SUSPICIOUS — fe47c899d05a1f5bafd6f9432e67c58fb6091399d6387b70a0fcb541895896b4
SUSPICIOUS — fe47c899d05a1f5bafd6f9432e67c58fb6091399d6387b70a0fcb541895896b4 is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
fe47c899d05a1f5bafd6f9432e67c58fb6091399d6387b70a0fcb541895896b4 - SHA-1:
37b801d004c8c8dabe0ac700d96b426110a48629 - MD5:
11deb4841697d5cacf6b9cd40fe0f3bc - ssdeep:
6144:+7duZaFp88GYXbrqZFj8NrlHZBnej2vQzWIed:+huMFp88GYXnsjUhIk - TLSH:
T1A9491A6F7C8C5F8FCD0EA48A7E8CA8DD77136E95745354C4C2BCD78C99A08A05C5882A - Submitted as: fe47c899d05a1f5bafd6f9432e67c58fb6091399d6387b70a0fcb541895896b4
- File type: script · Size: 409336 bytes
- Verdict: suspicious (54/100)
Detections (2 of 53 engines)
- Microsoft Defender: Trojan:JS/Agent.AG!MSR
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated powershell script: dynamic-exec, defense-evasion (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: http://flesler.blogspot.com, http://scriptpie.com/cubeportfolio/live-preview/, http://codecanyon.net/licenses - static signal, weight 0.35, confidence 0.60
Dynamic analysis (windows)
1255 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- desktop-hsgcbep
- 250.255.255.239.in-addr.arpa
- ntp.ubuntu.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded URLs
- http://flesler.blogspot.com
- http://scriptpie.com/cubeportfolio/live-preview/
- http://codecanyon.net/licenses
- http://embed.ted.com/talks/
- http://cameronspear.com/blog/twitter-bootstrap-dropdown-on-hover-plugin/
- http://scottjehl.github.io/picturefill
- https://github.com/scottjehl/picturefill/blob/master/Authors.txt
- http://www.w3.org/TR/SVG11/feature#Image
- http://img.youtube.com/vi/
- http://vimeo.com/api/v2/video/
- http://www.youtube.com/embed/
- http://player.vimeo.com/video/
- http://css-tricks.com
- http://daverupert.com
- http://www.alistapart.com/articles/creating-intrinsic-ratios-for-video/
- http://sam.zoy.org/wtfpl/
- https://github.com/toddmotto/fluidvids/blob/master/dist/fluidvids.js
- http://isotope.metafizzy.co
- https://api.instagram.com/v1
- http://www.opensource.org/licenses/mit-license.php
- http://www.gnu.org/licenses/gpl.html
- http://www.youtube.com/watch?v=opj24KnzrWo
- http://www.youtube.com/embed/opj24KnzrWo
- http://youtu.be/opj24KnzrWo
- http://www.youtube-nocookie.com/embed/opj24KnzrWo
Embedded domains
- flesler.blogspot.com
- scriptpie.com
- codecanyon.net
- f.bottom-f.top
- d.top
- c.style.top
- b.top
- d.style.top
- www.youtube.com
- player.vimeo.com
- embed.ted.com
- j.top
- e.top
- f.top
- e.style.top
- cameronspear.com
- scottjehl.github.io
- github.com
- www.w3.org
- a.vimeocdn.com
- console.info
- e.prototype.to
- this.to
- b.property.name
- a.property.name
Embedded IP addresses
- 52.123.252.198
- 52.110.12.54
- 172.215.188.225
- 4.230.171.124
- 4.155.94.154
- 74.178.76.128
- 74.178.240.51
- 52.123.128.14
- 13.89.179.12
- 74.179.71.159
- 203.26.79.13
- 52.123.252.222
- 4.209.250.170
- 20.184.175.20
- 52.148.114.188
- 142.250.183.35
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report