SUSPICIOUS — f99564a7f039b8f50c144ab91c547565815fe4a87ca4ed41447841dd7be0046c
SUSPICIOUS — f99564a7f039b8f50c144ab91c547565815fe4a87ca4ed41447841dd7be0046c is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 0 of 54 detection engines flagged it.
Identification
- SHA-256:
f99564a7f039b8f50c144ab91c547565815fe4a87ca4ed41447841dd7be0046c - SHA-1:
71916abb35ffc306ddd8446e5da285d2478594f1 - MD5:
0b9baca54ff19e08d46ca9e4a392d963 - ssdeep:
1536:vKCWX1F5kC/djrY6qvKGiGrBmJhw6oM9DARAb2xi4cPnEFKY/iCEx9tUQqP1oM9q:vKCWX1F5kC/djrY6qvKGiGrBmVoM9DAk - TLSH:
T1A536EB1228A06FE3C4982034FA8D999475D1E65BB934B9C1D6EF9FCEC424BE0F094467 - Submitted as: f99564a7f039b8f50c144ab91c547565815fe4a87ca4ed41447841dd7be0046c
- File type: html · Size: 65024 bytes
- Verdict: suspicious (54/100)
Detections (0 of 54 engines)
No engine flagged this sample.
Why this verdict
The suspicious score of 54/100 is the fusion of 4 weighted signals:
- Obfuscated javascript script: dynamic-exec (layers: base64) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://www.nexusconsultoriacontabil.com.br/, https://www.nexusconsultoriacontabil.com.br/modules/mod_bt_contentslider/tmpl/css/btcontentslider.css, https://www.nexusconsultoriacontabil.com.br/modules/mod_bt_contentslider/tmpl/js/slides.js - static signal, weight 0.35, confidence 0.60
- Extracted generic config (17 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
278 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- fe3cr.delivery.mp.microsoft.com
- settings-win.data.microsoft.com
- slscr.update.microsoft.com
Embedded URLs
- https://www.nexusconsultoriacontabil.com.br/
- https://www.nexusconsultoriacontabil.com.br/modules/mod_bt_contentslider/tmpl/css/btcontentslider.css
- https://www.nexusconsultoriacontabil.com.br/modules/mod_bt_contentslider/tmpl/js/slides.js
- https://www.nexusconsultoriacontabil.com.br/modules/mod_bt_contentslider/tmpl/js/default.js
- https://www.nexusconsultoriacontabil.com.br/modules/mod_bt_contentslider/tmpl/js/jquery.easing.1.3.js
- https://www.googletagmanager.com/gtag/js?id=UA-48332283-1
- https://www.nexusconsultoriacontabil.com.br/media/nextend/n2-ss-2/n2-ss-2.css?1538279492
- https://www.nexusconsultoriacontabil.com.br/media/nextend/n2/n2.js?1538279492
- https://www.nexusconsultoriacontabil.com.br/libraries/nextend2/nextend/media/dist/nextend-gsap.min.js?1538276997
- https://www.nexusconsultoriacontabil.com.br/libraries/nextend2/nextend/media/dist/nextend-frontend.min.js?1538276992
- https://www.nexusconsultoriacontabil.com.br/libraries/nextend2/smartslider/media/dist/smartslider-frontend.min.js?1538277003
- https://www.nexusconsultoriacontabil.com.br/libraries/nextend2/smartslider/media/plugins/type/simple/simple/dist/smartslider-simple-type-frontend.min.js?1538279031
- https://www.nexusconsultoriacontabil.com.br/libraries/nextend2/nextend/media/dist/nextend-webfontloader.min.js?1538276995
- https://www.nexusconsultoriacontabil.com.br/media/nextend/n2-ss-2/n2-ss-2.js?1538279492
- https://www.dominioatendimento.com:82/login.html
- https://www.nexusconsultoriacontabil.com.br//modules/mod_bt_contentslider/tmpl/images/loading.gif
- https://goo.gl/maps/ccj8EhxTESq
- https://www.facebook.com/NexusConsultoriaContabil
- http://www.dableo.com.br
- http://www.w3.org/2000/svg
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- www.nexusconsultoriacontabil.com.br
- www.googletagmanager.com
- www.dominioatendimento.com
- nexus.com.br
- www.facebook.com
- www.dableo.com.br
- jb.cookie.top
- jb.decline.link
- nexusconsultoriacontabil.com.br
- goo.gl
- www.w3.org
Embedded IP addresses
- 242.252.36.54
- 51.11.192.48
- 52.230.59.222
- 52.123.252.239
- 4.230.171.124
- 135.232.92.97
- 172.215.188.232
- 20.165.94.63
- 4.150.223.97
- 20.184.175.21
- 13.89.179.12
- 48.211.4.16
- 72.153.5.135
- 52.148.114.188
- 52.110.12.32
- 52.110.12.26
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report