SUSPICIOUS — f6951c12bd283646f39ce709a1fafaa7368dfd0b395235e5111eade78d96c567

SUSPICIOUS — f6951c12bd283646f39ce709a1fafaa7368dfd0b395235e5111eade78d96c567 is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: f6951c12bd283646f39ce709a1fafaa7368dfd0b395235e5111eade78d96c567
• SHA-1: c09f2970477f06f620fd119c32bf02898412e6bf
• MD5: b75c19e1b738e451670ed5dc3c39a271
• ssdeep: 384:7eWk5QRqhaFKTWKFaTOqU5SEhy6ya0FmDj5OhSu0LSah4A5Pks+u:7eWk5RhaFKTWKFauSEE6ya0FmDj51u0j
• TLSH: T1B92B8697BC88FFED981C62219D9EB537762B0875382594CC47BCCB849CB84B50C1CA66
• Submitted as: f6951c12bd283646f39ce709a1fafaa7368dfd0b395235e5111eade78d96c567
• File type: script · Size: 22391 bytes
• Verdict: suspicious (54/100)

Detections (2 of 53 engines)

• Microsoft Defender: Trojan:JS/Agent.AG!MSR
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://wpbakery.com, http://go.wpbakery.com/licensing, https://assets.pinterest.com/js/pinit.js - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://wpbakery.com
• http://go.wpbakery.com/licensing
• https://apis.google.com/js/plusone.js
• https://assets.pinterest.com/js/pinit.js

Embedded domains

• wpbakery.com
• go.wpbakery.com
• apis.google.com
• assets.pinterest.com
• espaceseptsursept.fr

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report