Windows Analysis Report
http://pemulihan-akun.dana-24.webappsystem.com/

Overview

General Information

Sample URL:	http://pemulihan-akun.dana-24.webappsystem.com/
Analysis ID:	1448173
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Phishing site detected (based on logo match)

HTML body contains low number of good links

None HTTPS page querying sensitive user data (password, username or email)

Suspicious form URL found

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://pemulihan-akun.dana-24.webappsystem.com/	Avira URL Cloud: detection malicious, Label: phishing
Source: http://pemulihan-akun.dana-24.webappsystem.com/	SlashNext: detection malicious, Label: Fraudulent Website type: Phishing & Social usering

Antivirus detection for URL or domain

Source: http://pemulihan-akun.dana-24.webappsystem.com/img/logo-ojk.png	Avira URL Cloud: Label: phishing
Source: http://pemulihan-akun.dana-24.webappsystem.com/img/2.png	Avira URL Cloud: Label: phishing
Source: http://pemulihan-akun.dana-24.webappsystem.com/img/1.png	Avira URL Cloud: Label: phishing

Phishing

Phishing site detected (based on logo match)

Source: http://pemulihan-akun.dana-24.webappsystem.com/

Matcher: Template: visa matched

HTML body contains low number of good links

Source: http://pemulihan-akun.dana-24.webappsystem.com/

HTTP Parser: Number of links: 0

None HTTPS page querying sensitive user data (password, username or email)

Source: http://pemulihan-akun.dana-24.webappsystem.com/

HTTP Parser: Has password / email / username input fields

Suspicious form URL found

Source: http://pemulihan-akun.dana-24.webappsystem.com/	HTTP Parser: Form action: login.php
Source: http://pemulihan-akun.dana-24.webappsystem.com/	HTTP Parser: Form action: login.php
Source: http://pemulihan-akun.dana-24.webappsystem.com/	HTTP Parser: Form action: login.php

Source: http://pemulihan-akun.dana-24.webappsystem.com/	HTTP Parser: No <meta name="author".. found
Source: http://pemulihan-akun.dana-24.webappsystem.com/	HTTP Parser: No <meta name="author".. found
Source: http://pemulihan-akun.dana-24.webappsystem.com/	HTTP Parser: No <meta name="author".. found

Source: http://pemulihan-akun.dana-24.webappsystem.com/	HTTP Parser: No <meta name="copyright".. found
Source: http://pemulihan-akun.dana-24.webappsystem.com/	HTTP Parser: No <meta name="copyright".. found
Source: http://pemulihan-akun.dana-24.webappsystem.com/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.6:49734 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ionicons/2.0.1/css/ionicons.min.css HTTP/1.1Host: code.ionicframework.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://pemulihan-akun.dana-24.webappsystem.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/3.3.5/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://pemulihan-akun.dana-24.webappsystem.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/jquery/3.5.1/jquery.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://pemulihan-akun.dana-24.webappsystem.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: pemulihan-akun.dana-24.webappsystem.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/1.png HTTP/1.1Host: pemulihan-akun.dana-24.webappsystem.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://pemulihan-akun.dana-24.webappsystem.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/2.png HTTP/1.1Host: pemulihan-akun.dana-24.webappsystem.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://pemulihan-akun.dana-24.webappsystem.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/logo-ojk.png HTTP/1.1Host: pemulihan-akun.dana-24.webappsystem.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://pemulihan-akun.dana-24.webappsystem.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/1.png HTTP/1.1Host: pemulihan-akun.dana-24.webappsystem.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/logo-ojk.png HTTP/1.1Host: pemulihan-akun.dana-24.webappsystem.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/2.png HTTP/1.1Host: pemulihan-akun.dana-24.webappsystem.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: pemulihan-akun.dana-24.webappsystem.com
Source: global traffic	DNS traffic detected: DNS query: a.m.dana.id
Source: global traffic	DNS traffic detected: DNS query: app.link
Source: global traffic	DNS traffic detected: DNS query: api2.branch.io
Source: global traffic	DNS traffic detected: DNS query: code.ionicframework.com
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: cdn.lr-ingest.io
Source: global traffic	DNS traffic detected: DNS query: sentry.io
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.dana.id

Source: chromecache_54.2.dr	String found in binary or memory: http://creativecommons.org/licenses/by/4.0/
Source: chromecache_59.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_54.2.dr	String found in binary or memory: http://ionicons.com/
Source: chromecache_52.2.dr	String found in binary or memory: https://a.m.dana.id
Source: chromecache_52.2.dr	String found in binary or memory: https://a.m.dana.id/danaweb/web/dana-meta-logo.png
Source: chromecache_52.2.dr	String found in binary or memory: https://api2.branch.io
Source: chromecache_52.2.dr	String found in binary or memory: https://app.link
Source: chromecache_52.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap
Source: chromecache_52.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/slick-carousel
Source: chromecache_52.2.dr	String found in binary or memory: https://cdn.lr-ingest.io
Source: chromecache_52.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js
Source: chromecache_52.2.dr	String found in binary or memory: https://code.ionicframework.com/ionicons/2.0.1/css/ionicons.min.css
Source: chromecache_52.2.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Open
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B4gaVI
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B4iaVI
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B4jaVI
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B4kaVI
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B4saVI
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B4taVI
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B4uaVI
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B4vaVI
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B5OaVI
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B5caVI
Source: chromecache_69.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_54.2.dr	String found in binary or memory: https://github.com/driftyco/ionicons
Source: chromecache_54.2.dr	String found in binary or memory: https://github.com/google/material-design-icons
Source: chromecache_69.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_52.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css
Source: chromecache_52.2.dr	String found in binary or memory: https://sentry.io
Source: chromecache_54.2.dr	String found in binary or memory: https://twitter.com/benjsperry
Source: chromecache_54.2.dr	String found in binary or memory: https://twitter.com/ionicframework
Source: chromecache_52.2.dr	String found in binary or memory: https://www.dana.id/favicon.ico
Source: chromecache_52.2.dr	String found in binary or memory: https://youtube.com

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.6:49734 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.win@16/34@30/13

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2124,i,9666912475870280729,789640676844921617,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://pemulihan-akun.dana-24.webappsystem.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2124,i,9666912475870280729,789640676844921617,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
18.66.27.116	app.link	United States	3	MIT-GATEWAYSUS	false
104.18.10.207	maxcdn.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
35.186.247.156	sentry.io	United States	15169	GOOGLEUS	false
188.166.191.232	pemulihan-akun.dana-24.webappsystem.com	Netherlands	14061	DIGITALOCEAN-ASNUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	cdn.lr-ingest.io	European Union	13335	CLOUDFLARENETUS	false
142.250.185.142	youtube.com	United States	15169	GOOGLEUS	false
142.250.185.164	www.google.com	United States	15169	GOOGLEUS	false
104.26.7.173	code.ionicframework.com	United States	13335	CLOUDFLARENETUS	false
13.32.110.70	api2.branch.io	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.6
192.168.2.5

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.210.172	true
app.link	18.66.27.116	true
cdnjs.cloudflare.com	104.17.24.14	true
sentry.io	35.186.247.156	true
maxcdn.bootstrapcdn.com	104.18.10.207	true
www.google.com	142.250.185.164	true
cdn.lr-ingest.io	188.114.97.3	true
code.ionicframework.com	104.26.7.173	true
fp2e7a.wpc.phicdn.net	192.229.221.95	true
pemulihan-akun.dana-24.webappsystem.com	188.166.191.232	true
api2.branch.io	13.32.110.70	true
youtube.com	142.250.185.142	true
cdn.jsdelivr.net	unknown	unknown
a.m.dana.id	unknown	unknown
www.dana.id	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://code.ionicframework.com/ionicons/2.0.1/css/ionicons.min.css	false	Avira URL Cloud: safe	unknown
http://pemulihan-akun.dana-24.webappsystem.com/img/logo-ojk.png	false	Avira URL Cloud: phishing	unknown
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js	false	Avira URL Cloud: safe	unknown
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css	false	Avira URL Cloud: safe	unknown
http://pemulihan-akun.dana-24.webappsystem.com/img/1.png	false	Avira URL Cloud: phishing	unknown
http://pemulihan-akun.dana-24.webappsystem.com/img/2.png	false	Avira URL Cloud: phishing	unknown
http://pemulihan-akun.dana-24.webappsystem.com/	true		unknown

Name	Type	MD5	SHA1	SHA256
Chrome Cache Entry: 52	HTML document, ASCII text, with very long lines (6714), with CRLF line terminators	C3921AABCFCA421B9B66E866A55BC32E	52DA22759F582B56C4B6507926C043A49617E455	ABC1C6F4D9C1667A018CA21E4EE8BF55914D449F544FCEDA8ACFD4A425898961
Chrome Cache Entry: 53	PNG image data, 1440 x 575, 8-bit/color RGB, non-interlaced	EB2530A21BB5CC75939020B7C952768E	23AF2B3351BD62359301075A59D56887CF18164E	FB56042CB6DB32182426539EC35FB748C577E98E22B583FD0B19CA99621F0E6A
Chrome Cache Entry: 54	Unicode text, UTF-8 text, with very long lines (50806)	1690997909AAE14B023A6580D4A2F33F	A4FD9551382A3B5C9C43E14ADB8C4C4149CD2352	92AC508220F5BB60EC94E07650528EB66625F82A4740ADA068CDE05365781286
Chrome Cache Entry: 55	PNG image data, 1440 x 575, 8-bit/color RGB, non-interlaced	5F02DBC34D6BD5FA2E8949FB860D60B8	F907C2F687DF5EA62D1FBEFBD0559E1F14F4DE20	92A1A4E9A5D862808A4F03C0A0D153ECE11BFB639462744B0C6244EBEE18F016
Chrome Cache Entry: 56	Unicode text, UTF-8 text	F9FABA678C4D6DCFDDE69E5B11B37A2E	81A434F94F2B1124F3232BB86F2944F82FB23AC0	7ADAF08052C6A6A0F8A0D0055B4F191FD07389FE41C972B69573472B2ECB406A
Chrome Cache Entry: 57	GIF image data, version 89a, 32 x 32	C5CD7F5300576AB4C88202B42F6DED62	7A1AA43614396382BB15E5FDE574D9CDCD21698F	E7B44C86B050FCA766A96DDAC2D0932AF0126DA6F2305280342D909168DCCE6B
Chrome Cache Entry: 58	PNG image data, 1440 x 575, 8-bit/color RGB, non-interlaced	5F02DBC34D6BD5FA2E8949FB860D60B8	F907C2F687DF5EA62D1FBEFBD0559E1F14F4DE20	92A1A4E9A5D862808A4F03C0A0D153ECE11BFB639462744B0C6244EBEE18F016
Chrome Cache Entry: 59	ASCII text, with very long lines (65371)	5D5357CB3704E1F43A1F5BFED2AEBF42	08DF9A96752852F2CBD310C30FACD934E348C2C5	31FBD99641C212A6AD3681A2397BDE13C148C0CCD98385BCE6A7EB7C81417D87
Chrome Cache Entry: 60	ASCII text, with very long lines (42862)	D5A61C749E44E47159AF8A6579DDA121	3B41B3BC956685015A347A2238E71DB29DFA0DBB	0C7178CC6CA34FB18E30F070A5E7A1C287B2D7CCFCBA2CFDF06E0F46EDA55740
Chrome Cache Entry: 61	PNG image data, 600 x 315, 8-bit/color RGBA, non-interlaced	883C16C692FA7FF6C3D58C14D1447C93	2043D443B2F2F4398F0E3B86C1D769637BDCF2BB	CB425BF8C81AF69B5850278ECA430AA7E6EDD0F27F7653C072C3437FAEB8319B
Chrome Cache Entry: 62	Web Open Font Format, CFF, length 1380, version 1.0	B7C9E1E479DE3B53F1E4E30EBAC2403A	AF91C12F0F406A4F801AEB3B398768FE41D8F864	26726BAC4060ABB1226E6CEEBC1336E84930FE7A7AF1B3895A109D067F5B5DCC
Chrome Cache Entry: 63	ASCII text, with very long lines (1572)	36D9E88C21981CAA4AD05669A090FC5B	5993B11F8169BF6DEFEAC7AD5C2029F0316CE549	BFE6E4D01A3D97686E49BDA1FCD4DA4FA9746DCD72B122480E2C950216DEC085
Chrome Cache Entry: 64	ASCII text	F38B2DB10E01B1572732A3191D538707	A94A059B3178B4ADEC09E3281ACE2819A30095A4	DE1E399B07289F3B0A8D35142E363E128124A1185770E214E25E58030DAD48E5
Chrome Cache Entry: 65	Web Open Font Format (Version 2), TrueType, length 18720, version 1.0	D26A2372AA87EA24DF867BE03821FC5F	5DEA98349DCF3E2DA8A4C4C209BBCF412D572805	1F6E5AE697330D08ACADF0299418B94A102DCC63F483B3F3EC821CC7E36EF8DC
Chrome Cache Entry: 66	PNG image data, 600 x 315, 8-bit/color RGBA, non-interlaced	883C16C692FA7FF6C3D58C14D1447C93	2043D443B2F2F4398F0E3B86C1D769637BDCF2BB	CB425BF8C81AF69B5850278ECA430AA7E6EDD0F27F7653C072C3437FAEB8319B
Chrome Cache Entry: 67	ASCII text, with very long lines (65451)	DC5E7F18C8D36AC1D3D4753A87C98D0A	C8E1C8B386DC5B7A9184C763C88D19A346EB3342	F7F6A5894F1D19DDAD6FA392B2ECE2C5E578CBF7DA4EA805B6885EB6985B6E3D
Chrome Cache Entry: 68	GIF image data, version 89a, 32 x 32	C5CD7F5300576AB4C88202B42F6DED62	7A1AA43614396382BB15E5FDE574D9CDCD21698F	E7B44C86B050FCA766A96DDAC2D0932AF0126DA6F2305280342D909168DCCE6B
Chrome Cache Entry: 69	Unicode text, UTF-8 text, with very long lines (65300)	6D9C6FDA1E7087224431CC8068BB998F	6273AC1A23D79A122F022F6A87C5B75C2CFAFC3A	FB1763B59F9F5764294B5AF9FA5250835AE608282FE6F2F2213A5952AACF1FBF
Chrome Cache Entry: 70	PNG image data, 1440 x 575, 8-bit/color RGB, non-interlaced	EB2530A21BB5CC75939020B7C952768E	23AF2B3351BD62359301075A59D56887CF18164E	FB56042CB6DB32182426539EC35FB748C577E98E22B583FD0B19CA99621F0E6A

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://pemulihan-akun.dana-24.webappsystem.com/	Avira URL Cloud: detection malicious, Label: phishing
Source: http://pemulihan-akun.dana-24.webappsystem.com/	SlashNext: detection malicious, Label: Fraudulent Website type: Phishing & Social usering

Antivirus detection for URL or domain

Source: http://pemulihan-akun.dana-24.webappsystem.com/img/logo-ojk.png	Avira URL Cloud: Label: phishing
Source: http://pemulihan-akun.dana-24.webappsystem.com/img/2.png	Avira URL Cloud: Label: phishing
Source: http://pemulihan-akun.dana-24.webappsystem.com/img/1.png	Avira URL Cloud: Label: phishing

Phishing

Phishing site detected (based on logo match)

Source: http://pemulihan-akun.dana-24.webappsystem.com/

Matcher: Template: visa matched

HTML body contains low number of good links

Source: http://pemulihan-akun.dana-24.webappsystem.com/

HTTP Parser: Number of links: 0

None HTTPS page querying sensitive user data (password, username or email)

Source: http://pemulihan-akun.dana-24.webappsystem.com/

HTTP Parser: Has password / email / username input fields

Suspicious form URL found

Source: http://pemulihan-akun.dana-24.webappsystem.com/	HTTP Parser: Form action: login.php
Source: http://pemulihan-akun.dana-24.webappsystem.com/	HTTP Parser: Form action: login.php
Source: http://pemulihan-akun.dana-24.webappsystem.com/	HTTP Parser: Form action: login.php

Source: http://pemulihan-akun.dana-24.webappsystem.com/	HTTP Parser: No <meta name="author".. found
Source: http://pemulihan-akun.dana-24.webappsystem.com/	HTTP Parser: No <meta name="author".. found
Source: http://pemulihan-akun.dana-24.webappsystem.com/	HTTP Parser: No <meta name="author".. found

Source: http://pemulihan-akun.dana-24.webappsystem.com/	HTTP Parser: No <meta name="copyright".. found
Source: http://pemulihan-akun.dana-24.webappsystem.com/	HTTP Parser: No <meta name="copyright".. found
Source: http://pemulihan-akun.dana-24.webappsystem.com/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.6:49734 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ionicons/2.0.1/css/ionicons.min.css HTTP/1.1Host: code.ionicframework.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://pemulihan-akun.dana-24.webappsystem.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/3.3.5/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://pemulihan-akun.dana-24.webappsystem.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/jquery/3.5.1/jquery.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://pemulihan-akun.dana-24.webappsystem.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: pemulihan-akun.dana-24.webappsystem.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/1.png HTTP/1.1Host: pemulihan-akun.dana-24.webappsystem.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://pemulihan-akun.dana-24.webappsystem.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/2.png HTTP/1.1Host: pemulihan-akun.dana-24.webappsystem.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://pemulihan-akun.dana-24.webappsystem.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/logo-ojk.png HTTP/1.1Host: pemulihan-akun.dana-24.webappsystem.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://pemulihan-akun.dana-24.webappsystem.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/1.png HTTP/1.1Host: pemulihan-akun.dana-24.webappsystem.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/logo-ojk.png HTTP/1.1Host: pemulihan-akun.dana-24.webappsystem.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/2.png HTTP/1.1Host: pemulihan-akun.dana-24.webappsystem.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: pemulihan-akun.dana-24.webappsystem.com
Source: global traffic	DNS traffic detected: DNS query: a.m.dana.id
Source: global traffic	DNS traffic detected: DNS query: app.link
Source: global traffic	DNS traffic detected: DNS query: api2.branch.io
Source: global traffic	DNS traffic detected: DNS query: code.ionicframework.com
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: cdn.lr-ingest.io
Source: global traffic	DNS traffic detected: DNS query: sentry.io
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.dana.id

Source: chromecache_54.2.dr	String found in binary or memory: http://creativecommons.org/licenses/by/4.0/
Source: chromecache_59.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_54.2.dr	String found in binary or memory: http://ionicons.com/
Source: chromecache_52.2.dr	String found in binary or memory: https://a.m.dana.id
Source: chromecache_52.2.dr	String found in binary or memory: https://a.m.dana.id/danaweb/web/dana-meta-logo.png
Source: chromecache_52.2.dr	String found in binary or memory: https://api2.branch.io
Source: chromecache_52.2.dr	String found in binary or memory: https://app.link
Source: chromecache_52.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap
Source: chromecache_52.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/slick-carousel
Source: chromecache_52.2.dr	String found in binary or memory: https://cdn.lr-ingest.io
Source: chromecache_52.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js
Source: chromecache_52.2.dr	String found in binary or memory: https://code.ionicframework.com/ionicons/2.0.1/css/ionicons.min.css
Source: chromecache_52.2.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Open
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B4gaVI
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B4iaVI
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B4jaVI
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B4kaVI
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B4saVI
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B4taVI
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B4uaVI
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B4vaVI
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B5OaVI
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjr0B5caVI
Source: chromecache_69.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_54.2.dr	String found in binary or memory: https://github.com/driftyco/ionicons
Source: chromecache_54.2.dr	String found in binary or memory: https://github.com/google/material-design-icons
Source: chromecache_69.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: chromecache_59.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_52.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css
Source: chromecache_52.2.dr	String found in binary or memory: https://sentry.io
Source: chromecache_54.2.dr	String found in binary or memory: https://twitter.com/benjsperry
Source: chromecache_54.2.dr	String found in binary or memory: https://twitter.com/ionicframework
Source: chromecache_52.2.dr	String found in binary or memory: https://www.dana.id/favicon.ico
Source: chromecache_52.2.dr	String found in binary or memory: https://youtube.com

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.6:49734 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.win@16/34@30/13

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2124,i,9666912475870280729,789640676844921617,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://pemulihan-akun.dana-24.webappsystem.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2124,i,9666912475870280729,789640676844921617,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

ID:	1448173
Product:	CloudBasic
Start time:	00:42:28
Start date:	28.05.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
http://pemulihan-akun.dana-24.webappsystem.com/

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report http://pemulihan-akun.dana-24.webappsystem.com/

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
http://pemulihan-akun.dana-24.webappsystem.com/