SUSPICIOUS — fe3e20075efccacd4c92618f87dbe3f763e7ef876e43be6a0866fdf3a5734e34

SUSPICIOUS — fe3e20075efccacd4c92618f87dbe3f763e7ef876e43be6a0866fdf3a5734e34 is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: fe3e20075efccacd4c92618f87dbe3f763e7ef876e43be6a0866fdf3a5734e34
• SHA-1: 4351de7103c2e1f9279dbea9c9d25f9994c14727
• MD5: 75f26d1ef42b74d9e35617695d698a88
• ssdeep: 96:lGfrrncMia+5rLHeCbMmXygFtFMssTaajfNBvDEmppC28clS+2fP68ku:lsrTcda+5rLHDbM+yGFnsTaajfNBDps/
• TLSH: T15E1BA6D66CC95EECC80EE1677F4FB4CB3F4ADA1276524484828D970918B68C13C1C636
• Submitted as: fe3e20075efccacd4c92618f87dbe3f763e7ef876e43be6a0866fdf3a5734e34
• File type: script · Size: 5180 bytes
• Verdict: suspicious (54/100)

Detections (2 of 53 engines)

• Microsoft Defender: Trojan:JS/Agent.AG!MSR
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: http://brm.io/jquery-match-height/ - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://brm.io/jquery-match-height/

Embedded domains

• brm.io
• duilawyersbrampton.ca

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report