SUSPICIOUS — f55c96a11f89cf3462b6b2990fd5af0ed6677a6a0c5b835fea1056e0245b3e29

SUSPICIOUS — f55c96a11f89cf3462b6b2990fd5af0ed6677a6a0c5b835fea1056e0245b3e29 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 50 detection engines flagged it.

Identification

• SHA-256: f55c96a11f89cf3462b6b2990fd5af0ed6677a6a0c5b835fea1056e0245b3e29
• SHA-1: f2d96408e4558d0c921b562c8f0d019522b11b31
• MD5: 9ce0751a5a1a28abe68914ac04659589
• ssdeep: 192:3gPImHr7v3Z0Q7vunl7vFZ7vAnuFwrFNFug0g5odq+JjzvL5mV5/yaXo7g0S:wPLvZ0O+fInt9uk+NTL5mV5/yKo7s
• TLSH: T12B27840175242B7D786C07479634F8F9A005BE8A633EDFE84FD9AD8029D1A3842B46DD
• Submitted as: f55c96a11f89cf3462b6b2990fd5af0ed6677a6a0c5b835fea1056e0245b3e29
• File type: html · Size: 15778 bytes
• Verdict: suspicious (54/100)

Detections (1 of 50 engines)

• Microsoft Defender: VirTool:JS/Obfuscator.BS

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://utarget.ru/ranging/8cf18a626b/js/?rand=, http://gmpg.org/xfn/11, http://www.ugodie.narod.ru/rss.xml - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://utarget.ru/ranging/8cf18a626b/js/?rand=
• http://www.w3.org/1999/xhtml
• http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd
• http://gmpg.org/xfn/11
• http://www.ugodie.narod.ru/rss.xml
• http://www.ugodie.narod.ru/feed/atom/
• http://blog.deconcept.com/swfobject/
• http://www.ugodie.narod.ru/xmlrpc.php
• http://www.ugodie.narod.ru/xmlrpc.php?rsd
• http://www.ugodie.narod.ru
• http://www.ugodie.narod.ru/map.html
• http://www.gala-med2008.narod.ru/lechenie-alkogolizma-podolsk.html
• http://www.narcocenter2008.narod.ru/alkogolizm-lechenie-noveyshee-alkogolizma.html
• http://www.narco-city2008.narod.ru/3-stadiya-alkogolizma.html
• http://www.pmed2008.narod.ru/alkogolizm-kemerovskaya-oblast.html
• http://www.doctorsan2008.narod.ru/alkogolizm-depressii.html
• http://www.centerys2008.narod.ru/rezultaty-alkogolizma.html
• http://www.drug-help.narod.ru/sit-lechenie-alkogolizma.html
• http://www.alcoclinic2008.narod.ru/alkogolizm-nizhnevartovsk.html
• http://www.ucoz.ru/

Embedded domains

• counter.yadro.ru
• utarget.ru
• ugodie.narod.ru
• s206.ucoz.net
• www.w3.org
• gmpg.org
• www.ugodie.narod.ru
• deconcept.com
• blog.deconcept.com
• www.gala-med2008.narod.ru
• www.narcocenter2008.narod.ru
• www.narco-city2008.narod.ru
• www.pmed2008.narod.ru
• www.doctorsan2008.narod.ru
• www.centerys2008.narod.ru
• www.drug-help.narod.ru
• www.alcoclinic2008.narod.ru
• www.ucoz.ru

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report