MALICIOUS — f82cdff1ad87ac0d63c010399bfddf36d5c83e084b1d5c01c0c88378cf09d1b1
MALICIOUS — f82cdff1ad87ac0d63c010399bfddf36d5c83e084b1d5c01c0c88378cf09d1b1 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the TrojanClicker family. 2 of 54 detection engines flagged it.
Identification
- SHA-256:
f82cdff1ad87ac0d63c010399bfddf36d5c83e084b1d5c01c0c88378cf09d1b1 - SHA-1:
6ee4fbf088c6bd59eb276c753b45b3a70b587b5c - MD5:
af9366a0baaddd3f07b40a857bd99c84 - ssdeep:
1536:X0oZVYB40AMY8HYnpBgoZOU+G9bKUPtDuveSsL05gw5JAl2QGlqHLM8YKC9Pd6:X0oZVYlAMYznpBgop59bPhuG8gw5JAlR - TLSH:
T1A83A095F37266ACF04D05A62B56C5AE490CAC6D7D53381E5E6B2EF88D87CC70884C81B - Submitted as: f82cdff1ad87ac0d63c010399bfddf36d5c83e084b1d5c01c0c88378cf09d1b1
- File type: html · Size: 94933 bytes
- Verdict: malicious (92/100) · Family: TrojanClicker
Detections (2 of 54 engines)
- Microsoft Defender: TrojanClicker:JS/Faceliker.M
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 92/100 is the fusion of 7 weighted signals:
- Microsoft Defender flagged TrojanClicker:JS/Faceliker.M (rule
TrojanClicker:JS/Faceliker.M) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 2 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: http://i1227.photobucket.com/albums/ee434/Faqihah_Husni/stripsMERAH.jpg, http://code.jquery.com/jquery-latest.js, https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css - static signal, weight 0.35, confidence 0.60
- Extracted generic config (13 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
277 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- windows.msn.com
- www.msn.com
- settings-win.data.microsoft.com
- assets.msn.com
- www.bing.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
- slscr.update.microsoft.com
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- http://i1227.photobucket.com/albums/ee434/Faqihah_Husni/stripsMERAH.jpg
- http://code.jquery.com/jquery-latest.js
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://aindonashi.blogspot.com/favicon.ico
- http://aindonashi.blogspot.com/2012/07/fruity-fruits.html
- http://aindonashi.blogspot.com/feeds/posts/default
- http://aindonashi.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/8094287455951500669/posts/default
- http://aindonashi.blogspot.com/feeds/4045562287344216778/comments/default
- http://25.media.tumblr.com/tumblr_lmw3pu5kDB1qln6ego1_500.jpg
- http://www.mediafire.com/?lqe8c1c4a1booag
- https://lh5.googleusercontent.com/proxy/iLg4PkvzLMnl1ptDZuUUhpL2AcPtpABPBB5igaVsAATt4uJrhWXEzD2cIL2J6ikqxdEGILo5gVjiDDlDIN7n5sYpNF5_2_wffR-qSsGadSS5=w1200-h630-p-k-no-nu
- http://aindonashi.blogspot.com
- http://2.bp.blogspot.com/-RHtaXFBIsTw/T5T6PylbuhI/AAAAAAAABRs/Ft5y4uynwQM/s1600/pink-background-pink-flower.gif
- http://i1218.photobucket.com/albums/dd417/cheesweet/backgroundbody3.png
- http://t1.gstatic.com/images?q=tbn:ANd9GcTItgkqa9-lnMoHQ_yhloZtCEfGH9f1kGkQxqOVpCK3tJBOJGHzqg
- http://3.bp.blogspot.com/-N9V5nWd1-QY/Tubt4iY8DxI/AAAAAAAABCo/vRWsldTH6uM/s1600/vintagebackground+%25281%2529.png
- http://farm4.staticflickr.com/3582/3413077928_1c55a2440c.jpg
- http://4.bp.blogspot.com/_p4Te9Li52fs/So9a2fSh2jI/AAAAAAAAAAc/VX0mAW1oYHc/thumb_bg.png
- http://dl5.glitter-graphics.net/pub/638/638145bltz6zqhdo.gif
- https://ajax.googleapis.com/ajax/libs/jquery/1.6.1/jquery.min.js
Embedded domains
- www.w3.org
- www.google.com
- i1227.photobucket.com
- code.jquery.com
- www.blogger.com
- fonts.gstatic.com
- aindonashi.blogspot.com
- 25.media.tumblr.com
- www.mediafire.com
- lh5.googleusercontent.com
- 2.bp.blogspot.com
- i1218.photobucket.com
- t1.gstatic.com
- 3.bp.blogspot.com
- farm4.staticflickr.com
- 4.bp.blogspot.com
- dl5.glitter-graphics.net
- ajax.googleapis.com
- blogspot.com
- 1.bp.blogspot.com
- static.tumblr.com
- apis.google.com
- pagead2.googlesyndication.com
- i1231.photobucket.com
- resources.blogblog.com
Embedded IP addresses
- 20.42.73.31
- 52.123.252.248
- 4.230.171.124
- 172.215.188.225
- 135.232.92.97
- 20.42.65.88
- 74.178.76.128
- 20.184.175.5
- 20.247.184.142
- 74.179.77.204
- 57.154.63.210
- 172.215.188.232
- 172.66.2.5
- 52.123.252.193
- 74.178.76.44
- 203.26.79.13
- 52.110.12.47
- 52.110.12.8
- 52.110.12.14
- 52.110.12.31
- 72.153.5.63
- 52.148.114.188
More TrojanClicker samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report