Windows Analysis Report
https://urlz.fr/r1TD

Overview

General Information

Sample URL: https://urlz.fr/r1TD
Analysis ID: 1467880
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Detected non-DNS traffic on DNS port

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: https://urlz.fr/r1TD SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering
Antivirus detection for URL or domain
Source: https://notube.lol/fr/youtube-app-v133 Avira URL Cloud: Label: malware
Source: https://urlz.fr/r1TD HTTP Parser: No favicon
Source: unknown HTTPS traffic detected: 23.212.194.8:443 -> 192.168.2.7:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.212.194.8:443 -> 192.168.2.7:49712 version: TLS 1.2
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.7:60666 -> 1.1.1.1:53
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown TCP traffic detected without corresponding DNS query: 23.212.194.8
Source: unknown TCP traffic detected without corresponding DNS query: 23.212.194.8
Source: unknown TCP traffic detected without corresponding DNS query: 23.212.194.8
Source: unknown TCP traffic detected without corresponding DNS query: 23.212.194.8
Source: unknown TCP traffic detected without corresponding DNS query: 23.212.194.8
Source: unknown TCP traffic detected without corresponding DNS query: 23.212.194.8
Source: unknown TCP traffic detected without corresponding DNS query: 23.212.194.8
Source: unknown TCP traffic detected without corresponding DNS query: 23.212.194.8
Source: unknown TCP traffic detected without corresponding DNS query: 23.212.194.8
Source: unknown TCP traffic detected without corresponding DNS query: 23.212.194.8
Source: unknown TCP traffic detected without corresponding DNS query: 23.212.194.8
Source: unknown TCP traffic detected without corresponding DNS query: 23.212.194.8
Source: unknown TCP traffic detected without corresponding DNS query: 23.212.194.8
Source: unknown TCP traffic detected without corresponding DNS query: 23.212.194.8
Source: unknown TCP traffic detected without corresponding DNS query: 23.212.194.8
Source: unknown TCP traffic detected without corresponding DNS query: 23.212.194.8
Source: unknown TCP traffic detected without corresponding DNS query: 23.212.194.8
Source: unknown TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /r1TD HTTP/1.1Host: urlz.frConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: urlz.frConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://urlz.fr/r1TDAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: chromecache_107.2.dr String found in binary or memory: <div id="partenaires"><a href="https://convertall.com/fr/convertisseur-pdf" title="Convertisseur PDF gratuit" onclick="if (!window.__cfRLUnblockHandlers) return false; window.open(this.href); return false;" data-cf-modified-04614967c3e055ef5d7398c9->Convertir en PDF</a> - <a href="https://casinobonusca.com/fr/" title="Casinobonusca" onclick="if (!window.__cfRLUnblockHandlers) return false; window.open(this.href); return false;" data-cf-modified-04614967c3e055ef5d7398c9->Casinobonusca</a> - <a href="https://cpstest.click/fr" title="Testez a quelle vitesse vous cliquez" onclick="if (!window.__cfRLUnblockHandlers) return false; window.open(this.href); return false;" data-cf-modified-04614967c3e055ef5d7398c9->Click Test</a> - <a title="Convertisseur YouTube MP3" href="https://notube.lol/fr/youtube-app-v133" onclick="if (!window.__cfRLUnblockHandlers) return false; window.open(this.href); return false;" data-cf-modified-04614967c3e055ef5d7398c9->Convertisseur YouTube MP3</a> - <a title="Trouver un serveur Minecraft" href="https://serveur-prive.net/minecraft" onclick="if (!window.__cfRLUnblockHandlers) return false; window.open(this.href); return false;" data-cf-modified-04614967c3e055ef5d7398c9->Serveur Minecraft gratuit</a> - <a title="Localiser mon ip" href="https://ipcost.com/fr" onclick="if (!window.__cfRLUnblockHandlers) return false; window.open(this.href); return false;" data-cf-modified-04614967c3e055ef5d7398c9->Localiser ip</a> - <a href="http://www.zupimages.net/" title="H equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: urlz.fr
Source: global traffic DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: unknown HTTP traffic detected: POST /report/v4?s=CGL4Nxg11L%2FyAdVfH6x7x9ZCJlaQja0steU6io7SdjXGoGhIxhTmBssr1j97ENbF2PgLFFgkRrOAwF04JUx%2B3kFY9nYjfMt%2FHVXqTauQ8ERDrVvPk9mkLDQc HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 382Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 04 Jul 2024 22:25:18 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CGL4Nxg11L%2FyAdVfH6x7x9ZCJlaQja0steU6io7SdjXGoGhIxhTmBssr1j97ENbF2PgLFFgkRrOAwF04JUx%2B3kFY9nYjfMt%2FHVXqTauQ8ERDrVvPk9mkLDQc"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 89e287cb5fad7c8a-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 04 Jul 2024 22:25:19 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCache-Control: max-age=86400CF-Cache-Status: EXPIREDReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YQNCvpSY7zluMdmUj%2FbVGruRTC1D51w9TyjzJsgzgkLVcmj%2BRVp%2FUlzAIN0B5eswXDl309oOaoNnOmhcXt6peXKI%2FsuPSniuAcc3JSxycX0pU%2FXZxt1kPsLX"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 89e287cf8ae77ce7-EWRalt-svc: h3=":443"; ma=86400
Source: chromecache_107.2.dr String found in binary or memory: http://www.zupimages.net/
Source: chromecache_107.2.dr String found in binary or memory: https://casinobonusca.com/fr/
Source: chromecache_107.2.dr String found in binary or memory: https://cmp.quantcast.com
Source: chromecache_107.2.dr String found in binary or memory: https://convertall.com/fr/convertisseur-pdf
Source: chromecache_107.2.dr String found in binary or memory: https://cpstest.click/fr
Source: chromecache_107.2.dr String found in binary or memory: https://ipcost.com/fr
Source: chromecache_107.2.dr String found in binary or memory: https://notube.lol/fr/youtube-app-v133
Source: chromecache_107.2.dr String found in binary or memory: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1581144506541376
Source: chromecache_107.2.dr String found in binary or memory: https://serveur-prive.net/minecraft
Source: chromecache_107.2.dr String found in binary or memory: https://twitter.com/URLzFR
Source: chromecache_107.2.dr String found in binary or memory: https://urlz.fr/
Source: chromecache_107.2.dr String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-162669458-1
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60672 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60670 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60672
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60671
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60670
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60671 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown HTTPS traffic detected: 23.212.194.8:443 -> 192.168.2.7:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.212.194.8:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: classification engine Classification label: mal56.win@21/4@6/6
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 --field-trial-handle=2460,i,5162128387195293770,17291697451212001631,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://urlz.fr/r1TD"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 --field-trial-handle=2460,i,5162128387195293770,17291697451212001631,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1467880 URL: https://urlz.fr/r1TD Startdate: 05/07/2024 Architecture: WINDOWS Score: 56 26 Antivirus detection for URL or domain 2->26 28 Antivirus / Scanner detection for submitted sample 2->28 6 chrome.exe 1 2->6         started        9 chrome.exe 2->9         started        process3 dnsIp4 14 192.168.2.4 unknown unknown 6->14 16 192.168.2.7, 123, 138, 443 unknown unknown 6->16 18 239.255.255.250 unknown Reserved 6->18 11 chrome.exe 6->11         started        process5 dnsIp6 20 www.google.com 142.250.185.132, 443, 49710, 60672 GOOGLEUS United States 11->20 22 a.nel.cloudflare.com 35.190.80.1, 443, 49708, 49709 GOOGLEUS United States 11->22 24 urlz.fr 104.21.234.214, 443, 49704, 49705 CLOUDFLARENETUS United States 11->24
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
239.255.255.250
 unknown Reserved
unknown unknown false
35.190.80.1
 a.nel.cloudflare.com United States
15169 GOOGLEUS false
142.250.185.132
 www.google.com United States
15169 GOOGLEUS false
104.21.234.214
 urlz.fr United States
13335 CLOUDFLARENETUS false

Private

IP
192.168.2.7
192.168.2.4

Contacted Domains

Name IP Active
a.nel.cloudflare.com 35.190.80.1 true
urlz.fr 104.21.234.214 true
www.google.com 142.250.185.132 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://urlz.fr/favicon.ico false
  • Avira URL Cloud: safe
 unknown
https://a.nel.cloudflare.com/report/v4?s=YQNCvpSY7zluMdmUj%2FbVGruRTC1D51w9TyjzJsgzgkLVcmj%2BRVp%2FUlzAIN0B5eswXDl309oOaoNnOmhcXt6peXKI%2FsuPSniuAcc3JSxycX0pU%2FXZxt1kPsLX false
  • Avira URL Cloud: safe
 unknown
https://a.nel.cloudflare.com/report/v4?s=CGL4Nxg11L%2FyAdVfH6x7x9ZCJlaQja0steU6io7SdjXGoGhIxhTmBssr1j97ENbF2PgLFFgkRrOAwF04JUx%2B3kFY9nYjfMt%2FHVXqTauQ8ERDrVvPk9mkLDQc false
  • Avira URL Cloud: safe
 unknown
https://urlz.fr/r1TD true
    		unknown