Windows Analysis Report
https://nimb.ws/uRSOy9q

Overview

General Information

Sample URL:	https://nimb.ws/uRSOy9q
Analysis ID:	1541501

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish54

AI detected landing page (webpage, office document or email)

Phishing site detected (based on favicon image match)

Phishing site detected (based on image similarity)

Phishing site or detected (based on various text indicators)

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Signatures

Phishing

AI detected phishing page

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	LLM: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'bradfordmarine.bytheyardservices.com' does not match the legitimate domain for Microsoft., The domain 'bytheyardservices.com' does not appear to be related to Microsoft, which is suspicious., The presence of input fields for 'Email, phone, or Skype' is typical for Microsoft services, but the domain mismatch raises concerns., The URL structure suggests a potential phishing attempt as it does not align with Microsoft's known domain. DOM: 3.7.pages.csv
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	LLM: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'bradfordmarine.bytheyardservices.com' does not match the legitimate domain for Microsoft., The domain 'bytheyardservices.com' does not appear to be related to Microsoft, which raises suspicion., The presence of input fields for 'Email, phone, or Skype' is typical for Microsoft services, but the domain mismatch is a strong indicator of phishing., The URL structure suggests a potential phishing attempt by using a subdomain to mimic a legitimate service. DOM: 3.8.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 0.24.id.script.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: 0.31.id.script.csv, type: HTML
Source: Yara match	File source: 3.8.pages.csv, type: HTML
Source: Yara match	File source: 3.6.pages.csv, type: HTML

Phishing site detected (based on favicon image match)

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true

Matcher: Template: microsoft matched with high similarity

Phishing site detected (based on image similarity)

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 1.0

OCR Text: Sign up to FuseBase for free + Save to FuseBase ag Share print Full screen RAIRDON John A. Dederman Sent yau a new encrypted message CLICK HERE TO VIEW MESSAGE Thanks

HTML body contains low number of good links

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true

HTTP Parser: Number of links: 0

HTML page contains hidden javascript code

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB

HTTP Parser: Base64 decoded: a[href="http://www.salidzini.lv/"][style="display: block; width: 88px; height: 31px; overflow: hidden; position: relative;"]

HTML title does not match URL

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true

HTTP Parser: Title: Sign in to your account does not match URL

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: Iframe src: https://5d9cbcef-e6d26ed4.bytheyardservices.com/Prefetch/Prefetch.aspx
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: Iframe src: https://5d9cbcef-e6d26ed4.bytheyardservices.com/Prefetch/Prefetch.aspx
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: Iframe src: https://5d9cbcef-e6d26ed4.bytheyardservices.com/Prefetch/Prefetch.aspx

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true

HTTP Parser: <input type="password" .../> found

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB	HTTP Parser: No favicon
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No favicon
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No favicon
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No favicon
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No favicon
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No favicon

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49830 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic	DNS traffic detected: DNS query: nimb.ws
Source: global traffic	DNS traffic detected: DNS query: premiumgain.nimbusweb.me
Source: global traffic	DNS traffic detected: DNS query: d3hogio4d1txum.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: nimbusweb.me
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: metric.nimbusweb.me
Source: global traffic	DNS traffic detected: DNS query: stt.nimbusweb.me
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: l.getsitecontrol.com
Source: global traffic	DNS traffic detected: DNS query: s2.getsitecontrol.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: bradfordmarine.bytheyardservices.com
Source: global traffic	DNS traffic detected: DNS query: events.getsitectrl.com
Source: global traffic	DNS traffic detected: DNS query: 635b2a2c-e6d26ed4.bytheyardservices.com
Source: global traffic	DNS traffic detected: DNS query: 9b7d0080-e6d26ed4.bytheyardservices.com
Source: global traffic	DNS traffic detected: DNS query: f6ccf083-e6d26ed4.bytheyardservices.com
Source: global traffic	DNS traffic detected: DNS query: l1ve.bytheyardservices.com
Source: global traffic	DNS traffic detected: DNS query: 5d9cbcef-e6d26ed4.bytheyardservices.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49830 version: TLS 1.2

Source: classification engine

Classification label: mal72.phis.win@19/57@60/355

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1964,i,17677752623552012898,389080841008536744,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://nimb.ws/uRSOy9q"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1964,i,17677752623552012898,389080841008536744,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: https://premiumgain.nimbusweb.me/share/11334622/yn85rfp6wmt2hykemiso

LLM: Page contains button: 'CLICK HERE TO VIEW MESSAGE' Source: '1.0.pages.csv'

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.224.189.125	premiumgain.nimbusweb.me	United States	16509	AMAZON-02US	false
142.250.74.202	unknown	United States	15169	GOOGLEUS	false
142.250.185.228	unknown	United States	15169	GOOGLEUS	false
13.224.189.39	unknown	United States	16509	AMAZON-02US	false
18.173.206.104	unknown	United States	3	MIT-GATEWAYSUS	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
169.150.247.39	gscwidgets2.b-cdn.net	United States	2711	SPIRITTEL-ASUS	false
169.150.249.167	gscstatic2.b-cdn.net	United States	2711	SPIRITTEL-ASUS	false
54.205.90.227	unknown	United States	14618	AMAZON-AESUS	false
142.250.185.163	unknown	United States	15169	GOOGLEUS	false
142.250.185.142	unknown	United States	15169	GOOGLEUS	false
216.239.36.21	unknown	United States	15169	GOOGLEUS	false
216.239.38.21	stt.nimbusweb.me	United States	15169	GOOGLEUS	false
18.66.122.56	nimbusweb.me	United States	3	MIT-GATEWAYSUS	false
142.250.184.206	unknown	United States	15169	GOOGLEUS	false
18.66.122.32	unknown	United States	3	MIT-GATEWAYSUS	false
142.250.110.84	unknown	United States	15169	GOOGLEUS	false
142.250.186.78	unknown	United States	15169	GOOGLEUS	false
198.58.104.63	5d9cbcef-e6d26ed4.bytheyardservices.com	United States	63949	LINODE-APLinodeLLCUS	true
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
216.239.36.181	analytics-alv.google.com	United States	15169	GOOGLEUS	false
216.58.206.67	unknown	United States	15169	GOOGLEUS	false
142.251.5.156	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
13.224.189.46	metric.nimbusweb.me	United States	16509	AMAZON-02US	false
142.250.185.232	unknown	United States	15169	GOOGLEUS	false
138.199.36.9	unknown	European Union	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
3.225.206.236	events.getsitectrl.com	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.173.206.24	d3hogio4d1txum.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
142.250.186.40	unknown	United States	15169	GOOGLEUS	false
216.58.212.163	unknown	United States	15169	GOOGLEUS	false
18.164.52.61	nimb.ws	United States	3	MIT-GATEWAYSUS	false

Private

IP
192.168.2.17
192.168.2.16

Contacted Domains

Name	IP	Active
stt.nimbusweb.me	216.239.38.21	true
5d9cbcef-e6d26ed4.bytheyardservices.com	198.58.104.63	true
f6ccf083-e6d26ed4.bytheyardservices.com	198.58.104.63	true
premiumgain.nimbusweb.me	13.224.189.125	true
metric.nimbusweb.me	13.224.189.46	true
stats.g.doubleclick.net	142.251.5.156	true
gscstatic2.b-cdn.net	169.150.249.167	true
analytics-alv.google.com	216.239.36.181	true
l1ve.bytheyardservices.com	198.58.104.63	true
events.getsitectrl.com	3.225.206.236	true
www.google.com	142.250.185.100	true
gscwidgets2.b-cdn.net	169.150.247.39	true
d3hogio4d1txum.cloudfront.net	18.173.206.24	true
bradfordmarine.bytheyardservices.com	198.58.104.63	true
635b2a2c-e6d26ed4.bytheyardservices.com	198.58.104.63	true
nimb.ws	18.164.52.61	true
nimbusweb.me	18.66.122.56	true
9b7d0080-e6d26ed4.bytheyardservices.com	198.58.104.63	true
s2.getsitecontrol.com	unknown	unknown
l.getsitecontrol.com	unknown	unknown
analytics.google.com	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB	false	unknown
https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	true	unknown
https://premiumgain.nimbusweb.me/share/11334622/yn85rfp6wmt2hykemiso	true	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 19:24:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	459E3E2E667FD032BDEC10D4D129261F	5C3104D57639C23499F903785CE891131F7EC4DD	236D710FB00867F13103194D418FE8E76F057E2EBB32969AF676B473439E3C99
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 19:24:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	A7BA4CC954D5846CB02498802E905E9E	378C09321833E684B241E4E4CE8772AA2A486A3B	331DCA838D4CB1BB1A41DFE21A041FE39B6E7D3CDFFC2B49A9CBBFB06C145105
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	654A63E3609ED26B652C8C68DEFB5B23	EF3585F2C8FD1B17DE01133487E2E517C9290B5E	5EF46451C8436D6F2CD91F1C333993D1EF0CD4A7F2C86036FBFDC18FCBC596C9
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 19:24:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	D70AA102CF36EF05C07748A85FD179C4	54739EC6F5019AD3CC87186D0DB5EA7D330A9004	11AEA36E21D83B418386B68DDD6081FDA46D112B31411CE530B6C544D97A3CC5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 19:24:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	63375DA126115E291B5629760C1D687B	E616E203CE8E6EF462FF2E3879C3DB90B5AB98F5	1EBC3BA401A19592060038758FC97A6751BCC92E6E2D1649C642E72C824A909C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 19:24:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	3FE07E98D5DC8AF155B1C0D08D37D4EF	E091251AF6B9743A3C0EB3AF16D4D57DDCBD22B6	771161DAFF0F2C3E51A69E4BE75A4E7B7DFB95B485CC7F1125D347580666216D
Chrome Cache Entry: 120	ASCII text, with very long lines (5844)	40E18F7BB11B8DB06FC0638314B08E93	4F20AAF99447628CC4681932ECFBB8A25023CBFB	884D03FED760723D780AD868D3344B83528415E6F4AF3ABC5DD18A3FDA6D4FF9
Chrome Cache Entry: 121	ASCII text, with very long lines (6035)	38D65ECEB65FBD4D6BC91C77F98E9AEF	408563267218AE0C1CE723457900DD29653EC617	B10511B08A5E7AE758D201857676F5337855BBB28D78AB5E69766B5449086C38
Chrome Cache Entry: 122	PNG image data, 378 x 124, 8-bit/color RGBA, non-interlaced	D0BCB68DAE759814BD8C2D357A55F49F	5A3B81435E6E7A496AABCA0787D75DE766C32A8B	E8E3A5481A761BB824095B9871E0DFCF3B407605D602C492E34D3DC48F94C868
Chrome Cache Entry: 123	JSON data	F1AAD3854C9944CE1FE05CF112A5FF1E	4A91A78E279AEBBFAE8E20C4AE0EEB05FB1BCB42	4C14D6054E122286D8F34AA993AB43591046600472CB5E48A13166FFF3D37418
Chrome Cache Entry: 124	ASCII text, with very long lines (5945)	F6FE2E4C99D6E83AB812B01A2E3BD881	C431E066C2D36B4859907319667976ACFEABCB22	2E52B7033B20712B4C93960FC89CB4F3AFBFF1DA5BCE3551F2BCFE55A42454D8
Chrome Cache Entry: 125	ASCII text, with very long lines (3835)	1A8838BE30C67B31A05F34F4739A82E1	2954CF222F60A6F20850670940BE6653993EB54C	8E1A1276D758098BDBA85D3F51E3EC9A6919AF34DCA20D4AFEBF83151AC7006F
Chrome Cache Entry: 127	JSON data	D5940EB80CD8D4030399948D3CFE067E	6E78F5437D8CEBA9D4EAFE04E76F923FF7B3DE0B	7919C4C910738782D23763EABCAE0E2326DFBF7C3C3CC11E28B4EB59B9E11A3B
Chrome Cache Entry: 129	Web Open Font Format, TrueType, length 246368, version 1.4	12365DEE78645AC21EAEC216A048746C	FCA809D23C8BA60E80F3ED1F7CE6A243897B494A	F08E51B27293D93D7770FA7AA4DF43908782AE51334C64649D2C8B72C35E8FC2
Chrome Cache Entry: 130	ASCII text, with very long lines (3835)	8EBFCB0E0A6C643E12D50B106716160E	1D9F6B22B455D93730467B54A9411A55BBB2E50D	2040D7066BBB8F3251DAEDE7B4437ACF0B7749BA309C9182439424349C1CBE1E
Chrome Cache Entry: 131	ASCII text, with very long lines (65536), with no line terminators	3AF14409140A188D90E8ABFE3FA2A40A	5C4A242BE0777A189A49F57554C97257B8941E84	295F29439726C35DF996F7FDFB173F1F979E39005B46D8A6CB091B98BAFA231C
Chrome Cache Entry: 133	Unicode text, UTF-8 text, with very long lines (64960)	6E7A6D936DE4FE50CF1C96953682CD89	928D4727003B9876437D793A1F6855AF34ED5B1B	6DE51819A411C1B183FBC5A867B1BEDD32E9B1814D8ECD0E7AAFD414474F014B
Chrome Cache Entry: 135	ASCII text, with very long lines (22434)	2337BCCDF58711AB17A7E34895C589D0	CCFF456F60E22E7F65025B9A99361B1655DDA2DE	E2F65E9238ED3CB27353458941893D713506291162E91AA796449BFD403996A9
Chrome Cache Entry: 139	ASCII text, with very long lines (22434)	96F27C75DB189544768AD37B89E4C753	6B645767B3D8FE3AAE43EFACDED45437A20919A7	5521DEEFFDD4B02649060CCABD0DC04A824235827B26950E498BA74C3563AF78
Chrome Cache Entry: 140	ASCII text, with very long lines (65536), with no line terminators	9E19B6354DFF8D3DA3D88D0D265E7F5C	D145EDC8AA7F058FE852B95576ACB0C8E3E318B4	C7414C792B8C81E73B4281D4001E3123BE930980614857D15ECEBE7DA7F42D98
Chrome Cache Entry: 141	HTML document, ASCII text, with very long lines (10654)	BA3ACD408BFC5D4BFF81C68A45F79D3A	22AB2C4282819027BF958704DEF1F2E0C3259BF8	F2B71B36D11EACBEC07BE6A52507AA25906C2F3EB18F99F8BB69C056213C8B6C
Chrome Cache Entry: 143	ASCII text, with no line terminators	9F9FA94F28FE0DE82BC8FD039A7BDB24	6FE91F82974BD5B101782941064BCB2AFDEB17D8	9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E
Chrome Cache Entry: 145	gzip compressed data, from Unix, original size modulo 2^32 57443	210F3C4E623D333CB94746CEC563DE09	887911B0BCA564AFEC25787B44A98F16EBF7ACA3	4792643ECEBF0EEAA641474C9A1BA39D16D2F924C6B5A6FCB8FC443A5FE59F44
Chrome Cache Entry: 146	ASCII text, with very long lines (1335)	0CC3A63FE10060AF4A349E5DF666EEFE	3E8D3925B550345123F2CAB26568221FD4154F9C	92FCA55833F48B4289AC8F1CEDD48752B580FCE4EC4B5D81670B8193D6E51B54
Chrome Cache Entry: 147	Unicode text, UTF-8 text, with very long lines (48945), with LF, NEL line terminators	358D1530FDF2E2787AD45E3A84F90C83	E6CC352CE14EE42835D5B4F796DB97C8FD57A25C	923CEED409970B037BD94B3FBDD9B62AFD5905F1D4BFAE8DCF3A293195C8D0EE
Chrome Cache Entry: 148	gzip compressed data, from Unix, original size modulo 2^32 141849	E5A4E72F435BBF3577A52EE642BA855A	6C040F9C0B665D536D409BAC1BDBD58BA3DAE8B7	E023EF317B00B17E6D0F31F09C0B976BE2CD5D47A6BA2A736DF6A600CEB9C8F1
Chrome Cache Entry: 149	MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel	7E0D59593F3377B72C29435C4B43954A	B4C5C39A6DFB460BBD2EACCEB09EC8079FB6A8E2	62D706019A0D80173113EF70FBBEE12F286E8E221534BE788448AADA4B14C8E8
Chrome Cache Entry: 151	ASCII text, with no line terminators	37A6259CC0C1DAE299A7866489DFF0BD	2BE88CA4242C76E8253AC62474851065032D6833	74234E98AFE7498FB5DAF1F36AC2D78ACC339464F950703B8C019892F982B90B
Chrome Cache Entry: 154	gzip compressed data, from Unix, original size modulo 2^32 407134	0003DCDEA4E7F56839E8B60A264144DE	E2F8AD8183DAE712AB9ECCFAB310FCEDA7CF635E	076F00C7D24423ADD2296FF3234E28435A08AB9392F263BFFA90278EA98023FA
Chrome Cache Entry: 155	ASCII text, with very long lines (715)	1D3C12EF7348978206413B2C985D0E37	4C8BF7428BA9FF2C3F9E54C05065604D5C4D6A4C	5AB8F962752071D61B4C1613F2126EAD5A5969B0157509532CB1CC43D1C0486D
Chrome Cache Entry: 156	JSON data	E5C9801DB0E3D7B602EEEE01ADE33F95	C5712D4387E1DA0358AE6B634DBE0104DA6520E7	A60F04C57702456E8D03327CE6860A25E1A4BE7E2906D1495965C5588AB0B108
Chrome Cache Entry: 157	ASCII text	34C520D87664032692C4315FFF455D18	978C8B03E97680EB62057A7000F6E7FD97FB9658	C40AA69F0B306CEA296DD1193C334BC0781587ED51AAB579C0433698BA9E0C4B
Chrome Cache Entry: 158	ASCII text, with very long lines (20581)	084AA824C6E6F64CF28551D070ABE00C	DABFADE6656A1018D065B5F3673F4154AAF7A8BA	7953631F0E54794D2352A3CFA591C0914D73E14F90141058E3CF16BEE7939BCF
Chrome Cache Entry: 159	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	FF6A823EABD85E67C626D007C2830BD5	FE6A997A92D1C85055F29BF95D746061BD9BAC5D	9FAC2F294DE40D7C9D11E392E5DF670BF14D3C536E5B41001FE672BF3F00A828
Chrome Cache Entry: 160	ASCII text, with very long lines (1434), with no line terminators	CC0A3CCF131962702BF792417A598C1D	CFC0E8F62F3C6E62A37AE1B6CCE6B9CEE56CE375	667C83B6A02C499E26B4B94D89295391F7EB3CAC903554B02EC343D9A89F2BA4
Chrome Cache Entry: 161	gzip compressed data, from Unix, original size modulo 2^32 3625	09487133A973EFB632F22B409AE914AB	4D2F1E131AC24138E13E47B4F809B7BD39A9922B	B1D5B024DBA9514EF9C9BBC42D2D2564C459106C1646F9D747C1595659B8F22C
Chrome Cache Entry: 163	gzip compressed data, from Unix, original size modulo 2^32 113378	D5B89CEEC2B024C565802C0E51607044	74696825D59F384D3D874638537BB4920FDB60CB	05DC99C6E0751D3A98E970F628C8426A967CF068A4BD681BDBAF6F627D54C7E2
Chrome Cache Entry: 166	HTML document, Unicode text, UTF-8 text, with very long lines (4324)	D261A5494F1616C5151B523CF48281A7	02975DF4B93DD489AB8E44A0DDCBF7AC00B0F5B2	A24FB7C791FA9A0DD8C8BCB8942307AC28E0022AC0C2375DFE3FCC71F60F3DDA
Chrome Cache Entry: 168	ASCII text, with very long lines (999)	893102E1869ADC5BCE0A94FEB6F74249	AA12E4ED5006F270AB072E00D749A2D0CC392198	E233A0FFB3016B204EDB0BBB841952FEB31A194AD53CD473C76003391F24BFD3
Chrome Cache Entry: 170	gzip compressed data, original size modulo 2^32 1864	2D2CBA7D7DC75F3BA9DC756738D41A6E	F87FD26066ED5E52A65DEE0ED2D581D3C3EA15AC	00E21864CF1BC70302EBB5B496C6C471A7DA8CBF600630B478A3E2376ED20EA2
Chrome Cache Entry: 172	Web Open Font Format, TrueType, length 245192, version 1.4	6D82FD0D97BD44E9484816A35C937EF9	22FCDBC5DDEC03622F99267218D96E74F83C07BC	15FE86A41798EBB7F44A0762303B596188AFD537FAD2E9D707125DF61A76EB59
Chrome Cache Entry: 174	gzip compressed data, original size modulo 2^32 1592	ECC8894D3791BEDDB4E0226F8DAB065A	6510EB51E76A49746C526E432455549B50DE5AF1	64C8C0A9EFBC27AD86EAEC90465B75C52AE8CD68F7E76FC9431DC6AE66072AC3
Chrome Cache Entry: 177	gzip compressed data, original size modulo 2^32 3651	DF6A7721C242813411CC6950DF40F9B3	B2068C4A65C183AAD6FC22A44CC1FA449CD355B4	AA53B6DC744357B392FC57C34E516BAE465D4A6837775C137A176D599C8EA948
Chrome Cache Entry: 180	ASCII text, with very long lines (9222)	4DE08422C32F184C4C53312679EAF155	BDC503CD996C21D1F4FEF8AA88A576C25005ACE0	D8F59368057A15E101CF020875EBB8CF4788D741E60EB2609CA0007D1244A16E
Chrome Cache Entry: 181	gzip compressed data, from Unix, original size modulo 2^32 449726	5C2278184C6648491C6941ABD970A727	7B582E9A39E95BAD83A2C933AFFABE1B7E45F2A0	827414946788C207F616A6DA58610F5DA86615F0F453959AAC47043917A48F9A
Chrome Cache Entry: 182	Web Open Font Format, TrueType, length 94040, version 2.137	80DF5DA08B99C807A5C6F7AE308E1F89	9F6FD6C54E5D6D36BF805CB756F48F96086F3BAD	9CB8BD1F1BC33E81434304DA0CB480009C00B4383453DC8B9AADA8FBA623226D
Chrome Cache Entry: 183	ASCII text, with very long lines (2343)	575B5480531DA4D14E7453E2016FE0BC	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
Chrome Cache Entry: 184	Unicode text, UTF-8 text, with very long lines (65449)	35B4382EEA07827E4A52459450699FC7	61FD3ACFF8CFEB5AFF1CFFB108966081500ACD0A	743ED943478949B8F61E1D5372CF423A0154D936FE01AD435DB11458022182FC
Chrome Cache Entry: 185	Unicode text, UTF-8 text, with very long lines (51633)	279A7FF233CD854B3536DB491C67A224	03ABE4CF3986ED4D4B87E9C7947B464F86F7BC65	C4CED4679C85898AA82AFAD47E3F692A172F1CB498AFC562358473CEF3B20235
Chrome Cache Entry: 187	JSON data	3718D561EF40CE1E90AEE9ED613ED87D	DC5ACBA6FBDC3C7AD8DAB1A63E2580A163322444	D96C8578ABE8377B2A7DFB6FD6C5CB04CAC2943B67FDFE1FE16129B670109640
Chrome Cache Entry: 189	ASCII text, with very long lines (433), with no line terminators	607497A71B3F58C69F285D965DFBC6AA	76C5A0E7C41B2E0E84C1C83D7D17E064ABBD8385	69D8D1F0F122FE1954B10C80F12D43FB5C56F2524460D04CEAE12E4719B4692E
Chrome Cache Entry: 190	PNG image data, 358 x 346, 8-bit/color RGBA, non-interlaced	9CD73603B3E6183B40B9E496D97961FF	FD2986570C93B20F0DC9604AB226E35C6A03B0FD	AB8A42166216E61ECDB35A9B3A9C1E113AFBC450C7C7674C1311A6107F791FBD
Chrome Cache Entry: 192	ASCII text, with very long lines (3835)	57C7D3FD0A09E642204A34C57BAE48E6	E23834B9BEDCCAAF728F82A5DB1D3C5FACA8C084	60026CB3585D9D094516FFA336B12929ED4C2A8C508E4E881A9FB236A21237B8
Chrome Cache Entry: 194	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	9F91F79F48D929848F219A5898A72D91	CCE8D8689B5BFC502EAD7F746C9352FB9A37BA63	D332A6D776816EC90D902D9F7A0CFDD817A7BF740B326F4593B70BD7300793BC
Chrome Cache Entry: 197	gzip compressed data, from Unix, original size modulo 2^32 113819	D1E9D883326A5B5954B01F178F3E3276	D44C9DE06CEB4E71B084A4D0BA2494A98928A697	14993D514CE763D958C9625408041B2ADE09914136A6D31CA0BDFAA425014917
Chrome Cache Entry: 198	ASCII text, with very long lines (5945)	A03A926E116518D9D79281855E6FEEA4	569E6C4443DB3970A96F19F4A57C933DE391E15F	D2A915C751AB0AAF2448B69E201DCF0C153FD0FC39F585B6EF49DC0A657968F6
Chrome Cache Entry: 201	ASCII text, with very long lines (3835)	E23B9D785F511D436F667EF3C279C8D9	17E4288BF4564261B389781BB7D6379AE687607B	7C34814FC440759FAEA072DD542878C6EB39C80F49C2A1F65C1D69242896A54F

Phishing

AI detected phishing page

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	LLM: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'bradfordmarine.bytheyardservices.com' does not match the legitimate domain for Microsoft., The domain 'bytheyardservices.com' does not appear to be related to Microsoft, which is suspicious., The presence of input fields for 'Email, phone, or Skype' is typical for Microsoft services, but the domain mismatch raises concerns., The URL structure suggests a potential phishing attempt as it does not align with Microsoft's known domain. DOM: 3.7.pages.csv
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	LLM: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'bradfordmarine.bytheyardservices.com' does not match the legitimate domain for Microsoft., The domain 'bytheyardservices.com' does not appear to be related to Microsoft, which raises suspicion., The presence of input fields for 'Email, phone, or Skype' is typical for Microsoft services, but the domain mismatch is a strong indicator of phishing., The URL structure suggests a potential phishing attempt by using a subdomain to mimic a legitimate service. DOM: 3.8.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 0.24.id.script.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: 0.31.id.script.csv, type: HTML
Source: Yara match	File source: 3.8.pages.csv, type: HTML
Source: Yara match	File source: 3.6.pages.csv, type: HTML

Phishing site detected (based on favicon image match)

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true

Matcher: Template: microsoft matched with high similarity

Phishing site detected (based on image similarity)

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 1.0

OCR Text: Sign up to FuseBase for free + Save to FuseBase ag Share print Full screen RAIRDON John A. Dederman Sent yau a new encrypted message CLICK HERE TO VIEW MESSAGE Thanks

HTML body contains low number of good links

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true

HTTP Parser: Number of links: 0

HTML page contains hidden javascript code

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB

HTTP Parser: Base64 decoded: a[href="http://www.salidzini.lv/"][style="display: block; width: 88px; height: 31px; overflow: hidden; position: relative;"]

HTML title does not match URL

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true

HTTP Parser: Title: Sign in to your account does not match URL

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: Iframe src: https://5d9cbcef-e6d26ed4.bytheyardservices.com/Prefetch/Prefetch.aspx
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: Iframe src: https://5d9cbcef-e6d26ed4.bytheyardservices.com/Prefetch/Prefetch.aspx
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: Iframe src: https://5d9cbcef-e6d26ed4.bytheyardservices.com/Prefetch/Prefetch.aspx

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true

HTTP Parser: <input type="password" .../> found

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB	HTTP Parser: No favicon
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No favicon
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No favicon
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No favicon
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No favicon
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No favicon

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://bradfordmarine.bytheyardservices.com/?dsM3D=P1HSB&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49830 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic	DNS traffic detected: DNS query: nimb.ws
Source: global traffic	DNS traffic detected: DNS query: premiumgain.nimbusweb.me
Source: global traffic	DNS traffic detected: DNS query: d3hogio4d1txum.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: nimbusweb.me
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: metric.nimbusweb.me
Source: global traffic	DNS traffic detected: DNS query: stt.nimbusweb.me
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: l.getsitecontrol.com
Source: global traffic	DNS traffic detected: DNS query: s2.getsitecontrol.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: bradfordmarine.bytheyardservices.com
Source: global traffic	DNS traffic detected: DNS query: events.getsitectrl.com
Source: global traffic	DNS traffic detected: DNS query: 635b2a2c-e6d26ed4.bytheyardservices.com
Source: global traffic	DNS traffic detected: DNS query: 9b7d0080-e6d26ed4.bytheyardservices.com
Source: global traffic	DNS traffic detected: DNS query: f6ccf083-e6d26ed4.bytheyardservices.com
Source: global traffic	DNS traffic detected: DNS query: l1ve.bytheyardservices.com
Source: global traffic	DNS traffic detected: DNS query: 5d9cbcef-e6d26ed4.bytheyardservices.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49830 version: TLS 1.2

Source: classification engine

Classification label: mal72.phis.win@19/57@60/355

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1964,i,17677752623552012898,389080841008536744,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://nimb.ws/uRSOy9q"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1964,i,17677752623552012898,389080841008536744,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: https://premiumgain.nimbusweb.me/share/11334622/yn85rfp6wmt2hykemiso

LLM: Page contains button: 'CLICK HERE TO VIEW MESSAGE' Source: '1.0.pages.csv'

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

ID:	1541501
Product:	CloudBasic
Start time:	22:23:35
Start date:	24.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://nimb.ws/uRSOy9q

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://nimb.ws/uRSOy9q

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://nimb.ws/uRSOy9q