MALICIOUS — ff63fbe8ab190d68f81acca367fff71e1a44e57bf8448398d1fcdc546983f4d2

MALICIOUS — ff63fbe8ab190d68f81acca367fff71e1a44e57bf8448398d1fcdc546983f4d2 is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the Injected family. 3 of 50 detection engines flagged it.

Identification

• SHA-256: ff63fbe8ab190d68f81acca367fff71e1a44e57bf8448398d1fcdc546983f4d2
• SHA-1: 9b8876f2a7a9d987ea56b0974317dc0051f34fb9
• MD5: 6ccd0250bfee0b6cde54d7fac90390f0
• ssdeep: 768:YIOlfnVUKW1t6WvsBZPKBt3FPmS3+EYykK1GPzpiN9sJTPdATgjZ7Nc4hC5orG1Q:+0tVUkkK1GPz6QrG1AJ7
• TLSH: T1FA34615E3C48AF8D8F5E64B21ECDD6B937193A00F5A568CCC3ACFB0455A4C708824D6A
• Submitted as: ff63fbe8ab190d68f81acca367fff71e1a44e57bf8448398d1fcdc546983f4d2
• File type: script · Size: 54786 bytes
• Verdict: malicious (92/100) · Family: Injected

Detections (3 of 50 engines)

• Microsoft Defender: Trojan:JS/Agent.AG!MSR
• Emsisoft (Emergency Kit): GT:JS.Injected.1.55430706
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 92/100 is the fusion of 5 weighted signals:

• Microsoft Defender flagged Trojan:JS/Agent.AG!MSR (rule Trojan:JS/Agent.AG!MSR) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged GT:JS.Injected.1.55430706 (rule GT:JS.Injected.1.55430706) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• Obfuscated javascript script: dynamic-exec, defense-evasion (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Contacted 6 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (linux)

842 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• 20.190.167.20
• ff02::1:3
• 224.0.0.252
• ff02::fb
• 224.0.0.251
• 10.240.0.1
• 74.179.77.204 US · Moses Lake · AS8075 Microsoft Corporation
• 4.247.188.224 IN · Pune · AS8075 Microsoft Corporation
• 149.154.167.99 NL · Amsterdam · AS62041 Telegram Messenger Network
• 239.255.255.250
• 185.125.190.57
• 255.255.255.255
• 185.125.190.58
• ff02::1:ff12:3456
• ff02::16
• ff02::1:2
• ff02::2
• 224.0.0.22

Dropped files

• tmp_tmp.vpOMNkhxFu - 8a0db06f145440b125315dcdc54dfcacd25a982abedc7679d33fb9c10f855146

Embedded domains

• en.wikipedia.org
• h.top
• d.top
• e.top
• t.top
• n.bottom-n.top
• r.top
• n.top
• kenwheeler.github.io
• meastmorning.com

Embedded IP addresses

• 74.179.77.204
• 4.247.188.224
• 149.154.167.99

More Injected samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report