MALICIOUS — fb97f9c75c1de795e94edf29455fbf4936b8e2d350e7fd1bd291201b2a6f6c11
MALICIOUS — fb97f9c75c1de795e94edf29455fbf4936b8e2d350e7fd1bd291201b2a6f6c11 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (81/100). 2 of 54 detection engines flagged it.
Identification
- SHA-256:
fb97f9c75c1de795e94edf29455fbf4936b8e2d350e7fd1bd291201b2a6f6c11 - SHA-1:
3330618e7af87bc55fbd0a487c06c3f05904824c - MD5:
e8b7e84a95a4ff91210a3b55eed52d06 - ssdeep:
48:SadUTq/aBQ4sbcuwsAqu7x3JKp82s1SV5o9ogUCXWXd/GPGhb8D6EJV9ogF4Gj+/:Sad54427LHtlb2/axOyNDsOQ8GrQQj - TLSH:
T1AA27ED283789ACC04997ED1B6477C4B05CBFC2F1A35E52E19B82D6D2854CB1D68B02E7 - Submitted as: fb97f9c75c1de795e94edf29455fbf4936b8e2d350e7fd1bd291201b2a6f6c11
- File type: html · Size: 15759 bytes
- Verdict: malicious (81/100)
Detections (2 of 54 engines)
- Microsoft Defender: Phish:HTML/FakeLogin.PABI!MTB
- Kaspersky (KVRT): Hoax.HTML.Phish.aad
Why this verdict
The malicious score of 81/100 is the fusion of 3 weighted signals:
- Microsoft Defender flagged Phish:HTML/FakeLogin.PABI!MTB (rule
Phish:HTML/FakeLogin.PABI!MTB) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Hoax.HTML.Phish.aad (rule
Hoax.HTML.Phish.aad) - engine signal, weight 0.55, confidence 0.85 - Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Dynamic analysis (windows)
284 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- windows.msn.com
- www.msn.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- edge.microsoft.com
- time.windows.com
- settings-win.data.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded IP addresses
- 20.50.80.215
- 20.247.184.142
- 4.230.171.124
- 57.155.104.224
- 184.84.165.171
- 184.84.165.136
- 52.110.12.53
- 52.110.12.11
- 52.148.114.188
- 72.145.35.104
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report