Windows Analysis Report
https://www-bbc-co-uk.cdn.ampproject.org/c/s/ANToniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A

Overview

General Information

Sample URL:	https://www-bbc-co-uk.cdn.ampproject.org/c/s/ANToniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A
Analysis ID:	1466889

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Phishing site detected (based on favicon image match)

Snort IDS alert for network traffic

Yara detected HtmlPhish54

Phishing site detected (based on image similarity)

Detected hidden input values containing email addresses (often used in phishing pages)

Detected non-DNS traffic on DNS port

Found iframes

HTML body contains low number of good links

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Signatures

Phishing

AI detected phishing page

Source: https://microsoft-office-offic365.pawradar.com.br	LLM: Score: 9 brands: Microsoft Reasons: The URL 'https://microsoft-office-offic365.pawradar.com.br' is highly suspicious. It uses a subdomain 'microsoft-office-offic365' which is designed to look like a legitimate Microsoft domain but is actually under 'pawradar.com.br'. This is a common technique used in phishing attacks to mislead users. The image shows a Microsoft logo and a prompt to click 'Confirm', which is a social engineering technique to get users to click on a potentially harmful link. The legitimate domain for Microsoft is 'microsoft.com', and this URL does not match it. There is no prominent login form or captcha, but the use of misleading subdomains and social engineering techniques strongly indicate that this is a phishing site. DOM: 2.2.pages.csv
Source: https://microsoft-office-offic365.pawradar.com.br	LLM: Score: 9 brands: Microsoft Reasons: The URL 'https://microsoft-office-offic365.pawradar.com.br' is highly suspicious. It uses a subdomain 'microsoft-office-offic365' which attempts to mimic a legitimate Microsoft domain but is actually under 'pawradar.com.br', which is not associated with Microsoft. The image shows a login form that resembles Microsoft's login page, which is a common phishing technique to deceive users. The presence of a prominent login form without a CAPTCHA further raises suspicion. The legitimate domain for Microsoft is 'microsoft.com', and this URL does not match it. These factors strongly indicate that this is a phishing site. DOM: 3.7.pages.csv
Source: https://microsoft-office-offic365.pawradar.com.br	LLM: Score: 9 brands: Microsoft Reasons: The URL 'https://microsoft-office-offic365.pawradar.com.br' is highly suspicious. The legitimate domain for Microsoft services is 'microsoft.com'. The use of 'pawradar.com.br' as the main domain is not associated with Microsoft. The subdomain 'microsoft-office-offic365' is an attempt to mimic Microsoft's legitimate services, which is a common social engineering technique used in phishing attacks. The webpage displays a prominent login form, which is another common characteristic of phishing sites. Additionally, the presence of a suspicious link and the overall setup of the page strongly suggest that this is a phishing site. DOM: 3.8.pages.csv

Phishing site detected (based on favicon image match)

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	Matcher: Template: microsoft matched with high similarity
Source: https://pawradar.com.br	Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish54

Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 3.5.pages.csv, type: HTML
Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 3.5.pages.csv, type: HTML
Source: Yara match	File source: 3.8.pages.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML
Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 3.5.pages.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML
Source: Yara match	File source: 3.8.pages.csv, type: HTML
Source: Yara match	File source: 3.9.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A	Matcher: Found strong image similarity, brand: MICROSOFT
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	Matcher: Found strong image similarity, brand: MICROSOFT

Detected hidden input values containing email addresses (often used in phishing pages)

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true

HTTP Parser: de.witte.bono@deme-group.com

Found iframes

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: Iframe src: https://6f8b5f67-5240a3ad.pawradar.com.br/Prefetch/Prefetch.aspx
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: Iframe src: https://6f8b5f67-5240a3ad.pawradar.com.br/Prefetch/Prefetch.aspx
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: Iframe src: https://6f8b5f67-5240a3ad.pawradar.com.br/Prefetch/Prefetch.aspx
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: Iframe src: https://6f8b5f67-5240a3ad.pawradar.com.br/Prefetch/Prefetch.aspx

HTML body contains low number of good links

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true

HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true

HTTP Parser: Title: Sign in to your account does not match URL

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true

HTTP Parser: <input type="password" .../> found

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A	HTTP Parser: No favicon
Source: https://6f8b5f67-5240a3ad.pawradar.com.br/Prefetch/Prefetch.aspx	HTTP Parser: No favicon

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:59244 version: TLS 1.2

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2857090 ETPRO CURRENT_EVENTS JS/PsyduckPockeball Payload Inbound 134.209.234.126:443 -> 192.168.2.16:49714

Detected non-DNS traffic on DNS port

Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183

Source: global traffic	DNS traffic detected: DNS query: www-bbc-co-uk.cdn.ampproject.org
Source: global traffic	DNS traffic detected: DNS query: antoniopneus-com-br.cdn.ampproject.org
Source: global traffic	DNS traffic detected: DNS query: antoniopneus.com.br
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: microsoft-office-offic365.pawradar.com.br
Source: global traffic	DNS traffic detected: DNS query: b5794ac5-5240a3ad.pawradar.com.br
Source: global traffic	DNS traffic detected: DNS query: 38448e97-5240a3ad.pawradar.com.br
Source: global traffic	DNS traffic detected: DNS query: 810debeb-5240a3ad.pawradar.com.br
Source: global traffic	DNS traffic detected: DNS query: l1ve.pawradar.com.br
Source: global traffic	DNS traffic detected: DNS query: 6f8b5f67-5240a3ad.pawradar.com.br
Source: global traffic	DNS traffic detected: DNS query: 8380f30c-5240a3ad.pawradar.com.br
Source: global traffic	DNS traffic detected: DNS query: 4d9e3863-5240a3ad.pawradar.com.br

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59246
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59247
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59244
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59249
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59256
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59250
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 59250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 59249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:59244 version: TLS 1.2

Source: classification engine

Classification label: mal76.phis.win@18/24@30/139

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www-bbc-co-uk.cdn.ampproject.org/c/s/ANToniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1864,i,13666949484252195792,14017647277874097095,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1864,i,13666949484252195792,14017647277874097095,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5464 --field-trial-handle=1864,i,13666949484252195792,14017647277874097095,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5464 --field-trial-handle=1864,i,13666949484252195792,14017647277874097095,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.195	unknown	United States	15169	GOOGLEUS	false
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
134.209.234.126	b5794ac5-5240a3ad.pawradar.com.br	United States	14061	DIGITALOCEAN-ASNUS	true
142.250.185.129	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.186.170	unknown	United States	15169	GOOGLEUS	false
64.233.166.84	unknown	United States	15169	GOOGLEUS	false
142.250.181.238	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.174	unknown	United States	15169	GOOGLEUS	false
142.250.184.225	cdn-content.ampproject.org	United States	15169	GOOGLEUS	false
191.252.141.106	antoniopneus.com.br	Brazil	27715	LocawebServicosdeInternetSABR	false
172.217.18.99	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17
192.168.2.16

Contacted Domains

Name	IP	Active
b5794ac5-5240a3ad.pawradar.com.br	134.209.234.126	true
l1ve.pawradar.com.br	134.209.234.126	true
38448e97-5240a3ad.pawradar.com.br	134.209.234.126	true
antoniopneus.com.br	191.252.141.106	true
810debeb-5240a3ad.pawradar.com.br	134.209.234.126	true
www.google.com	142.250.186.68	true
6f8b5f67-5240a3ad.pawradar.com.br	134.209.234.126	true
4d9e3863-5240a3ad.pawradar.com.br	134.209.234.126	true
cdn-content.ampproject.org	142.250.184.225	true
8380f30c-5240a3ad.pawradar.com.br	134.209.234.126	true
microsoft-office-offic365.pawradar.com.br	134.209.234.126	true
antoniopneus-com-br.cdn.ampproject.org	unknown	unknown
www-bbc-co-uk.cdn.ampproject.org	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	true	unknown
https://6f8b5f67-5240a3ad.pawradar.com.br/Prefetch/Prefetch.aspx	false	unknown
https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A	true	unknown
https://antoniopneus-com-br.cdn.ampproject.org/c/s/ANToniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A	false	unknown
https://antoniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A	false	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 11:43:03 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	974DDF49D8BC809252409AB77C49EC41	1C4B71D97E08E0C6D41546F1C8FCF0B37EBC4740	2BA0927602B1B29FFD8D735E0CAEDA37DD1AA29CE9CF941380BFEACD63C9EA78
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 11:43:03 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	70438A4057FC63C0909461558CE90FE7	89149FF73C25B5C7386433AC9036596358E10AE1	367BC8286F6614001F34877F92F94799E7F39C85A3282A69913466BB86A0BD60
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	DEF931A634489E849527DCDD565EB48B	990ABC71A47EA550BF75E0C5F9F0B3227FFBC3A2	2E18F3B11365B96BED7323983A9CDBA92FCA6231386C870BE030FA4C1A690582
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 11:43:03 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	9A512BB17B5A6BF4DB5CD573B1224C74	FB88CC5475115C58C332BAFCB6D8B0FE344B7273	98C3A90A68CEAC829E09825FF5C104391DE8E5AF55A0FB32DE94D28D94A486E0
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 11:43:03 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	7055A4E615494B29AE6E80CF8EC6E42C	1A438EDACA53268C55B92FA18459A3617ED45961	A24C63C827959E56F5EAD1E4E275BC6800EFF3EA3259E100E4FF7C5B67F102AA
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 11:43:03 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	CC0985B2B2EEF9AD8E3CD66B40CCD7F6	6F124C4DAFF001A90631B7446B3BB8C56B4F7651	1F4CE5760BC7567ECC144A05AD91DE7283E058A0B82EC4DC50AFE56C48A72BF4
Chrome Cache Entry: 67	MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel	7E0D59593F3377B72C29435C4B43954A	B4C5C39A6DFB460BBD2EACCEB09EC8079FB6A8E2	62D706019A0D80173113EF70FBBEE12F286E8E221534BE788448AADA4B14C8E8
Chrome Cache Entry: 68	GIF image data, version 89a, 352 x 3	166DE53471265253AB3A456DEFE6DA23	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
Chrome Cache Entry: 69	gzip compressed data, from Unix, original size modulo 2^32 113355	02363E4C20BE02F305298C569681427C	EEEF3294F36805907EC217BE82022A71350AA7F5	DE0591B9220B931A57F173CE64D7E14F041B979CA5BEC6127B4BCEC7C373AD1C
Chrome Cache Entry: 70	HTML document, ASCII text, with CRLF, LF line terminators	3632234E193AAEA777716808ACFF3E2D	C66FA1B66C1586FDB88EB730F594B5DB51934576	C22C7BBB21430DC671F7B82EBD9F1EB78D425EF9660F4BEFE16779BCD96514F1
Chrome Cache Entry: 71	gzip compressed data, original size modulo 2^32 3651	DF6A7721C242813411CC6950DF40F9B3	B2068C4A65C183AAD6FC22A44CC1FA449CD355B4	AA53B6DC744357B392FC57C34E516BAE465D4A6837775C137A176D599C8EA948
Chrome Cache Entry: 72	ASCII text, with no line terminators	17C4BD96DCB397D1D62D24921BC4FEBA	2C0F2AFF858069D582A97867B183EBD5DC8A9FCB	3549DBC06BDD994A38C9A29AECD7E8F9577E2150D15F8D6B0533B4D250666514
Chrome Cache Entry: 76	gzip compressed data, from Unix, original size modulo 2^32 3551	93035D0F0CE5F7D570D06E0C90201706	3CFE18C4FE0139693800CDACE8781270BC5172DC	79B563CC07AD8EACB50475117C0B0A0C1BC965F69DDC1FBE026DD3F719372764
Chrome Cache Entry: 77	gzip compressed data, original size modulo 2^32 1864	2D2CBA7D7DC75F3BA9DC756738D41A6E	F87FD26066ED5E52A65DEE0ED2D581D3C3EA15AC	00E21864CF1BC70302EBB5B496C6C471A7DA8CBF600630B478A3E2376ED20EA2
Chrome Cache Entry: 78	PNG image data, 280 x 60, 8-bit/color RGBA, non-interlaced	74CABA060BC836E70D4F5D5F667040B1	0ADDEA394E0CC6C8D58145C767BB8AE245620BD9	F91A4538E7B7789D0B53325D90E0D6661B774F01A5336A4B56BC3947560E9AF1
Chrome Cache Entry: 79	gzip compressed data, from Unix, original size modulo 2^32 447049	0055D9BDE07A8B0D35AD234EE70FB566	093A97D6FC43DD702813C1035C811C53162E9793	412BFBE2494A8844FBB370AA3102C2167742AE24828C8D360496C8BECAD0C7FC
Chrome Cache Entry: 80	gzip compressed data, original size modulo 2^32 513	44D8807C223B5C6DEF6E75A602F314EF	E061C196D771661D6C47336C50EAFE2B3BA14130	BA9816D7AF3E3B0EA5B6B34BAA0C99FE5EDCF4CA9BE30307AAA2956F994A8B1E
Chrome Cache Entry: 81	gzip compressed data, from Unix, original size modulo 2^32 15767	7A44785AE6B0C9669B4D2A5248F0C059	C4B64849A6B9F04F6580BBB6EA1E7054214276E8	2D167AC2DE069B2441F436077C4E93430653DDBF28ED31795178D2222DD166E9
Chrome Cache Entry: 82	GIF image data, version 89a, 352 x 3	B540A8E518037192E32C4FE58BF2DBAB	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
Chrome Cache Entry: 84	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1420x1200, components 3	A9AFFF093AE10BA09735D13BA0F71E22	8BDCC469286BA4372A6BB8DC228C677637F59F8A	56CB3896CA6272F10CBD86A173206DEEC13A9D3D32B8A04C0040D843D2DBA553
Chrome Cache Entry: 86	gzip compressed data, from Unix, original size modulo 2^32 223841	BAF99BC01E805A1DF9652CD1C7B5380B	C9DEC1D06D3043769DE7764AD32C4BCEF6DE4C6A	3036B7F6816CA324B2E0ABBD5A9F29DF5802EC3D6600E034A1313CA38C6F33B0
Chrome Cache Entry: 87	gzip compressed data, from Unix, original size modulo 2^32 26679	5D56B4B9CC9D4F5C9100FE677F0D837A	6D3EC574B8B181D1470647735A4A9AA8D6275B75	F4159CE23E89358A9AD834A034214FD690C005BA9363B51FE943223819102454
Chrome Cache Entry: 89	gzip compressed data, from Unix, original size modulo 2^32 141462	D9FAD0FBB757334B25FCAE4E6DB91A40	EDE5970E289F6CA84385402986BA1EF9F36E0453	B6E11A8B756A9357FF1A566C3CC6709509DAA9D831B0AFC0E7CBCF3FD9F9FCB7
Chrome Cache Entry: 90	gzip compressed data, from Unix, original size modulo 2^32 55503	E488D353476FAC6C93E6056EDF1B04E2	69BFEF9AAFE0F7543ED36FB26F558C769EF97BEF	EB3C57E120B75B045A09F177C61420DD4BF785613185D253C0D8F53DC6474CE3

Phishing

AI detected phishing page

Source: https://microsoft-office-offic365.pawradar.com.br	LLM: Score: 9 brands: Microsoft Reasons: The URL 'https://microsoft-office-offic365.pawradar.com.br' is highly suspicious. It uses a subdomain 'microsoft-office-offic365' which is designed to look like a legitimate Microsoft domain but is actually under 'pawradar.com.br'. This is a common technique used in phishing attacks to mislead users. The image shows a Microsoft logo and a prompt to click 'Confirm', which is a social engineering technique to get users to click on a potentially harmful link. The legitimate domain for Microsoft is 'microsoft.com', and this URL does not match it. There is no prominent login form or captcha, but the use of misleading subdomains and social engineering techniques strongly indicate that this is a phishing site. DOM: 2.2.pages.csv
Source: https://microsoft-office-offic365.pawradar.com.br	LLM: Score: 9 brands: Microsoft Reasons: The URL 'https://microsoft-office-offic365.pawradar.com.br' is highly suspicious. It uses a subdomain 'microsoft-office-offic365' which attempts to mimic a legitimate Microsoft domain but is actually under 'pawradar.com.br', which is not associated with Microsoft. The image shows a login form that resembles Microsoft's login page, which is a common phishing technique to deceive users. The presence of a prominent login form without a CAPTCHA further raises suspicion. The legitimate domain for Microsoft is 'microsoft.com', and this URL does not match it. These factors strongly indicate that this is a phishing site. DOM: 3.7.pages.csv
Source: https://microsoft-office-offic365.pawradar.com.br	LLM: Score: 9 brands: Microsoft Reasons: The URL 'https://microsoft-office-offic365.pawradar.com.br' is highly suspicious. The legitimate domain for Microsoft services is 'microsoft.com'. The use of 'pawradar.com.br' as the main domain is not associated with Microsoft. The subdomain 'microsoft-office-offic365' is an attempt to mimic Microsoft's legitimate services, which is a common social engineering technique used in phishing attacks. The webpage displays a prominent login form, which is another common characteristic of phishing sites. Additionally, the presence of a suspicious link and the overall setup of the page strongly suggest that this is a phishing site. DOM: 3.8.pages.csv

Phishing site detected (based on favicon image match)

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	Matcher: Template: microsoft matched with high similarity
Source: https://pawradar.com.br	Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish54

Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 3.5.pages.csv, type: HTML
Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 3.5.pages.csv, type: HTML
Source: Yara match	File source: 3.8.pages.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML
Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 3.5.pages.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML
Source: Yara match	File source: 3.8.pages.csv, type: HTML
Source: Yara match	File source: 3.9.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A	Matcher: Found strong image similarity, brand: MICROSOFT
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	Matcher: Found strong image similarity, brand: MICROSOFT

Detected hidden input values containing email addresses (often used in phishing pages)

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true

HTTP Parser: de.witte.bono@deme-group.com

Found iframes

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: Iframe src: https://6f8b5f67-5240a3ad.pawradar.com.br/Prefetch/Prefetch.aspx
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: Iframe src: https://6f8b5f67-5240a3ad.pawradar.com.br/Prefetch/Prefetch.aspx
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: Iframe src: https://6f8b5f67-5240a3ad.pawradar.com.br/Prefetch/Prefetch.aspx
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: Iframe src: https://6f8b5f67-5240a3ad.pawradar.com.br/Prefetch/Prefetch.aspx

HTML body contains low number of good links

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true

HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true

HTTP Parser: Title: Sign in to your account does not match URL

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true

HTTP Parser: <input type="password" .../> found

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A	HTTP Parser: No favicon
Source: https://6f8b5f67-5240a3ad.pawradar.com.br/Prefetch/Prefetch.aspx	HTTP Parser: No favicon

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:59244 version: TLS 1.2

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2857090 ETPRO CURRENT_EVENTS JS/PsyduckPockeball Payload Inbound 134.209.234.126:443 -> 192.168.2.16:49714

Detected non-DNS traffic on DNS port

Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183

Source: global traffic	DNS traffic detected: DNS query: www-bbc-co-uk.cdn.ampproject.org
Source: global traffic	DNS traffic detected: DNS query: antoniopneus-com-br.cdn.ampproject.org
Source: global traffic	DNS traffic detected: DNS query: antoniopneus.com.br
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: microsoft-office-offic365.pawradar.com.br
Source: global traffic	DNS traffic detected: DNS query: b5794ac5-5240a3ad.pawradar.com.br
Source: global traffic	DNS traffic detected: DNS query: 38448e97-5240a3ad.pawradar.com.br
Source: global traffic	DNS traffic detected: DNS query: 810debeb-5240a3ad.pawradar.com.br
Source: global traffic	DNS traffic detected: DNS query: l1ve.pawradar.com.br
Source: global traffic	DNS traffic detected: DNS query: 6f8b5f67-5240a3ad.pawradar.com.br
Source: global traffic	DNS traffic detected: DNS query: 8380f30c-5240a3ad.pawradar.com.br
Source: global traffic	DNS traffic detected: DNS query: 4d9e3863-5240a3ad.pawradar.com.br

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59246
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59247
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59244
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59249
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59256
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59250
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 59250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 59249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:59244 version: TLS 1.2

Source: classification engine

Classification label: mal76.phis.win@18/24@30/139

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www-bbc-co-uk.cdn.ampproject.org/c/s/ANToniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1864,i,13666949484252195792,14017647277874097095,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1864,i,13666949484252195792,14017647277874097095,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5464 --field-trial-handle=1864,i,13666949484252195792,14017647277874097095,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5464 --field-trial-handle=1864,i,13666949484252195792,14017647277874097095,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

ID:	1466889
Product:	CloudBasic
Start time:	14:41:53
Start date:	03.07.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://www-bbc-co-uk.cdn.ampproject.org/c/s/ANToniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://www-bbc-co-uk.cdn.ampproject.org/c/s/ANToniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://www-bbc-co-uk.cdn.ampproject.org/c/s/ANToniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A