MALICIOUS — fc20da1e08c170c2a45629ae13338fc4ffe87ca2d9b98b94cd9f37e419d63534

MALICIOUS — fc20da1e08c170c2a45629ae13338fc4ffe87ca2d9b98b94cd9f37e419d63534 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 2 of 54 detection engines flagged it.

Identification

SHA-256: fc20da1e08c170c2a45629ae13338fc4ffe87ca2d9b98b94cd9f37e419d63534
SHA-1: d3ab95dc2788fadb1d34e1dd5cc8089d21c883e6
MD5: ad7b62bb46ef8484ec977cab6cad6338
ssdeep: 1536:G9IRIOITIwIgI1KZgNDxIwIGI5IKJ7S6IRIOITIwIgI2KZgND2IwIGI5ImJ7So18:S199/WezTFUL
TLSH: T1C2333045AA4B8D8F908B064D52510F84B49DD98E41A2DBDFF0E4CD2ADD9FB10C26C8DB
Submitted as: fc20da1e08c170c2a45629ae13338fc4ffe87ca2d9b98b94cd9f37e419d63534
File type: html · Size: 51004 bytes
Verdict: malicious (92/100)

Detections (2 of 54 engines)

Microsoft Defender: Trojan:HTML/Phish.B!atmn
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 92/100 is the fusion of 7 weighted signals:

Microsoft Defender flagged Trojan:HTML/Phish.B!atmn (rule Trojan:HTML/Phish.B!atmn) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
Obfuscated javascript script: dynamic-exec (layers: char-code+concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://ogp.me/ns/fb#, http://xamfund.weebly.com/uploads/1/2/6/7/126735946/872746900_orig.png, http://xamfund.weebly.com/uploads/1/2/6/7/126735946/660671036_orig.jpg - static signal, weight 0.35, confidence 0.60
Extracted generic config (4 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

280 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://ogp.me/ns/fb#
http://xamfund.weebly.com/uploads/1/2/6/7/126735946/872746900_orig.png
http://xamfund.weebly.com/uploads/1/2/6/7/126735946/660671036_orig.jpg
http://xamfund.weebly.com/2/post/2020/08/download-passport-photo-maker-serial-key.html
https://fonts.googleapis.com/css?family=Poppins:400
https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
https://www.google.com/recaptcha/api.js
https://xamfund.weebly.com/2/post/2020/08/download-passport-photo-maker-serial-key.html
http://twitter.com/share?url=https://xamfund.weebly.com/2/post/2020/08/download-passport-photo-maker-serial-key.html
http://xamfund.weebly.com/blog/download-passport-photo-maker-serial-key&is_mobile=&r=3&is_light=0
https://www.weebly.com/signup?utm_source=internal&utm_medium=footer
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

ogp.me
xamfund.weebly.com
fonts.googleapis.com
cdn2.editmysite.com
cdn1.editmysite.com
ajax.googleapis.com
www.weebly.com
www.google.com
twitter.com
google-analytics.com
test.name
ec.editmysite.com
connect.facebook.net
tter.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

10.0.7.3
10.0.7.2
10.0.4.198
3.0.1.0
8.2.0.1
52.168.117.169
52.123.252.229
4.230.171.124
48.211.4.16
57.154.63.210
74.179.77.204
74.178.76.54
20.184.175.1
52.253.84.76
20.184.175.0
104.18.33.89
52.110.12.20
52.110.12.47
4.247.188.233
72.145.35.109
52.148.114.188
52.110.12.15

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report