com/-wfdpCWKAG1c/VCl4pOwZj8I/AAAAAAAABFo/jtn3CyiTn8c/s1600/6087456626_7d85b75b62_m.jpg
- http://4.bp.blogspot.com/-wfdpCWKAG1c/VCl4pOwZj8I/AAAAAAAABFo/jtn3CyiTn8c/w1200-h630-p-k-no-nu/6087456626_7d85b75b62_m.jpg
- http://falconhive.com/2009/05/milano-blogger-template/
- http://falconhive.com
- http://www.hsoc.gatech.edu/blog/casing.jpg
- http://www.hsoc.gatech.edu/blog/top.png
- http://www.hsoc.gatech.edu/blog/IAC_small.png
- http://www.hsoc.gatech.edu/blog/search.png
- http://www.hsoc.gatech.edu/blog/sform.png
- http://www.hsoc.gatech.edu/blog/sbutton.png
- http://www.hsoc.gatech.edu/blog/catmen.jpg
- http://www.hsoc.gatech.edu/blog/catmenhov.jpg
- http://www.hsoc.gatech.edu/blog/add.png
- http://www.hsoc.gatech.edu/blog/sing.png
Embedded domains
- www.w3.org
- www.google.com
- www.blogger.com
- georgiatechhts.blogspot.com
- 4.bp.blogspot.com
- www.web2feel.com
- falconhive.com
- www.hsoc.gatech.edu
- blogspot.com
- connect.facebook.net
- apis.google.com
- pagead2.googlesyndication.com
- www.hts.gatech.edu
- www.library.gatech.edu
- pts.gatech.edu
- weblog.library.gatech.edu
- v2.zopim.com
- 40gmail.com
- 40group.v.calendar.google.com
- www.facebook.com
- twitter.com
- platform.twitter.com
- www.registrar.gatech.edu
- www.advising.gatech.edu
- www.profpractice.gatech.edu
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report