MALICIOUS — f9963fe38500fb5daef0b379a7aeac1ebdfef208db2854e305c51998e264a554

MALICIOUS — f9963fe38500fb5daef0b379a7aeac1ebdfef208db2854e305c51998e264a554 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the Wacatac family. 1 of 54 detection engines flagged it.

Identification

SHA-256: f9963fe38500fb5daef0b379a7aeac1ebdfef208db2854e305c51998e264a554
SHA-1: 6c8eb847627e683cd8294f9ca159c85c1e907fd5
MD5: 2f05358c7c7ff4209a4c9e1c29f1da05
ssdeep: 768:r7Gu4hsfOblxAVwhFVOZCPxHY96x9yX0RO/AcqXT/:ryu4WfOblxAVwhFVOZCPxHY96x9yX0RD
TLSH: T18F2D942441707B6A58D80942F46948C0E092FF8E68B7F8D08E66DB4EF56DD3098B95CF
Submitted as: f9963fe38500fb5daef0b379a7aeac1ebdfef208db2854e305c51998e264a554
File type: html · Size: 27124 bytes
Verdict: malicious (84/100) · Family: Wacatac

Detections (1 of 54 engines)

Microsoft Defender: Trojan:Script/Wacatac.B!ml

Why this verdict

The malicious score of 84/100 is the fusion of 6 weighted signals:

Microsoft Defender flagged Trojan:Script/Wacatac.B!ml (rule Trojan:Script/Wacatac.B!ml) - engine signal, weight 0.55, confidence 0.85
Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://newbeginningcog.com, http://newbeginningcog.com/feed/, http://newbeginningcog.com/wp-content/themes/churchope - static signal, weight 0.35, confidence 0.60
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

278 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://newbeginningcog.com
http://newbeginningcog.com/feed/
http://newbeginningcog.com/wp-content/themes/churchope
http://newbeginningcog.com/wp-content/plugins/easy-modal/assets/styles/easy-modal-site.css?ver=0.1
http://newbeginningcog.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=4.5
http://newbeginningcog.com/wp-content/themes/churchope/css/main.css
http://newbeginningcog.com/wp-content/themes/churchope/js/prettyphoto/css/prettyPhoto.css
http://newbeginningcog.com/wp-content/themes/churchope/css/skin.css?ver=4.7.21
http://newbeginningcog.com/wp-includes/js/jquery/jquery.js?ver=1.12.4
http://newbeginningcog.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
http://newbeginningcog.com/wp-content/themes/churchope/js/modernizr-2.5.3.min.js
https://api.w.org/
http://newbeginningcog.com/wp-json/
http://newbeginningcog.com/wp-json/oembed/1.0/embed?url=http%3A%2F%2Fnewbeginningcog.com%2F
http://newbeginningcog.com/wp-json/oembed/1.0/embed?url=http%3A%2F%2Fnewbeginningcog.com%2F&#038
http://www.newbeginningcog.com/wp-content/uploads/2013/02/cog_black.jpg
http://newbeginningcog.com/
http://newbeginningcog.com/wp-content/themes/churchope/style.css
http://browsehappy.com/
http://www.google.com/chromeframe/?redirect=true
http://www.newbeginningcog.com/wp-content/uploads/2013/02/Logo2008-e1359778510246.jpg
http://newbeginningcog.com/th_event/bible-study-wnbs/
http://newbeginningcog.com/visitor-info/
http://newbeginningcog.com/visitor-info/meet-our-pastor/
http://newbeginningcog.com/visitor-info/who-we-are/

Embedded domains

newbeginningcog.com
s.w.org
api.w.org
www.newbeginningcog.com
browsehappy.com
www.google.com
www.facebook.com
coin-hive.com
facebook.com

Embedded IP addresses

51.11.192.48
52.230.59.222
52.123.252.248
4.230.171.124
135.232.92.97
172.215.188.232
4.150.223.97
20.165.94.63
72.153.5.135
52.148.114.188
52.110.12.26
52.110.12.56

More Wacatac samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report