MALICIOUS — 7fa72a60b63204f1264fd850931acd9683148a665f08c4108c2ba26035b385bd

MALICIOUS — 7fa72a60b63204f1264fd850931acd9683148a665f08c4108c2ba26035b385bd is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the Iframe family. 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 7fa72a60b63204f1264fd850931acd9683148a665f08c4108c2ba26035b385bd
• SHA-1: 0b9c6aa37ca41b5ef1ba3b4d60ccd853339dba0d
• MD5: 3ff98cba7fe7ccc3b1ed3ba49a693af2
• File type: html · Size: 53336 bytes
• Verdict: malicious (92/100) · Family: Iframe

Detections (2 of 50 engines)

• Microsoft Defender: Trojan:JS/Iframe!MTB
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

• T1112

Dynamic analysis (windows)

273 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• inference.location.live.net
• ctldl.windowsupdate.com
• login.live.com
• ocsp.digicert.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• oneocsp.microsoft.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• settings-win.data.microsoft.com
• assets.msn.com
• www.bing.com
• licensing.mp.microsoft.com
• tas02.sls.update.microsoft.com
• fe3cr.delivery.mp.microsoft.com
• v10.events.data.microsoft.com

Embedded URLs

• https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css
• http://ondashvideocamera.blogspot.com/favicon.ico
• http://ondashvideocamera.blogspot.com/2013/12/best-deals-acti-5mp-box-with-dn-basic.html
• http://ondashvideocamera.blogspot.com/feeds/posts/default
• http://ondashvideocamera.blogspot.com/feeds/posts/default?alt=rss
• https://draft.blogger.com/feeds/8403186252409469039/posts/default
• http://ondashvideocamera.blogspot.com/feeds/4536736745869072298/comments/default
• https://www.blogger.com/static/v1/jsbin/403901366-ieretrofit.js
• https://lh4.googleusercontent.com/-ERpIcGkzgpM/U0pkVA2JsYI/AAAAAAAABjY/4ROqoYjemPs/41zUNg8z6TL._SL500_.jpg
• https://lh4.googleusercontent.com/-ERpIcGkzgpM/U0pkVA2JsYI/AAAAAAAABjY/4ROqoYjemPs/w1200-h630-p-k-no-nu/41zUNg8z6TL._SL500_.jpg
• https://draft.blogger.com/dyn-css/authorization.css?targetBlogID=8403186252409469039&amp
• https://apis.google.com/js/plusone.js
• http://ondashvideocamera.blogspot.com/
• http://schema.org/BlogPosting
• http://google.com/B00HPXQJ1O/?tag=bestfoodprocr-20
• https://draft.blogger.com/post-edit.g?blogID=8403186252409469039&postID=4536736745869072298&from=pencil
• https://resources.blogblog.com/img/icon18_edit_allbkg.gif
• https://draft.blogger.com/share-post.g?blogID=8403186252409469039&postID=4536736745869072298&target=email
• https://draft.blogger.com/share-post.g?blogID=8403186252409469039&postID=4536736745869072298&target=blog
• https://draft.blogger.com/share-post.g?blogID=8403186252409469039&postID=4536736745869072298&target=twitter
• https://draft.blogger.com/share-post.g?blogID=8403186252409469039&postID=4536736745869072298&target=facebook
• https://draft.blogger.com/share-post.g?blogID=8403186252409469039&postID=4536736745869072298&target=pinterest
• http://ondashvideocamera.blogspot.com/search/label/On%20Dash%20Video%20Camera
• https://draft.blogger.com/comment-iframe.g?blogID=8403186252409469039&postID=4536736745869072298
• https://www.blogger.com/static/v1/jsbin/2517944472-comment_from_post_iframe.js

Embedded domains

• www.blogger.com
• ondashvideocamera.blogspot.com
• draft.blogger.com
• lh4.googleusercontent.com
• www.blogblog.com
• blogspot.com
• apis.google.com
• pagead2.googlesyndication.com
• schema.org
• resources.blogblog.com
• 3.bp.blogspot.com
• google.com

Embedded IP addresses

• 20.50.201.195
• 52.123.252.220
• 4.230.171.124
• 20.42.179.204
• 20.247.184.197
• 135.232.92.137
• 74.179.77.164
• 135.233.95.144
• 20.42.73.24
• 135.234.160.245
• 172.215.188.232
• 74.178.232.29
• 203.26.79.13
• 20.184.175.15
• 20.184.175.22
• 48.199.12.1
• 52.148.114.188
• 72.145.35.105
• 52.110.12.25
• 52.110.12.31

More Iframe samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report