Edit tour

Windows Analysis Report
https://www-bbc-co-uk.cdn.ampproject.org/c/s/ANToniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A

Overview

General Information

Sample URL:	https://www-bbc-co-uk.cdn.ampproject.org/c/s/ANToniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A
Analysis ID:	1466889

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Phishing site detected (based on favicon image match)

Snort IDS alert for network traffic

Yara detected HtmlPhish54

Phishing site detected (based on image similarity)

Detected hidden input values containing email addresses (often used in phishing pages)

Detected non-DNS traffic on DNS port

Found iframes

HTML body contains low number of good links

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6280 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www-bbc-co-uk.cdn.ampproject.org/c/s/ANToniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6468 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1864,i,13666949484252195792,14017647277874097095,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7472 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5464 --field-trial-handle=1864,i,13666949484252195792,14017647277874097095,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
2.4.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.4.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.8.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.4.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.8.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.9.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
Click to see the 6 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ETPRO CURRENT_EVENTS JS/PsyduckPockeball Payload Inbound - Source IP: 134.209.234.126 - Destination IP: 192.168.2.16

Timestamp:	07/03/24-14:43:11.177518
SID:	2857090
Source Port:	443
Destination Port:	49714
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://microsoft-office-offic365.pawradar.com.br	LLM: Score: 9 brands: Microsoft Reasons: The URL 'https://microsoft-office-offic365.pawradar.com.br' is highly suspicious. It uses a subdomain 'microsoft-office-offic365' which is designed to look like a legitimate Microsoft domain but is actually under 'pawradar.com.br'. This is a common technique used in phishing attacks to mislead users. The image shows a Microsoft logo and a prompt to click 'Confirm', which is a social engineering technique to get users to click on a potentially harmful link. The legitimate domain for Microsoft is 'microsoft.com', and this URL does not match it. There is no prominent login form or captcha, but the use of misleading subdomains and social engineering techniques strongly indicate that this is a phishing site. DOM: 2.2.pages.csv
Source: https://microsoft-office-offic365.pawradar.com.br	LLM: Score: 9 brands: Microsoft Reasons: The URL 'https://microsoft-office-offic365.pawradar.com.br' is highly suspicious. It uses a subdomain 'microsoft-office-offic365' which attempts to mimic a legitimate Microsoft domain but is actually under 'pawradar.com.br', which is not associated with Microsoft. The image shows a login form that resembles Microsoft's login page, which is a common phishing technique to deceive users. The presence of a prominent login form without a CAPTCHA further raises suspicion. The legitimate domain for Microsoft is 'microsoft.com', and this URL does not match it. These factors strongly indicate that this is a phishing site. DOM: 3.7.pages.csv
Source: https://microsoft-office-offic365.pawradar.com.br	LLM: Score: 9 brands: Microsoft Reasons: The URL 'https://microsoft-office-offic365.pawradar.com.br' is highly suspicious. The legitimate domain for Microsoft services is 'microsoft.com'. The use of 'pawradar.com.br' as the main domain is not associated with Microsoft. The subdomain 'microsoft-office-offic365' is an attempt to mimic Microsoft's legitimate services, which is a common social engineering technique used in phishing attacks. The webpage displays a prominent login form, which is another common characteristic of phishing sites. Additionally, the presence of a suspicious link and the overall setup of the page strongly suggest that this is a phishing site. DOM: 3.8.pages.csv

Phishing site detected (based on favicon image match)

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	Matcher: Template: microsoft matched with high similarity
Source: https://pawradar.com.br	Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish54

Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 3.5.pages.csv, type: HTML
Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 3.5.pages.csv, type: HTML
Source: Yara match	File source: 3.8.pages.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML
Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 3.5.pages.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML
Source: Yara match	File source: 3.8.pages.csv, type: HTML
Source: Yara match	File source: 3.9.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A	Matcher: Found strong image similarity, brand: MICROSOFT
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	Matcher: Found strong image similarity, brand: MICROSOFT

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true

HTTP Parser: de.witte.bono@deme-group.com

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: Iframe src: https://6f8b5f67-5240a3ad.pawradar.com.br/Prefetch/Prefetch.aspx
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: Iframe src: https://6f8b5f67-5240a3ad.pawradar.com.br/Prefetch/Prefetch.aspx
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: Iframe src: https://6f8b5f67-5240a3ad.pawradar.com.br/Prefetch/Prefetch.aspx
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: Iframe src: https://6f8b5f67-5240a3ad.pawradar.com.br/Prefetch/Prefetch.aspx

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true

HTTP Parser: Number of links: 0

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true

HTTP Parser: Title: Sign in to your account does not match URL

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true

HTTP Parser: <input type="password" .../> found

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A	HTTP Parser: No favicon
Source: https://6f8b5f67-5240a3ad.pawradar.com.br/Prefetch/Prefetch.aspx	HTTP Parser: No favicon

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:59244 version: TLS 1.2

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2857090 ETPRO CURRENT_EVENTS JS/PsyduckPockeball Payload Inbound 134.209.234.126:443 -> 192.168.2.16:49714

Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:59242 -> 162.159.36.2:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183

Source: global traffic	DNS traffic detected: DNS query: www-bbc-co-uk.cdn.ampproject.org
Source: global traffic	DNS traffic detected: DNS query: antoniopneus-com-br.cdn.ampproject.org
Source: global traffic	DNS traffic detected: DNS query: antoniopneus.com.br
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: microsoft-office-offic365.pawradar.com.br
Source: global traffic	DNS traffic detected: DNS query: b5794ac5-5240a3ad.pawradar.com.br
Source: global traffic	DNS traffic detected: DNS query: 38448e97-5240a3ad.pawradar.com.br
Source: global traffic	DNS traffic detected: DNS query: 810debeb-5240a3ad.pawradar.com.br
Source: global traffic	DNS traffic detected: DNS query: l1ve.pawradar.com.br
Source: global traffic	DNS traffic detected: DNS query: 6f8b5f67-5240a3ad.pawradar.com.br
Source: global traffic	DNS traffic detected: DNS query: 8380f30c-5240a3ad.pawradar.com.br
Source: global traffic	DNS traffic detected: DNS query: 4d9e3863-5240a3ad.pawradar.com.br

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59246
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59247
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59244
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59249
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59256
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59250
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 59250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 59249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:59244 version: TLS 1.2

Source: classification engine

Classification label: mal76.phis.win@18/24@30/139

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www-bbc-co-uk.cdn.ampproject.org/c/s/ANToniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1864,i,13666949484252195792,14017647277874097095,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1864,i,13666949484252195792,14017647277874097095,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5464 --field-trial-handle=1864,i,13666949484252195792,14017647277874097095,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5464 --field-trial-handle=1864,i,13666949484252195792,14017647277874097095,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
https://www-bbc-co-uk.cdn.ampproject.org/c/s/ANToniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
b5794ac5-5240a3ad.pawradar.com.br	134.209.234.126	true	true	unknown
l1ve.pawradar.com.br	134.209.234.126	true	true	unknown
38448e97-5240a3ad.pawradar.com.br	134.209.234.126	true	true	unknown
antoniopneus.com.br	191.252.141.106	true	false	unknown
810debeb-5240a3ad.pawradar.com.br	134.209.234.126	true	true	unknown
www.google.com	142.250.186.68	true	false	unknown
6f8b5f67-5240a3ad.pawradar.com.br	134.209.234.126	true	true	unknown
4d9e3863-5240a3ad.pawradar.com.br	134.209.234.126	true	true	unknown
cdn-content.ampproject.org	142.250.184.225	true	false	unknown
8380f30c-5240a3ad.pawradar.com.br	134.209.234.126	true	true	unknown
microsoft-office-offic365.pawradar.com.br	134.209.234.126	true	true	unknown
antoniopneus-com-br.cdn.ampproject.org	unknown	unknown	false	unknown
www-bbc-co-uk.cdn.ampproject.org	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true	true	unknown
https://6f8b5f67-5240a3ad.pawradar.com.br/Prefetch/Prefetch.aspx	false	unknown
https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A	true	unknown
https://antoniopneus-com-br.cdn.ampproject.org/c/s/ANToniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A	false	unknown
https://antoniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.195	unknown	United States	15169	GOOGLEUS	false
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
134.209.234.126	b5794ac5-5240a3ad.pawradar.com.br	United States	14061	DIGITALOCEAN-ASNUS	true
142.250.185.129	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.186.170	unknown	United States	15169	GOOGLEUS	false
64.233.166.84	unknown	United States	15169	GOOGLEUS	false
142.250.181.238	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.174	unknown	United States	15169	GOOGLEUS	false
142.250.184.225	cdn-content.ampproject.org	United States	15169	GOOGLEUS	false
191.252.141.106	antoniopneus.com.br	Brazil	27715	LocawebServicosdeInternetSABR	false
172.217.18.99	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17
192.168.2.16

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466889
Start date and time:	2024-07-03 14:41:53 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://www-bbc-co-uk.cdn.ampproject.org/c/s/ANToniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.phis.win@18/24@30/139

Warnings

Exclude process from analysis (whitelisted): SgrmBroker.exe, MoUsoCoreWorker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 142.250.184.195, 142.250.181.238, 64.233.166.84, 34.104.35.123
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://www-bbc-co-uk.cdn.ampproject.org/c/s/ANToniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A

LLM Input / Output

Input	Output
URL: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A Model: Perplexity: mixtral-8x7b-instruct	{"loginform": false,"urgency": true,"captcha": false,"reasons": ["The title 'Confirming' does not contain any specific keywords related to a login form.","The text 'i' Microsoft does not contain any explicit request for sensitive information.","The text 'Please click confirm to continue Confirm' creates a sense of urgency as it instructs the user to take immediate action.","There is no mention of a CAPTCHA or any other anti-robot detection mechanism in the provided information."]}
Title: Confirming OCR: 'i' Microsoft Please click confirm to continue Confirm
URL: https://microsoft-office-offic365.pawradar.com.br Model: gpt-4o	```json{ "phishing_score": 9, "brands": "Microsoft", "phishing": true, "suspicious_domain": true, "has_prominent_loginform": false, "has_captcha": false, "setechniques": true, "has_suspicious_link": true, "legitmate_domain": "microsoft.com", "reasons": "The URL 'https://microsoft-office-offic365.pawradar.com.br' is highly suspicious. It uses a subdomain 'microsoft-office-offic365' which is designed to look like a legitimate Microsoft domain but is actually under 'pawradar.com.br'. This is a common technique used in phishing attacks to mislead users. The image shows a Microsoft logo and a prompt to click 'Confirm', which is a social engineering technique to get users to click on a potentially harmful link. The legitimate domain for Microsoft is 'microsoft.com', and this URL does not match it. There is no prominent login form or captcha, but the use of misleading subdomains and social engineering techniques strongly indicate that this is a phishing site."}

URL: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true Model: Perplexity: mixtral-8x7b-instruct	{"loginform": true,"urgency": false,"captcha": false,"reasons": ["The text 'Sign in to your account' suggests the presence of a login form.","The text does not create a sense of urgency.","There is no CAPTCHA or anti-robot detection mechanism present.","The text 'Microsoft Trying to sign you in ance Terms of use Privacy & ckies' does not contain any language that creates a sense of urgency or interest."]}
Title: Sign in to your account OCR: Microsoft Trying to sign you in ance Terms of use Privacy & ckies
URL: https://microsoft-office-offic365.pawradar.com.br/?offic=ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A&sso_reload=true Model: Perplexity: mixtral-8x7b-instruct	{"loginform": true,"urgency": false,"captcha": false,"reasons": ["The text 'Sign in to your account' suggests the presence of a login form.","The text does not create a sense of urgency as it is a standard login message.","No CAPTCHA or anti-robot detection mechanism was detected in the provided text.","The text 'Microsoft Trying to sign you in ance Terms of use Privacy & ckies' does not contain any keywords that would indicate a sense of urgency."]}
Title: Sign in to your account OCR: Microsoft Trying to sign you in ance Terms of use Privacy & ckies
URL: https://microsoft-office-offic365.pawradar.com.br Model: gpt-4o	```json{ "phishing_score": 9, "brands": "Microsoft", "phishing": true, "suspicious_domain": true, "has_prominent_loginform": true, "has_captcha": false, "setechniques": true, "has_suspicious_link": true, "legitmate_domain": "microsoft.com", "reasons": "The URL 'https://microsoft-office-offic365.pawradar.com.br' is highly suspicious. It uses a subdomain 'microsoft-office-offic365' which attempts to mimic a legitimate Microsoft domain but is actually under 'pawradar.com.br', which is not associated with Microsoft. The image shows a login form that resembles Microsoft's login page, which is a common phishing technique to deceive users. The presence of a prominent login form without a CAPTCHA further raises suspicion. The legitimate domain for Microsoft is 'microsoft.com', and this URL does not match it. These factors strongly indicate that this is a phishing site."}

URL: https://microsoft-office-offic365.pawradar.com.br Model: gpt-4o	```json{ "phishing_score": 9, "brands": "Microsoft", "phishing": true, "suspicious_domain": true, "has_prominent_loginform": true, "has_captcha": false, "setechniques": true, "has_suspicious_link": true, "legitmate_domain": "microsoft.com", "reasons": "The URL 'https://microsoft-office-offic365.pawradar.com.br' is highly suspicious. The legitimate domain for Microsoft services is 'microsoft.com'. The use of 'pawradar.com.br' as the main domain is not associated with Microsoft. The subdomain 'microsoft-office-offic365' is an attempt to mimic Microsoft's legitimate services, which is a common social engineering technique used in phishing attacks. The webpage displays a prominent login form, which is another common characteristic of phishing sites. Additionally, the presence of a suspicious link and the overall setup of the page strongly suggest that this is a phishing site."}

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 11:43:03 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9787174731680617
Encrypted:	false
SSDEEP:
MD5:	974DDF49D8BC809252409AB77C49EC41
SHA1:	1C4B71D97E08E0C6D41546F1C8FCF0B37EBC4740
SHA-256:	2BA0927602B1B29FFD8D735E0CAEDA37DD1AA29CE9CF941380BFEACD63C9EA78
SHA-512:	A7B32C6698C4178F0FB8FE10A75973C846CB8C5CDD59D5D916D8C50EF2A961F9BA2BFA0B83EAC1FC246F9A0BC21057FE800F2A5044811C583CF28C5E522A2913
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....[..F...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.XVe....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xae....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xae....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xae..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xbe...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............1:.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 11:43:03 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9916278429610133
Encrypted:	false
SSDEEP:
MD5:	70438A4057FC63C0909461558CE90FE7
SHA1:	89149FF73C25B5C7386433AC9036596358E10AE1
SHA-256:	367BC8286F6614001F34877F92F94799E7F39C85A3282A69913466BB86A0BD60
SHA-512:	86AA533B1A58D31B3D7ACBCCA68FE30A6FE90C0D639DC90E8018A386A0CE688C5DCA336C20AF66D7E749F8DB2660C22E47095F91E06BADD301ACD1D4944FAC18
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....!f.F...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.XVe....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xae....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xae....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xae..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xbe...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............1:.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.000076019147734
Encrypted:	false
SSDEEP:
MD5:	DEF931A634489E849527DCDD565EB48B
SHA1:	990ABC71A47EA550BF75E0C5F9F0B3227FFBC3A2
SHA-256:	2E18F3B11365B96BED7323983A9CDBA92FCA6231386C870BE030FA4C1A690582
SHA-512:	2A030B4A49C6743D20F59DD12186A3916B497B910361793A7553A11FF4CC25795BF528F8C62094D9538E4C5C617085F1FE4D1AFCA6046DD3D721E8701E8314E5
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.XVe....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xae....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xae....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xae..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............1:.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 11:43:03 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.990038991956736
Encrypted:	false
SSDEEP:
MD5:	9A512BB17B5A6BF4DB5CD573B1224C74
SHA1:	FB88CC5475115C58C332BAFCB6D8B0FE344B7273
SHA-256:	98C3A90A68CEAC829E09825FF5C104391DE8E5AF55A0FB32DE94D28D94A486E0
SHA-512:	2F3B2AA5B1C36ED6D4377EFE77F6E06434E151C3A228B2DB2D3B45BC0CAF3F149C2804F8A956597BF8285C946930BD81DDAE1C935AD49F9968BE739F43C25B79
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....P..F...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.XVe....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xae....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xae....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xae..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xbe...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............1:.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 11:43:03 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.979874967838405
Encrypted:	false
SSDEEP:
MD5:	7055A4E615494B29AE6E80CF8EC6E42C
SHA1:	1A438EDACA53268C55B92FA18459A3617ED45961
SHA-256:	A24C63C827959E56F5EAD1E4E275BC6800EFF3EA3259E100E4FF7C5B67F102AA
SHA-512:	B4E8CDE66D0944A90C1748F80350F4E87FB56D5890367258A3344C1757DEC667B30F53D2B5DB546A8E34AFFDD4170891CBBDBD416C155C88754B55DF5B51DA04
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....B..F...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.XVe....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xae....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xae....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xae..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xbe...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............1:.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 11:43:03 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9896995028778575
Encrypted:	false
SSDEEP:
MD5:	CC0985B2B2EEF9AD8E3CD66B40CCD7F6
SHA1:	6F124C4DAFF001A90631B7446B3BB8C56B4F7651
SHA-256:	1F4CE5760BC7567ECC144A05AD91DE7283E058A0B82EC4DC50AFE56C48A72BF4
SHA-512:	007F055D5D922484B7381A2DB27A55512A88D8C4D82025E22C3AFF445029CFD21876A9DB26781AC0566B83F02A3DB496123B977B72910588BCEB663B3DB2D68A
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......F...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.XVe....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xae....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xae....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xae..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xbe...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............1:.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	downloaded
Size (bytes):	2279
Entropy (8bit):	7.354295352983905
Encrypted:	false
SSDEEP:
MD5:	7E0D59593F3377B72C29435C4B43954A
SHA1:	B4C5C39A6DFB460BBD2EACCEB09EC8079FB6A8E2
SHA-256:	62D706019A0D80173113EF70FBBEE12F286E8E221534BE788448AADA4B14C8E8
SHA-512:	397416A6A96A39F46F22E906A60E56067E5B7B11FB0597A733F862FC077C88D5ED31F51A82709A56F6082FB1F2F72F9A0FE0849E3DD493BB4240C265B546AAD3
Malicious:	false
Reputation:	unknown
URL:	https://810debeb-5240a3ad.pawradar.com.br/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	............ .....f......... .$...\|... .... .5.......00.... .j.......@@.... .....?......... .....2....PNG........IHDR................a....IDATx..1NCA.C..D@."-en.!.h..8@..9h..".....5M....h..-..l..L..P.Y.^luw...r.(.........w...B({....&.F......N.f%..........^&.x}Zu........g..7m......n?..U`....@.M8.g.-..\|..S.K.!....].%.I......&.I..`...F \|o;....{S....\|..VL...E....IEND.B`..PNG........IHDR..............w=.....IDATx..AJ.A.E_.5...D..$'....<.g.\...!.].!..Y....4...B.......4U...Q..J(...y....%..[t;..>\...~....O....r......e...F....8.d9....4.x.xW..e...c...~W..P2.........[.....r<..,..>....q.\...U...v.'......!.1.....9..:8............I.I.d.......IEND.B`..PNG........IHDR... ... .....szz.....IDATx..AJC1.E.{..... .;..>\..q+.. ..N.j....."8k.P..IF...M..{.8..F..Z.q...~.y}...0.f..U....Z...@yd...4......DT.B..)......v.8.....)..Lq.[....]_jrG$...3.%......i.vU...C...h0.....rz^.].....9..5.....mU~.E..GMF.X....?..Y.U..\|.c.k.v>..@.h..........Nh.u......IEND.B`..PNG........IHDR...

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	unknown
URL:	https://810debeb-5240a3ad.pawradar.com.br/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 113355
Category:	downloaded
Size (bytes):	20390
Entropy (8bit):	7.979439840390925
Encrypted:	false
SSDEEP:
MD5:	02363E4C20BE02F305298C569681427C
SHA1:	EEEF3294F36805907EC217BE82022A71350AA7F5
SHA-256:	DE0591B9220B931A57F173CE64D7E14F041B979CA5BEC6127B4BCEC7C373AD1C
SHA-512:	7AD5AB34536709F0AA0C7FEDABF6432A6EB2F5D201BC71AA34E236E230D9FDF7C01EAE3A1800DE9F9AF01521B881478F259BE1574755C4FC17B8090E237BE9DA
Malicious:	false
Reputation:	unknown
URL:	https://810debeb-5240a3ad.pawradar.com.br/ests/2.1/content/cdnbundles/converged.v2.login.min_mc5ac6ol0l4d2iaqspstyg2.css
Preview:	...........}ks.6.....\.R;.J.H=-WR;..&>g^53.G.R[.DY<C..$e.WG..... )...{+'g...l............bw_f7.:x..<x.-.V5)/wE..Y...gy.0.(.-o.e.\|..._..I.....?<{.!x...W..._..^..p..E..'..Y...<.....]..6(. ..D.....Y.......:.ve.?..!..\|t...].+.......a.......\|.P...u.H.d.d.r.c[..~.L..n.-.}e.H3...r..^..iP.u..z.....)..Z.jx..C'......u..{.C...N.o.m~..F(b..f.....h..O.....6....kr.......n2m M$.R..R..i{.~.....n.dKY..#.Kn.4..G...O..l.#.a=..iU..].S.2.wY..O.\|...Z.A....].uU.._%U.<...pp..u=.....C.R..S.....0...A<......&...W..'o.T.."..jO..^+.....DiW.b..7i..7..........lKe.0.~B0.....zQu#...YB.,.{.&.6..G.6..._...J.i.?.LS$( .^.{..u.-.0....K....M&j..s.yB..+....^.)...7e.....]..eFI_.kRX.B......D[.4......+.u=>....R.`QEK...R..d...*S.. ,c5RKBK(......][..eF{T.....6...".....Uk:..S.0Ro.}B.dwJZ}U..S.F.....&.&.~\|......{..Ep.>x..._....}p..=.}...v...7?}...g..1&.......}...^...o.x.>x...../.^....._.........w.v./.........BA...{J..w..$?.}w....?zO.r..5...7.gl..z...g.?.{....R.......yGj

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	467
Entropy (8bit):	5.719065879218642
Encrypted:	false
SSDEEP:
MD5:	3632234E193AAEA777716808ACFF3E2D
SHA1:	C66FA1B66C1586FDB88EB730F594B5DB51934576
SHA-256:	C22C7BBB21430DC671F7B82EBD9F1EB78D425EF9660F4BEFE16779BCD96514F1
SHA-512:	64C5897DB9544C7FE96535C4E7DD1ECCAB9E679C24EBEEE107D88980B594D098CFDAFA91A8605C1A46913F9E7B43EA8743BB7E7BB1C81904A54BDD50CDACD3EF
Malicious:	false
Reputation:	unknown
URL:	https://antoniopneus-com-br.cdn.ampproject.org/c/s/ANToniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A
Preview:	<HTML><HEAD>.<meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>Redirecting</TITLE>.<META HTTP-EQUIV="refresh" content="0; url=https://ANToniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A">.</HEAD>.<BODY onLoad="location.replace('https://ANToniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ\x3d\x3d$%C3%A3%E2%82%AC%E2%80%9A'+document.location.hash)">.</BODY></HTML>..

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.860223690068481
Encrypted:	false
SSDEEP:
MD5:	DF6A7721C242813411CC6950DF40F9B3
SHA1:	B2068C4A65C183AAD6FC22A44CC1FA449CD355B4
SHA-256:	AA53B6DC744357B392FC57C34E516BAE465D4A6837775C137A176D599C8EA948
SHA-512:	CDCFB686649F2061FE13A58841EB6A4E17F40951BA0C440C568B248E6128B6E0C4E79F95DC3EAB81286C103ED2A966F7058D22066466ADED482BF9ECAA6EA3CB
Malicious:	false
Reputation:	unknown
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.164497779200461
Encrypted:	false
SSDEEP:
MD5:	17C4BD96DCB397D1D62D24921BC4FEBA
SHA1:	2C0F2AFF858069D582A97867B183EBD5DC8A9FCB
SHA-256:	3549DBC06BDD994A38C9A29AECD7E8F9577E2150D15F8D6B0533B4D250666514
SHA-512:	9659C4D5B7EF0C852428D3AE8A8EE816438E268E4537FFA70823C9CB2C240252E6D9E863B2AE95F39397172EEFAAA73541123DC9255C9B37FC9437C655F55A78
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwl6PFMS9u7cfhIFDU9-u70SBQ1Xevf9?alt=proto
Preview:	ChIKBw1Pfru9GgAKBw1Xevf9GgA=

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 3551
Category:	downloaded
Size (bytes):	1436
Entropy (8bit):	7.8877206700779094
Encrypted:	false
SSDEEP:
MD5:	93035D0F0CE5F7D570D06E0C90201706
SHA1:	3CFE18C4FE0139693800CDACE8781270BC5172DC
SHA-256:	79B563CC07AD8EACB50475117C0B0A0C1BC965F69DDC1FBE026DD3F719372764
SHA-512:	AB54236A9E3E7ED911F6A2F2A25CB8144DB8C8783B033C4114B270A67FE0E277145510E62B82D8C42F911B96A265860D55BB2B0E86A8334D8D7066F057992CC3
Malicious:	false
Reputation:	unknown
URL:	https://l1ve.pawradar.com.br/Me.htm?v=3
Preview:	...........W.n.8.}.W.D...V.-N"...n.u.E..>.^..(.[..H.i...wt.dw.M...H&g......k.L].}K.EN\|ug..-+G..'.n.Q.I.<G....x[f:.#UG`7.s._...1...#<.w2..L..ncT'....T.g'9.....Uc..#2..I4.D.t..ru.+gI....H...?J7..5.Y....@._S..s.N~J.".....i...BV..A.Y8'.....O.Z...^.... 7....U...j]..G,......6I2i.p.."X$.\|....\./R.6M....aX.DR[3P.r.NO...`ET}#.q......}.;...wF..>E...>.........(`.T....$.&..fa..j...q...h.y..-t:\KS.."..!i.D.h1T.Z..h.R./MB.fl^.>m.<9.$M..b....v%c.aL...].ZB.z.pM..~.@J.'I8....nz.og..s..T.1.tg.RM.;..A....hm.".0!.....,+a.@...4....z.....v08..Mp..Lb..s...y.:...J...D."...H.j...s...l4'.1.....E..h-...'................6.y........w6.....z.?m........%..2b...F...[Z...x].S .BBM#..E.E......1.3.....J.gM.......T...\J.ON..1.3.ve......r^5.......:.$...$B..:l)>A...od.9..{_9.b...R.K?..7"p...&.\G...z.j.%.U..V.)..~.<.&\|.%......g.............Xi]{h.l..-/8.QA/....Y~+^2....6.......-...9q2.%..&u@...J..mI....(2..h%:o(0skYXnx.....B.=H.H.....h.{N..H: ...@Q{0y.3.p...@.w.!.w.-.x.....O~8

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6584200238076905
Encrypted:	false
SSDEEP:
MD5:	2D2CBA7D7DC75F3BA9DC756738D41A6E
SHA1:	F87FD26066ED5E52A65DEE0ED2D581D3C3EA15AC
SHA-256:	00E21864CF1BC70302EBB5B496C6C471A7DA8CBF600630B478A3E2376ED20EA2
SHA-512:	46F17658CA247C02F612213025350390D8F62179C8DE26725EB17F5CCFAFDD63F2149DA1765D3C2F3A12FE85EF29CAC58457B0D5C2F8DA8DED6E1231A35F199D
Malicious:	false
Reputation:	unknown
URL:	https://810debeb-5240a3ad.pawradar.com.br/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 280 x 60, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	6297
Entropy (8bit):	7.950489490026617
Encrypted:	false
SSDEEP:
MD5:	74CABA060BC836E70D4F5D5F667040B1
SHA1:	0ADDEA394E0CC6C8D58145C767BB8AE245620BD9
SHA-256:	F91A4538E7B7789D0B53325D90E0D6661B774F01A5336A4B56BC3947560E9AF1
SHA-512:	8BC559C21BAFBE9C4FAC82663E25E0FC40198ECE08BBDC0E606676FE1C9D8FC391C579D3E4FBACC9B48D87C7BA1A89E95D94CE0B917E3AB5F0A359664EEB9E9C
Malicious:	false
Reputation:	unknown
URL:	https://4d9e3863-5240a3ad.pawradar.com.br/c1c6b6c8-gu93kzcvv9nfo0jjjijxe9133mrsglit9lh2ikhkvmm/logintenantbranding/0/bannerlogo?ts=637271955782382065
Preview:	.PNG........IHDR.......<............pHYs..........+......tIME.....,...R....tEXtAuthor....H....tEXtDescription...!#....tEXtCopyright....:....tEXtCreation time.5.......tEXtSoftware.]p.:....tEXtDisclaimer.........tEXtWarning........tEXtSource.........tEXtComment........tEXtTitle....'...dIDATx..{...u...VUw.[B.....0`;FK..wY0~ .B.53....^...l6..l..]..... ..F.!@.$...$@l,..`.,4 .a,i..LwW.{....H..<z.GP...O..[..[]u.s.WT........Z...../.......-.....H.....2.....Q0.q..X.9}..w.+. [..)....S.h..j%cLL....F6.....8....>p..#.g3.{...9....)...........I.... .9.+..8...2&.......W>m....m....L.......ZRp4.....sW=S....\|.....lj_LK.yR..G.z.1.>..L..kT.W.....@..$!..7.Qmz...3.,.Y..z&O....Z.Y0....z.e...4.....\.....4.p4.D....W.Q...../.F6...3N{...W8.B.B..........y<).\ o.D..e...C...l\x..."&&f.q.`dS..H...>....ZV..xA.Se...\|...^.=Y...'......tPa.cbb.Ps.#].![...).W.cF@$o.....L#7D...$<....x.g6..-..8g&&f..k..~.......{..m.d..8..u.t7..Gh.<.."..w..^...0.F..w.#(..l..9....!.g4.{0x...SYj.`...<\|y

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 447049
Category:	downloaded
Size (bytes):	121723
Entropy (8bit):	7.997673145956696
Encrypted:	true
SSDEEP:
MD5:	0055D9BDE07A8B0D35AD234EE70FB566
SHA1:	093A97D6FC43DD702813C1035C811C53162E9793
SHA-256:	412BFBE2494A8844FBB370AA3102C2167742AE24828C8D360496C8BECAD0C7FC
SHA-512:	98C9938A12E1AD3A435CB96F6372B76EE0C6BABD66A29224D1C30BEBF9860D612E7C96B47BE2E3A28FBA5573D303D980AD6579F2E56632C706C6D5EFC532FA32
Malicious:	false
Reputation:	unknown
URL:	https://810debeb-5240a3ad.pawradar.com.br/shared/1.0/content/js/ConvergedLogin_PCore_Kjlmc42uL0ATl_21eYcwVg2.js
Preview:	...........m{.8....~.......e.-....I....8...L.Y..ud.+.y......I...T....s...T,.\|.A..A..O;.G.....W....o.........\|.G.rts6<..z.Q....W....wb...A%.^..."...9..y._.F.<.."..dN.W\|/N....s...En......U...3..y..v..+.~HA.x...K.......\.U..<.r.9Q....1.yO.H...\|.z.X%fIe.F...G.2FHQkL...c...?y.T8...0@/....0h,...k].DZ..7.J.V^..}6./.U.o.....:.t.zn.1....._..<...b.{..,. ._+.....9.8{.16gA.......V...:B#.+,N...8.T.....$.J..8...?.J..0....~..$Y...3/yXN...9.];.;.>.>..r..1..y.....}<...3..9....r.....s..d.W.L..f.J...fB...:..rry.?]).T>.L.......J........d.D..Z.m.N...q..VCw......`.<..{{5..o.;}4..T.JH..u...v<z..%...Uw......vw.[.nw./..C.?....?..!v .2.D..2.....n.;+..jT.....p....S...iR.Ukk1@k..mk.l...a.....M..mpW.X..............I..3..7w.]d....P.bX....z.g...\|..N#K[..^(..x...VM.A..JF..R.R.R..F..om.B.pJk..<D....\...(..i[...z...I.J. ..U...x1.W6...L....+.S....c....110.......5..H....E,O..v..b.V.=...H$.J..J..M.4.#..dzPK..S.B@RJ.V>..GJ."/.uMwC..Q.`.k......KN\|.o....{vi.YUC ...M.

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 513
Category:	downloaded
Size (bytes):	276
Entropy (8bit):	7.319344972980597
Encrypted:	false
SSDEEP:
MD5:	44D8807C223B5C6DEF6E75A602F314EF
SHA1:	E061C196D771661D6C47336C50EAFE2B3BA14130
SHA-256:	BA9816D7AF3E3B0EA5B6B34BAA0C99FE5EDCF4CA9BE30307AAA2956F994A8B1E
SHA-512:	E71B16643B2AC3DC315D1EEF21B9054A71F35E9E2E1DC0D36ABC08F4BDF1A9D3C3D6E9D35D06217966647367DCDD7709EA92B558CE407422FC13B4C33E12E3E4
Malicious:	false
Reputation:	unknown
URL:	https://810debeb-5240a3ad.pawradar.com.br/shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg
Preview:	...........Q=o. ..+.......=t....E.k["...../g;n.,....{.......2....e.......J).8..).5.....>,.ih...^s...&M.Ta..m........C.N5.G.!.-...}.9.~........u.3..@i..qK.U.......E.........S.......A.....6...G..g...,f3g.5F..I...G@<..L.:`.N&.?R....d..(.7._....z.L.......s....

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 15767
Category:	downloaded
Size (bytes):	5538
Entropy (8bit):	7.958251478454778
Encrypted:	false
SSDEEP:
MD5:	7A44785AE6B0C9669B4D2A5248F0C059
SHA1:	C4B64849A6B9F04F6580BBB6EA1E7054214276E8
SHA-256:	2D167AC2DE069B2441F436077C4E93430653DDBF28ED31795178D2222DD166E9
SHA-512:	3124132C1D5FBE1410112F6ECC70BBC83C5694E19CAA3A549BF51C4FCA4ACB991BCC7E659FFC309D96060CB494A0CEFEDA0046E7633299DDC1C9CF9C2CA570F9
Malicious:	false
Reputation:	unknown
URL:	https://810debeb-5240a3ad.pawradar.com.br/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_0b5ca5d48eeaf75b0528.js
Preview:	...........[.w.F....Bh..i3...vqU..........&9...P,$uF.S.w..;#!..;}7'.h..;w..+..U.......?F.sr.1.....q......N.y.\|<.)...i......y..F...0....$.^.1..".Bc ............bQ.....N..'.............q2..QjDq....E....!..D>..t..G.e......!x....DN0...3<...Sc..t..p.6AfX..F.(.8...\| ......0...d.C.8.gN..%2.w..#..Y<./..DC.\|.K.....@.?...1%..Db..1....%.v.?$....../"......\|...y\-..`...u2fp..I.C.[.\|.H..b`._d..r.H.zup...{......i".... .MzN.M..{...c.'..x2.=.c..pP......./R/..\|k....1N..D....h...u~.W....+.D............cM..dMy/..w?.[.[16...l;.D........._..n.&Q..eq.1i?.{.8WZ.l....f...6.....5..i...j.~.Y...._'\...... ..).............X......Z*o...).c..Q.=.0<...<.)4....E..........r.f...%...K=..(.Z.G.a.=?........#qg....s..;~ .....6MF......d.-c-...Vr6..$~..._....Z...k..=tz.K.H.<...K..(....\|......./...c}/....kAO3....u0(......D..1..x...h..2.>`x.......<..5%f.S.u.s.ax.1.`~...G.^....'!....-.>jJ...0.O...8.!.....i.~...0_...._FC0..).'..F.`."'.n.....q.n....z.y.pL..i..G.I+t..Y..n...

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	unknown
URL:	https://810debeb-5240a3ad.pawradar.com.br/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1420x1200, components 3
Category:	downloaded
Size (bytes):	202674
Entropy (8bit):	7.977589463192636
Encrypted:	false
SSDEEP:
MD5:	A9AFFF093AE10BA09735D13BA0F71E22
SHA1:	8BDCC469286BA4372A6BB8DC228C677637F59F8A
SHA-256:	56CB3896CA6272F10CBD86A173206DEEC13A9D3D32B8A04C0040D843D2DBA553
SHA-512:	749E9C6299ADEF2B793DABC3B809313FD83F28EDC041001EFE010A8A9F0E13CF72DB87DA06D8A33469EFE5F1390BDDB9EDE5D0A62DC28B9FFD62896F9E4BA650
Malicious:	false
Reputation:	unknown
URL:	https://4d9e3863-5240a3ad.pawradar.com.br/c1c6b6c8-gu93kzcvv9nfo0jjjijxe9133mrsglit9lh2ikhkvmm/logintenantbranding/0/illustration?ts=635896818023035143
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................".........................................U......................!..1A.Qa.."q...2.....#BR....br.$3....CS..%&4Dcs.56d.Tt........................................>.......................!1.A..Q"2aq..3......#B..Rb...r4C..$%.............?....r......U.DOQ{+.\|]#e'I....W4[Y=RE.{.Yx..He..7.v. B...vN=R(p..l...aF...%;@..m......k............(.......o..`I]'.3.....1.....s.........;.$@..o..R...@....7.@i........A..X..K%..Ja......\|-3.....[..Qq.:....[<w.o....................n...... ...O..Rv[....c.<}...^ Vm..?9^e.{....{......4~~.......N.\.9.A.Y`.(._&.d.n\|...6(.X....<.\|i.....:V.r.1..y.h;...<^....7.5 H....P....i..s....&u.P.m.ko..X.".c.L..j.. ..`.>a...X.. ..@L..7R..`.-.....A.#^.."..d.t.1.A:m...D.(.t....w......,.d.T...Lm...&v.Tl....HLA..am5.%...Mbu...`_~...:h.>P.A./.`..?U5.........0m7......A...F?.P.. .Dk6.

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 223841
Category:	downloaded
Size (bytes):	54376
Entropy (8bit):	7.995329649360672
Encrypted:	true
SSDEEP:
MD5:	BAF99BC01E805A1DF9652CD1C7B5380B
SHA1:	C9DEC1D06D3043769DE7764AD32C4BCEF6DE4C6A
SHA-256:	3036B7F6816CA324B2E0ABBD5A9F29DF5802EC3D6600E034A1313CA38C6F33B0
SHA-512:	7DBD494A5DF1897DA8738B890F6D0005262E39E2FEA7934890ACB8A152EFDB9C1DDEA974D9E54A84E6C2CE55AFDD9126BB3CD80BE69E2A3ECD81783BDDCC4F01
Malicious:	false
Reputation:	unknown
URL:	https://810debeb-5240a3ad.pawradar.com.br/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js
Preview:	...........k{.F.0.}...gF.L."..mR..v.y.O....g...........X...~...@....f<...F./...u...;........W...\|.y.C...y....x....._?{.....N...I.Y$.....".w....$..\|..a...K.7O.eg.g..."...8..2)J..,^fW......a^^w.....~..%.I._G...~_..4+.(..Z[.CZ...y.."..:?%Q.....q.'...r.....q...."...6.~.........0.w...\.D._.`...W.L.....u_..l..k..Sf...W.I.....~.\5.C.WQ.7.Y..;..r..z.!`.8.N.~....u.<.S......<...2NK....g..r.......(..^..R.WI...6.t~+.t......78....{uQ..b..w....Y..^..<..Qv.?...Yu....F..&:...W....V...dp.w^Tg0..w.e......J<3V.X........:+......<{..^%..v.U\|.......Z.....t..WUq.>..7..G.E.F8+7.K?.n.y'.rw.........x~...=?.?...y~.?....<...(H........V.2....Ex.?.O.>l.8.E..c]..n.?..>......%<.....?....w........../.2.^...d........1b...4....+.......7e..../.r..Q.[:-__..q......U?.....L...K...{\.er.gU9..\|@.p..p..`M.........0YVyl......-....g....c..n....9....q..7...j...@.>..T...2..X....9.Wu`,..V..'.Y8......P.e?.m..q..XB_~.....W<<[....^o.i.(".c...Y..m.x{S.7.&%\/..@....,....a#......F

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 26679
Category:	downloaded
Size (bytes):	7406
Entropy (8bit):	7.971249656857067
Encrypted:	false
SSDEEP:
MD5:	5D56B4B9CC9D4F5C9100FE677F0D837A
SHA1:	6D3EC574B8B181D1470647735A4A9AA8D6275B75
SHA-256:	F4159CE23E89358A9AD834A034214FD690C005BA9363B51FE943223819102454
SHA-512:	0DC0A3156034E546049028625C8954CB500CC8DA41E09588B0BE4A101A79C351384CC9792E3756BB3C2F59FED441013D0220CD051D14D05B0C6A49A161BEC39E
Malicious:	false
Reputation:	unknown
URL:	https://810debeb-5240a3ad.pawradar.com.br/shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_4d39c0367444c533fcd7.js
Preview:	...........=kw.6...W..=....;...e}.......d.$G."!.1E.$dY...w.........{.zj. 0..{. ........m........vy..N.WGZ..~............`.'......#'...B....,.X.p.h3...N..c6...jQ.>S.'Z.'...h.....bO.91_j.a.\|......h.EK.=.Z..R..=.-..0..<.h.-..;..}7f..s-...o`.d...)...TK(..,.S.....g.5..........=.8.....@.!.....cX.,...90.....d...b=~8.n.D...8@....,3.........&.. .....C.,.I.H.l:`.3.)... ..CGK.E..X..h.Y...y+./.....h......?..y...rk{....G..........E.xNl.lf....O.'.e..P..O.....\|&.fi.........l.^....'z.'...Y./...+..G.WSPU..E_........q...jE......'...T....O...?.Y.y..tJB.....`s..Ab..6.._;.I..A..z...=... .~.w../.2..;.9...&..].!.G......$.n..d._.0.....c......O.L...A......].+##.3.<.A&.;6{..1.^.._2..3.M....W.1.@..R...%..t...8.YLf.o.. .1...:v..M........].T.(.Q..D.L.e...K..k?.>.... .5..%tf.\..'Q.,/.....!W.6..+.....OX.6.[..$...-...S...9.[....(.....M......h<.Y...%.;'.S.M....T....C...%..=!.p..8........c0j.vMC.V.8...N.;.2e.lC*d..h..xs..=...h..-.^Q..1...gb..^J.........L..g~xM..y..s.

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 141462
Category:	downloaded
Size (bytes):	49720
Entropy (8bit):	7.99557081225868
Encrypted:	true
SSDEEP:
MD5:	D9FAD0FBB757334B25FCAE4E6DB91A40
SHA1:	EDE5970E289F6CA84385402986BA1EF9F36E0453
SHA-256:	B6E11A8B756A9357FF1A566C3CC6709509DAA9D831B0AFC0E7CBCF3FD9F9FCB7
SHA-512:	6E1D9AA942FC0E69EB004E291337E3A3D4EAB337D9D738E942FDC630E37052FDF8271742E3E94F718CE65018CE38094BF12022B2E706FC215E88870B6C98B3EA
Malicious:	false
Reputation:	unknown
URL:	https://b5794ac5-5240a3ad.pawradar.com.br/shared/1.0/content/js/BssoInterrupt_Core_sw-M8KkV3_nBot-G1ImRcw2.js
Preview:	............[.8.8...+.w..O...hp../.t73@..sy..qb.<...p....O]$[v..g.<......,..JU........~..}.?..y....T;.rx._;..?j'......?.....Im.LD.~.^".Z......(.F....v.......qt_K.Dm.G..Q..&A.B...D..:T...S/N.k.......-..B(=....\|...(.F..>.6..0..Y..x...j..(..h..b1...\|$.Az..V.E-.im........R..g....C....*.SG./t0.....t..D......U..-...F..h&[..'.ok.......yu...6J.B7..?`.'.Z..q...`.k.i....v.{!.\}.......aj.....>..)4.zf.D.F....R.A"lE...I...?.Z..lm.57.-....t.8..Az7..S.1.\|/.G.=...hv;.....+t._.i.?Y.3..G.7.v:.Bkj......H..F.T.D.FB...>!^98..o9.Ye}e<.G..0_.s-............./...?.k+q.....&..{".....4.f......"..@.i.>O.}.%...P2.@X....Y....]...3{:K...._1-\|p.]l@.d\....R.....k.?&.0Z].Aw.3.Rsf'w.8..us.;...}i9.y7.B.X....2.6c....6.,.d...&./..Z.g.e.L.e>..B..Q.SU.J..90.e.4..'..... .__..c.Y.H.-.%%\}..7.z7V\....jfz.....c..R...pg,......(Z....A...6..w1...;..'.0.Q...a.og...2.....?..H-k..........[!...M...zheu....@k{......N.....B3..L...EiU..L..<D^`ys..........^_..[..LH.%......^...2Ld7...Q.$J

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 55503
Category:	downloaded
Size (bytes):	15942
Entropy (8bit):	7.985848663515711
Encrypted:	false
SSDEEP:
MD5:	E488D353476FAC6C93E6056EDF1B04E2
SHA1:	69BFEF9AAFE0F7543ED36FB26F558C769EF97BEF
SHA-256:	EB3C57E120B75B045A09F177C61420DD4BF785613185D253C0D8F53DC6474CE3
SHA-512:	A805573E08E5F4D0D5088D15916E3BDA54036700E875F249541CB1CF9F26172B0ECD6D20E71625CDDF275F9D8270DC4DC6443C4884AEA71DE50C0FC6098DA716
Malicious:	false
Reputation:	unknown
URL:	https://810debeb-5240a3ad.pawradar.com.br/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_fo8rkc18qnhjh4wnzabsdg2.js
Preview:	...........}Ms#G.....u...z \|..#h........C)$....`/.n...p..8...;.j.\|..G_\|.O.........n..How...!..+++++3+3.w7k..{..R.=.......~....E.......O. ......7.U.Q..?~v.Y.w..;....._...N...e.zpb'.....7k....\|.a...((-...J........,.}~.c2.'p<..eu.................9n#,.......7.\?...^6...^.3..^.h.....R(.^..p...xY...c..D..l2..'#o.W..7iB...XL..S.(.B......i.D.M\p..`..Eg{.....7M..{...zh...'N]..L...s..2.A..u..."p.. Xx....w..'l..w..'c/^.FP....q.h4.R+X^{...d..M.C.J,..RP.7E.T......8 .v....Iw.X..?.r......nk./..?Wj..A.\|./........JAs.j......?.!..t.z.-..m.]..3y...S@...'.).).Aa..1.kQ.....l+.....-q..n.p../..l.H>G.^<.}..ID.][D..[!...........{O....9.C...8V>..=N..(.4.KXt../.1U...\F.*0..=.......p.-..kQ@P..(...-..ea&>.y.......:..Y.t[x..Xw:.QTp....ZE.u..\?`q......EhJ.A.L.......P..=.xk....(.wrL.."d.q`...$../.\...M.<_\|.<.~\|[....l....o...;p.(z.&.,~.....X....1?e1.1..v.L.........,.......?{...\fB....-.).Fb.;.p.N...n(..^....B.#D...g\|.E..8R\.0....7 ...C....QQ.fPB3."F..dN....%.s..%....'

Static File Info

⊘No static file info

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://www-bbc-co-uk.cdn.ampproject.org/c/s/ANToniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 84

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Static File Info

Windows Analysis Report
https://www-bbc-co-uk.cdn.ampproject.org/c/s/ANToniopneus.com.br/dayo/laits/captcha/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A