SUSPICIOUS — f94810207cdb52855651b2f495a555e5cc7179c8cee6454dfca4312c213d6096
SUSPICIOUS — f94810207cdb52855651b2f495a555e5cc7179c8cee6454dfca4312c213d6096 is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
f94810207cdb52855651b2f495a555e5cc7179c8cee6454dfca4312c213d6096 - SHA-1:
ce9481f883a5b1d039f0d2a170aec2d014e898d0 - MD5:
665a3adab66451da61462d0c41b42aa1 - ssdeep:
768:70SBS436yDKoTim9K+ixOwHZ+nkppLYRRRg6WpX3dQFer3D/P:70EKyfVK+QOrkppLERSh3dQFer3D/P - TLSH:
T1A234931726A13FEF9AC55005EA9C00AC10A6AFEF482026D9539EDF4C945FFB09058DDE - Submitted as: f94810207cdb52855651b2f495a555e5cc7179c8cee6454dfca4312c213d6096
- File type: html · Size: 54962 bytes
- Verdict: suspicious (54/100)
Detections (2 of 53 engines)
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): Trojan.JS.Agent.UQZ
Why this verdict
The suspicious score of 54/100 is the fusion of 4 weighted signals:
- Obfuscated javascript script: dynamic-exec, defense-evasion (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 26 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://ajayksharma.com/feed/, https://ajayksharma.com/wp-content/uploads/js_composer/js_composer_front_custom.css?ver=3.6.12, https://ajayksharma.com/wp-content/uploads/js_composer/custom.css?ver=3.6.12 - static signal, weight 0.35, confidence 0.60
- Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
277 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- settings-win.data.microsoft.com
Embedded URLs
- https://ajayksharma.com/feed/
- http://ajayksharma.com/wp-content/uploads/2018/09/DSC_0395-400x500.jpg
- https://ajayksharma.com/wp-content/uploads/js_composer/js_composer_front_custom.css?ver=3.6.12
- https://ajayksharma.com/wp-content/uploads/js_composer/custom.css?ver=3.6.12
- https://ajayksharma.com/wp-includes/css/dist/block-library/style.min.css?ver=5.4.8
- https://ajayksharma.com/wp-includes/css/dist/components/style.min.css?ver=5.4.8
- https://fonts.googleapis.com/css?family=Noto+Serif%3A400%2C400i%2C700%2C700i&
- https://ajayksharma.com/wp-includes/css/dist/block-editor/style.min.css?ver=5.4.8
- https://ajayksharma.com/wp-includes/css/dist/nux/style.min.css?ver=5.4.8
- https://ajayksharma.com/wp-includes/css/dist/editor/style.min.css?ver=5.4.8
- https://ajayksharma.com/wp-content/plugins/gallery-images-ape/modules/block/dist/blocks.style.build.css?ver=2.2.6
- https://ajayksharma.com/wp-content/themes/samba/css/custom.css?ver=2.5
- https://ajayksharma.com/wp-content/themes/samba/css/other.css?ver=2.5
- https://ajayksharma.com/wp-content/themes/samba/css/responsive.css?ver=2.5
- https://ajayksharma.com/wp-content/themes/samba-child/style.css?ver=2.5
- https://fonts.googleapis.com/css?family=Open+Sans%3A400italic%2C600italic%2C700italic%2C400%2C600%2C700&
- https://ajayksharma.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
- https://ajayksharma.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
- https://api.w.org/
- https://ajayksharma.com/wp-json/
- https://ajayksharma.com/xmlrpc.php?rsd
- https://ajayksharma.com/wp-includes/wlwmanifest.xml
- https://ajayksharma.com/
- https://ajayksharma.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fajayksharma.com%2F
- https://ajayksharma.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fajayksharma.com%2F&
Embedded domains
- ajayksharma.com
- fonts.googleapis.com
- s.w.org
- st-container.no
- api.w.org
- www.facebook.com
- www.linkedin.com
- twitter.com
- getwpo.com
Embedded IP addresses
- 20.42.65.84
- 52.123.252.227
- 4.230.171.124
- 85.210.196.11
- 52.230.60.54
- 20.165.94.63
- 74.178.240.51
- 52.138.229.67
- 20.76.201.171
- 52.123.128.14
- 52.123.129.14
- 172.178.240.162
- 20.42.179.204
- 52.123.252.195
- 135.232.92.34
- 52.110.12.32
- 52.110.12.31
- 203.26.79.13
- 52.148.114.188
- 20.184.175.11
- 20.42.73.26
- 135.233.95.80
- 72.145.35.109
- 52.110.12.16
- 92.223.78.30
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report