MALICIOUS — f9967f752c58162309bcef6479767c076ef73fc5e9c907610d4cff1fe1b12dfb
MALICIOUS — f9967f752c58162309bcef6479767c076ef73fc5e9c907610d4cff1fe1b12dfb is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the TrojanClicker family. 2 of 54 detection engines flagged it.
Identification
- SHA-256:
f9967f752c58162309bcef6479767c076ef73fc5e9c907610d4cff1fe1b12dfb - SHA-1:
bf7ca34da699de58d6095618ffad9339fe47a279 - MD5:
f60d73a961382983f01fc3d1d8a8cbd0 - ssdeep:
3072:KJ3U3cjvG8rMUcXmNRS75vyKYyLovyKYyLb/sxIdmK673ezKUFyXj:aGXmNR2vyKYyLovyKYyLUKZU - TLSH:
T1683C4B1B3A707D8E40F95153BA8D1A8C20EA4A2BD57B81D9E2E7DB84EC38D605C4C45F - Submitted as: f9967f752c58162309bcef6479767c076ef73fc5e9c907610d4cff1fe1b12dfb
- File type: html · Size: 123393 bytes
- Verdict: malicious (92/100) · Family: TrojanClicker
Detections (2 of 54 engines)
- Microsoft Defender: TrojanClicker:JS/Faceliker.M
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 92/100 is the fusion of 7 weighted signals:
- Microsoft Defender flagged TrojanClicker:JS/Faceliker.M (rule
TrojanClicker:JS/Faceliker.M) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 2 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://bep-hong-ngoai-nhap-khau.blogspot.com/, http://bep-hong-ngoai-nhap-khau.blogspot.com/favicon.ico - static signal, weight 0.35, confidence 0.60
- Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule
windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
280 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- desktop-hsgcbep
- login.live.com
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- edge.microsoft.com
- time.windows.com
- settings-win.data.microsoft.com
- storeedgefd.dsx.mp.microsoft.com
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://bep-hong-ngoai-nhap-khau.blogspot.com/
- http://bep-hong-ngoai-nhap-khau.blogspot.com/favicon.ico
- http://bep-hong-ngoai-nhap-khau.blogspot.com/search/label/ap1.php
- http://bep-hong-ngoai-nhap-khau.blogspot.com/feeds/posts/default
- http://bep-hong-ngoai-nhap-khau.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/4417187255359610405/posts/default
- http://1.bp.blogspot.com/-AszFH56aOIw/T76koNqqtwI/AAAAAAAAA4Q/okXSh4tg-PI/s000/background.jpg
- http://3.bp.blogspot.com/-z2BVdQ0uEbE/T76kooRTbYI/AAAAAAAAA4Y/IPGYx_bBTi4/s000/wrapper-bg.png
- http://2.bp.blogspot.com/-b3ciT32BNL0/T76kozEEtyI/AAAAAAAAA4g/L6R66xYUcYU/s000/date.png
- http://4.bp.blogspot.com/-ycKQR9ZFN1M/T76kpA8lNKI/AAAAAAAAA4o/dfZcqNnpOSw/s000/author.png
- http://4.bp.blogspot.com/-60mSJcP3gf4/T76kpAV80tI/AAAAAAAAA4w/_CApMqBoso4/s000/comments.png
- http://1.bp.blogspot.com/-KcQf_hjvw9U/T76kpdzQBuI/AAAAAAAAA44/S5JLR7Cgt3c/s000/category.png
- http://1.bp.blogspot.com/-RFwusyYvkkM/T76kps9ZAKI/AAAAAAAAA5A/25AqLZfnVbU/s000/tags.png
- http://4.bp.blogspot.com/-_wlGm8FVpy0/T76kqA6-LOI/AAAAAAAAA5I/FD2p1nTjP1c/s000/readmore-bg.png
- http://3.bp.blogspot.com/-K5KGJPhrndQ/T76kqKRVGAI/AAAAAAAAA5Q/tkYzjeOlVZU/s000/widgettitle-bg.png
- http://2.bp.blogspot.com/-z0PYygg5rn4/T76kqUIB3JI/AAAAAAAAA5Y/JeIDBPkOOdI/s000/widget-list.png
- http://3.bp.blogspot.com/-MUiSHTGAoho/T76kqnXespI/AAAAAAAAA5g/kku59_MtbGA/s000/footer-bg.png
- http://1.bp.blogspot.com/-C6au-1zLlUI/T76kqwR9cTI/AAAAAAAAA5o/EyIm9NF6Rxg/s000/search.png
- http://2.bp.blogspot.com/-sbeYMb0ux3g/T76krMNTq_I/AAAAAAAAA5w/0hiKd4QQH9g/s000/comment-avatar.jpg
- http://2.bp.blogspot.com/-LCwoDTIMkV0/UZH_sLftbUI/AAAAAAAAVHc/NrO7qV4i1GM/s1600/icon-slideshare.png
Embedded domains
- www.w3.org
- www.google.com
- www.blogger.com
- bep-hong-ngoai-nhap-khau.blogspot.com
- www.bloggertipandtrick.net
- 1.bp.blogspot.com
- 3.bp.blogspot.com
- 2.bp.blogspot.com
- 4.bp.blogspot.com
- ajax.googleapis.com
- www.opensource.org
- www.gnu.org
- users.tpg.com.au
- jquery.malsup.com
- entry.link
- posttitle.link
- readmorelink.link
- apis.google.com
- blogspot.com
- i1283.photobucket.com
- noithatnamanh.com
- twitter.com
- facebook.com
- plus.google.com
- www.linkedin.com
Embedded IP addresses
- 4.150.223.107
- 52.253.84.76
- 4.230.171.124
- 52.110.12.28
- 52.110.12.15
- 20.42.179.204
- 72.154.7.110
- 52.148.114.188
- 52.110.12.55
- 52.110.12.45
More TrojanClicker samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report