MALICIOUS — fe94b25e630257483fe43121b14418badee44a44205e93a5db6e45023841444e
MALICIOUS — fe94b25e630257483fe43121b14418badee44a44205e93a5db6e45023841444e is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100). 2 of 54 detection engines flagged it.
Identification
- SHA-256:
fe94b25e630257483fe43121b14418badee44a44205e93a5db6e45023841444e - SHA-1:
dc132263b9ce4fcc471fefecaa63dd52f99da215 - MD5:
43fb5d4a431bbf45bb85415e063a2f82 - ssdeep:
768:HOT0EipBnqauT3B817aB6/ivs6ZIf0qRx02ZLdbaw1I2fCuTn/:uTupBnqauT3BT6/ikRfW2J1H1b - TLSH:
T1B134A825360E368F1060C012566C1F95C1C6C6EB767781F5D6A3FFC5EA29EA05C2E8B2 - Submitted as: fe94b25e630257483fe43121b14418badee44a44205e93a5db6e45023841444e
- File type: html · Size: 54249 bytes
- Verdict: malicious (91/100)
Detections (2 of 54 engines)
- Microsoft Defender: Trojan:JS/Iframeinject.AH
- Kaspersky (KVRT): Trojan-Downloader.JS.Iframe.dfw
Why this verdict
The malicious score of 91/100 is the fusion of 6 weighted signals:
- Microsoft Defender flagged Trojan:JS/Iframeinject.AH (rule
Trojan:JS/Iframeinject.AH) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Trojan-Downloader.JS.Iframe.dfw (rule
Trojan-Downloader.JS.Iframe.dfw) - engine signal, weight 0.55, confidence 0.85 - Obfuscated powershell script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://heartwarminghearty2009.blogspot.com/favicon.ico, http://heartwarminghearty2009.blogspot.com/search/label/rambler%20classic - static signal, weight 0.35, confidence 0.60
- Extracted generic config (13 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
279 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- officeclient.microsoft.com
- www.msn.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- licensing.mp.microsoft.com
- assets.msn.com
- www.bing.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://heartwarminghearty2009.blogspot.com/favicon.ico
- http://heartwarminghearty2009.blogspot.com/search/label/rambler%20classic
- http://heartwarminghearty2009.blogspot.com/feeds/posts/default
- http://heartwarminghearty2009.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/6777650751576748576/posts/default
- https://www.blogger.com/profile/07204115767096175373
- https://www.blogger.com/dyn-css/authorization.css?targetBlogID=6777650751576748576&
- https://apis.google.com/js/plusone.js
- http://heartwarminghearty2009.blogspot.com/
- http://heartwarminghearty2009.blogspot.com/2011/08/wpsamc1963-rambler-classic-550-cross.html
- http://www.dizoo.net/creations/archives/missmp_1201378958.jpg
- http://www.kyosho.com/blog/diecast_overseas/log/image/img09070013_1.jpg
- http://forums.rennlist.com/upload/p1010069.jpgs.jpg
- http://www.iveho.com/wp-content/uploads/2011/05/2013_Malibu_ECO_027.jpg
- http://www.carpictures1.com/data/media/24/Chevrolet_Camaro_interior_design_2_lg.jpg
- http://prilohy.idnes.cz/pearlharbor/scripts/imgs/foto_velke/d4sheltc.jpg
- http://www.rocknrollmotors.co.uk/images/mercrearseat.jpg
- http://mathewsonsautomotive.com/wp-content/uploads/2011/05/1952-desoto.jpg
- http://www.eleves.ens.fr/home/mbouaziz/arabe/sources/fille.jpg
- http://www.curbsideclassic.com/wp-content/uploads/2011/04/1-029.jpg
Embedded domains
- www.w3.org
- www.google.com
- www.blogger.com
- heartwarminghearty2009.blogspot.com
- blogspot.com
- apis.google.com
- pagead2.googlesyndication.com
- www.dizoo.net
- www.kyosho.com
- forums.rennlist.com
- www.iveho.com
- www.carpictures1.com
- www.rocknrollmotors.co.uk
- mathewsonsautomotive.com
- www.eleves.ens.fr
- www.curbsideclassic.com
- www.fordforumsonline.com
- www.freeimagehosting.net
- 4.bp.blogspot.com
- i927.photobucket.com
- th07.deviantart.net
- blog.hemmings.com
- www.mustangeleanor.net
- i3.photobucket.com
- pic.phyrefile.com
Embedded IP addresses
- 52.168.112.67
- 40.84.97.4
- 4.230.171.124
- 20.247.184.197
- 48.211.4.16
- 20.165.94.54
- 74.179.77.204
- 40.79.150.121
- 74.178.76.128
- 51.11.192.48
- 72.145.35.107
- 52.148.114.188
- 52.110.12.4
- 52.110.12.11
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report