Edit tour
Windows
Analysis Report
https://hianime.to
Overview
Detection
Score: | 48 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
AI detected suspicious URL
Performs DNS queries to domains with low reputation
Connects to several IPs in different countries
Detected hidden input values containing email addresses (often used in phishing pages)
Detected non-DNS traffic on DNS port
Detected suspicious crossdomain redirect
HTML page contains hidden javascript code
Suricata IDS alerts with low severity for network traffic
Classification
- System is w10x64
- chrome.exe (PID: 5676 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed "about :blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 3484 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =1920 --fi eld-trial- handle=198 4,i,167217 8309382949 6953,14232 0568141865 47916,2621 44 --disab le-feature s=Optimiza tionGuideM odelDownlo ading,Opti mizationHi nts,Optimi zationHint sFetching, Optimizati onTargetPr ediction / prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- chrome.exe (PID: 6328 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" "htt ps://hiani me.to" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-10-29T00:06:50.479722+0100 | 2022090 | 1 | Exploit Kit Activity Detected | 192.168.2.4 | 57528 | 188.114.96.3 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
Source: | HTTP Parser: |