Edit tour

Windows Analysis Report
https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:595729f4-6ee1-464c-a534-c9dd79612c8d

Overview

General Information

Sample URL:	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:595729f4-6ee1-464c-a534-c9dd79612c8d
Analysis ID:	1547038
Infos:

Detection

HTMLPhisher

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish44

Yara detected HtmlPhish45

Phishing site detected (based on favicon image match)

Drops files with a non-matching file extension (content does not match file extension)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6360 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2980 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1996,i,12908367275366264149,14497096882164769627,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4592 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:595729f4-6ee1-464c-a534-c9dd79612c8d" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_563	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security
dropped/chromecache_849	JoeSecurity_HtmlPhish_45	Yara detected HtmlPhish_45	Joe Security

HTML

Source	Rule	Description	Author
0.151.id.script.csv	JoeSecurity_HtmlPhish_45	Yara detected HtmlPhish_45	Joe Security
2.3.pages.csv	JoeSecurity_HtmlPhish_45	Yara detected HtmlPhish_45	Joe Security
2.195..script.csv	JoeSecurity_HtmlPhish_45	Yara detected HtmlPhish_45	Joe Security
0.203.i.script.csv	JoeSecurity_HtmlPhish_45	Yara detected HtmlPhish_45	Joe Security
3.10.pages.csv	JoeSecurity_HtmlPhish_45	Yara detected HtmlPhish_45	Joe Security
3.14.pages.csv	JoeSecurity_HtmlPhish_45	Yara detected HtmlPhish_45	Joe Security
3.19.pages.csv	JoeSecurity_HtmlPhish_45	Yara detected HtmlPhish_45	Joe Security
Click to see the 2 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkbuZGsE2OMP4ldF7sFx6bw6lYUfP3t0VCzWsNmTL7fMCMrJxUaXKF9/9Qx9gHeMhlDYYyYkHHPz95iJDdvKD8b3z9uoTPXoeMClNuuXvvaCXE5mYsEIJ6dxIb	LLM: Score: 9 Reasons: The brand 'Dropbox' is well-known and typically associated with the domain 'dropbox.com'., The URL 'gomomodapafozxas.erfvqedajm.workers.dev' does not match the legitimate domain for Dropbox., The URL uses a subdomain structure that is not typical for Dropbox, which usually uses 'dropbox.com'., The domain 'workers.dev' is a generic domain often used for cloud services, which can be legitimate but is suspicious when combined with unrelated subdomains., The presence of a CAPTCHA-like input field ('Please verify that you are not a robot') is common in phishing attempts to appear legitimate. DOM: 3.10.pages.csv
Source: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkbuZGsE2OMP4ldF7sFx6bw6lYUfP3t0VCzWsNmTL7fMCMrJxUaXKF9/9Qx9gHeMhlDYYyYkHHPz95iJDdvKD8b3z9uoTPXoeMClNuuXvvaCXE5mYsEIJ6dxIb	LLM: Score: 9 Reasons: The brand 'Dropbox' is well-known and typically associated with the domain 'dropbox.com'., The URL 'gomomodapafozxas.erfvqedajm.workers.dev' does not match the legitimate domain for Dropbox., The URL contains a random string and uses a 'workers.dev' domain, which is not associated with Dropbox., The presence of a CAPTCHA-like input field ('Please verify that you are not a robot') is common in phishing attempts to appear legitimate., The use of a cloud service domain ('workers.dev') can be a tactic to obscure the true nature of the site. DOM: 3.13.pages.csv
Source: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkbuZGsE2OMP4ldF7sFx6bw6lYUfP3t0VCzWsNmTL7fMCMrJxUaXKF9/9Qx9gHeMhlDYYyYkHHPz95iJDdvKD8b3z9uoTPXoeMClNuuXvvaCXE5mYsEIJ6dxIb	LLM: Score: 9 Reasons: The brand 'Dropbox' is well-known and typically associated with the domain 'dropbox.com'., The URL 'gomomodapafozxas.erfvqedajm.workers.dev' does not match the legitimate domain for Dropbox., The URL uses a subdomain structure that is not associated with Dropbox's official services., The domain 'workers.dev' is a generic domain often used for cloud services, which can be legitimate but is suspicious in this context due to the unrelated subdomain., The presence of random characters in the subdomain 'gomomodapafozxas.erfvqedajm' is a common tactic used in phishing to confuse users. DOM: 3.18.pages.csv

Yara detected HtmlPhish44

Source: Yara match

File source: dropped/chromecache_563, type: DROPPED

Yara detected HtmlPhish45

Source: Yara match	File source: 0.151.id.script.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: 2.195..script.csv, type: HTML
Source: Yara match	File source: 0.203.i.script.csv, type: HTML
Source: Yara match	File source: 3.10.pages.csv, type: HTML
Source: Yara match	File source: 3.14.pages.csv, type: HTML
Source: Yara match	File source: 3.19.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_849, type: DROPPED

Phishing site detected (based on favicon image match)

Source: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkbuZGsE2OMP4ldF7sFx6bw6lYUfP3t0VCzWsNmTL7fMCMrJxUaXKF9/9Qx9gHeMhlDYYyYkHHPz95iJDdvKD8b3z9uoTPXoeMClNuuXvvaCXE5mYsEIJ6dxIb	Matcher: Template: dropbox matched with high similarity
Source: https://gomomodapafozxas.erfvqedajm.workers.dev/ZBJMbNR30exbrq5HNVOBVsK3wzDquAUyeOjeK3ETdJnvc-bbpappre-oIV1AeoxxBJEOsAiOLLQRB8Ha2dtBYm593nEJ1EiuwHOzvRWuiyesRzeFltY0IvFEfs1L62kK3GKAwpgjqRLzOy6dt8YeZ2oga24kLX9l-4VJDJ9TAT2eSlr0VsBheF5dzTQYgq7RQZYlTTXZCt9ObFnT8qJ1Jg113IqjaT4uzH1jgppTBdOIOufjIgIzq85LRXX8j33/GUa7FnUNC8M769q7B7xm99EfHmTuCPDPWgQXTvvR2gq6bx0rsQZZQwm4tPxLlgCrDvlmHXPybD3UaSLQwkEynL	Matcher: Template: dropbox matched with high similarity

Source: https://gomomodapafozxas.erfvqedajm.workers.dev/ZBJMbNR30exbrq5HNVOBVsK3wzDquAUyeOjeK3ETdJnvc-bbpappre-oIV1AeoxxBJEOsAiOLLQRB8Ha2dtBYm593nEJ1EiuwHOzvRWuiyesRzeFltY0IvFEfs1L62kK3GKAwpgjqRLzOy6dt8YeZ2oga24kLX9l-4VJDJ9TAT2eSlr0VsBheF5dzTQYgq7RQZYlTTXZCt9ObFnT8qJ1Jg113IqjaT4uzH1jgppTBdOIOufjIgIzq85LRXX8j33/GUa7FnUNC8M769q7B7xm99EfHmTuCPDPWgQXTvvR2gq6bx0rsQZZQwm4tPxLlgCrDvlmHXPybD3UaSLQwkEynL

HTTP Parser: Number of links: 0

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://gomomodapafozxas.erfvqedajm.workers.dev/?bbre=ozO8O/equipment-inc

HTTP Parser: Base64 decoded: <script>var _0x7f29=["yxbWBhK=","DgvZDa==","EKeTwL8KxsOP","y+kzOgH0DhbZ4PMGD2LZChNIMAbLyti04PMGyxbWzw5K","4PMGC2nYAxb0mZrZC2tIMAb2yxlIMAbKB2n1BwvUDa==","BgvUz3rO","Aw5MBW==","BwxIMAbOzwfK4PMGzw1MCM9Tz2v0BMjYDg9V","z2DLCG==","mIbUpsiIoZiGmsa9idmUnsGInIiPoZ...

Source: https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:595729f4-6ee1-464c-a534-c9dd79612c8d	HTTP Parser: No favicon
Source: https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:595729f4-6ee1-464c-a534-c9dd79612c8d	HTTP Parser: No favicon
Source: https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:595729f4-6ee1-464c-a534-c9dd79612c8d	HTTP Parser: No favicon
Source: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkbuZGsE2OMP4ldF7sFx6bw6lYUfP3t0VCzWsNmTL7fMCMrJxUaXKF9/9Qx9gHeMhlDYYyYkHHPz95iJDdvKD8b3z9uoTPXoeMClNuuXvvaCXE5mYsEIJ6dxIb	HTTP Parser: No favicon
Source: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkbuZGsE2OMP4ldF7sFx6bw6lYUfP3t0VCzWsNmTL7fMCMrJxUaXKF9/9Qx9gHeMhlDYYyYkHHPz95iJDdvKD8b3z9uoTPXoeMClNuuXvvaCXE5mYsEIJ6dxIb	HTTP Parser: No favicon
Source: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkbuZGsE2OMP4ldF7sFx6bw6lYUfP3t0VCzWsNmTL7fMCMrJxUaXKF9/9Qx9gHeMhlDYYyYkHHPz95iJDdvKD8b3z9uoTPXoeMClNuuXvvaCXE5mYsEIJ6dxIb	HTTP Parser: No favicon
Source: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkbuZGsE2OMP4ldF7sFx6bw6lYUfP3t0VCzWsNmTL7fMCMrJxUaXKF9/9Qx9gHeMhlDYYyYkHHPz95iJDdvKD8b3z9uoTPXoeMClNuuXvvaCXE5mYsEIJ6dxIb	HTTP Parser: No favicon
Source: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkbuZGsE2OMP4ldF7sFx6bw6lYUfP3t0VCzWsNmTL7fMCMrJxUaXKF9/9Qx9gHeMhlDYYyYkHHPz95iJDdvKD8b3z9uoTPXoeMClNuuXvvaCXE5mYsEIJ6dxIb	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:50134 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	DNS traffic detected: DNS query: adobe.tt.omtrdc.net
Source: global traffic	DNS traffic detected: DNS query: widget.uservoice.com
Source: global traffic	DNS traffic detected: DNS query: use.typekit.net
Source: global traffic	DNS traffic detected: DNS query: static.adobelogin.com
Source: global traffic	DNS traffic detected: DNS query: prod.adobeccstatic.com
Source: global traffic	DNS traffic detected: DNS query: p.typekit.net
Source: global traffic	DNS traffic detected: DNS query: l.betrad.com
Source: global traffic	DNS traffic detected: DNS query: ims-na1.adobelogin.com
Source: global traffic	DNS traffic detected: DNS query: files-download2.acrocomcontent.com
Source: global traffic	DNS traffic detected: DNS query: dc-api-v2.adobecontent.io
Source: global traffic	DNS traffic detected: DNS query: dc-api.adobecontent.io
Source: global traffic	DNS traffic detected: DNS query: c.evidon.com
Source: global traffic	DNS traffic detected: DNS query: by2.uservoice.com
Source: global traffic	DNS traffic detected: DNS query: assets.adobedtm.com
Source: global traffic	DNS traffic detected: DNS query: api.echosign.com
Source: global traffic	DNS traffic detected: DNS query: cdn-sharing.adobecc.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: o4505393339695104.ingest.us.sentry.io
Source: global traffic	DNS traffic detected: DNS query: detect.adobedccdn.com
Source: global traffic	DNS traffic detected: DNS query: _19292._https.detect.adobedccdn.com
Source: global traffic	DNS traffic detected: DNS query: _39691._https.detect.adobedccdn.com
Source: global traffic	DNS traffic detected: DNS query: _49100._https.detect.adobedccdn.com
Source: global traffic	DNS traffic detected: DNS query: api.spently.com
Source: global traffic	DNS traffic detected: DNS query: danisoappdalialers.amlajzjnigyha.workers.dev
Source: global traffic	DNS traffic detected: DNS query: gomomodapafozxas.erfvqedajm.workers.dev
Source: global traffic	DNS traffic detected: DNS query: wispy-dawn-ea24.porschea50.workers.dev
Source: global traffic	DNS traffic detected: DNS query: dailycndsapptopushpull.web.app
Source: global traffic	DNS traffic detected: DNS query: unpkg.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: use1-turn.fpjs.io
Source: global traffic	DNS traffic detected: DNS query: use1.fptls.com

Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50215
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50283 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 50202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50226
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50186
Source: unknown	Network traffic detected: HTTP traffic on port 50186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50193
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50238
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50237
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50197
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50198
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 50198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 50280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50245
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50247
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 50206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50257
Source: unknown	Network traffic detected: HTTP traffic on port 50238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 50278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 50209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50265
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 50226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50272
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50273
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50279
Source: unknown	Network traffic detected: HTTP traffic on port 50265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50280
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50283
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50207
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50209
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50208
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50288
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50202
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50290
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50171
Source: unknown	Network traffic detected: HTTP traffic on port 50160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50291
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50273 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1996,i,12908367275366264149,14497096882164769627,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:595729f4-6ee1-464c-a534-c9dd79612c8d"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1996,i,12908367275366264149,14497096882164769627,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Name	IP	Active	Malicious	Reputation
dd20fzx9mj46f.cloudfront.net	52.222.214.61	true	false	unknown
privacycollector-production-457481513.us-east-1.elb.amazonaws.com	34.237.81.82	true	false	unknown
use1-turn.fpjs.io	3.66.243.164	true	false	unknown
widget.uservoice.com	104.18.20.58	true	false	unknown
api.echosign.com	3.236.206.93	true	false	unknown
detect.adobedccdn.com	127.0.0.1	true	false	unknown
wispy-dawn-ea24.porschea50.workers.dev	188.114.96.3	true	false	unknown
ethos503-prod-irl1-k8s-p2-0-44a754a51c58d666.elb.eu-west-1.amazonaws.com	54.154.242.122	true	false	unknown
api.spently.com	172.67.202.50	true	false	unknown
danisoappdalialers.amlajzjnigyha.workers.dev	172.67.214.84	true	false	unknown
cdn-sharing.adobecc.map.fastly.net	151.101.1.138	true	false	unknown
gomomodapafozxas.erfvqedajm.workers.dev	104.21.70.55	true	true	unknown
adobetarget.data.adobedc.net	66.235.152.156	true	false	unknown
o4505393339695104.ingest.us.sentry.io	34.120.195.249	true	false	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	unknown
adobe.com.ssl.d1.sc.omtrdc.net	63.140.62.17	true	false	unknown
dailycndsapptopushpull.web.app	199.36.158.100	true	false	unknown
use1.fptls.com	75.2.10.96	true	false	unknown
www.google.com	142.250.185.100	true	false	unknown
by2.uservoice.com	104.18.21.58	true	false	unknown
prod.adobeccstatic.com	18.239.18.46	true	false	unknown
unpkg.com	104.17.247.203	true	false	unknown
ethos551-prod-va6-k8s-p2-0-ae4ec75f18def055.elb.us-east-1.amazonaws.com	35.170.167.46	true	false	unknown
c.evidon.com	unknown	unknown	false	unknown
ims-na1.adobelogin.com	unknown	unknown	false	unknown
dc-api-v2.adobecontent.io	unknown	unknown	false	unknown
adobe.tt.omtrdc.net	unknown	unknown	false	unknown
cdn-sharing.adobecc.com	unknown	unknown	false	unknown
static.adobelogin.com	unknown	unknown	false	unknown
_49100._https.detect.adobedccdn.com	unknown	unknown	false	unknown
use.typekit.net	unknown	unknown	false	unknown
assets.adobedtm.com	unknown	unknown	false	unknown
_39691._https.detect.adobedccdn.com	unknown	unknown	false	unknown
l.betrad.com	unknown	unknown	false	unknown
p.typekit.net	unknown	unknown	false	unknown
_19292._https.detect.adobedccdn.com	unknown	unknown	false	unknown
dc-api.adobecontent.io	unknown	unknown	false	unknown
files-download2.acrocomcontent.com	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://gomomodapafozxas.erfvqedajm.workers.dev/?bbre=ozO8O/equipment-inc	false		unknown
https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkbuZGsE2OMP4ldF7sFx6bw6lYUfP3t0VCzWsNmTL7fMCMrJxUaXKF9/9Qx9gHeMhlDYYyYkHHPz95iJDdvKD8b3z9uoTPXoeMClNuuXvvaCXE5mYsEIJ6dxIb	true		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
52.215.98.41	unknown	United States	16509	AMAZON-02US	false
151.101.1.138	cdn-sharing.adobecc.map.fastly.net	United States	54113	FASTLYUS	false
52.209.185.35	unknown	United States	16509	AMAZON-02US	false
184.28.88.176	unknown	United States	16625	AKAMAI-ASUS	false
172.67.214.84	danisoappdalialers.amlajzjnigyha.workers.dev	United States	13335	CLOUDFLARENETUS	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
2.19.126.206	unknown	European Union	16625	AKAMAI-ASUS	false
2.18.64.23	unknown	European Union	6057	AdministracionNacionaldeTelecomunicacionesUY	false
142.250.185.227	unknown	United States	15169	GOOGLEUS	false
172.64.155.61	unknown	United States	13335	CLOUDFLARENETUS	false
54.154.242.122	ethos503-prod-irl1-k8s-p2-0-44a754a51c58d666.elb.eu-west-1.amazonaws.com	United States	16509	AMAZON-02US	false
172.67.202.50	api.spently.com	United States	13335	CLOUDFLARENETUS	false
107.22.247.231	unknown	United States	14618	AMAZON-AESUS	false
34.194.112.142	unknown	United States	14618	AMAZON-AESUS	false
99.83.173.21	unknown	United States	16509	AMAZON-02US	false
23.22.254.206	unknown	United States	14618	AMAZON-AESUS	false
142.250.186.35	unknown	United States	15169	GOOGLEUS	false
44.198.86.118	unknown	United States	14618	AMAZON-AESUS	false
142.250.185.67	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
3.248.26.100	unknown	United States	16509	AMAZON-02US	false
75.2.10.96	use1.fptls.com	United States	16509	AMAZON-02US	false
63.140.62.17	adobe.com.ssl.d1.sc.omtrdc.net	United States	15224	OMNITUREUS	false
2.19.126.198	unknown	European Union	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
66.235.152.156	adobetarget.data.adobedc.net	United States	15224	OMNITUREUS	false
18.207.85.246	unknown	United States	14618	AMAZON-AESUS	false
3.233.142.19	unknown	United States	14618	AMAZON-AESUS	false
34.250.193.244	unknown	United States	16509	AMAZON-02US	false
104.17.25.14	unknown	United States	13335	CLOUDFLARENETUS	false
3.236.206.93	api.echosign.com	United States	14618	AMAZON-AESUS	false
104.18.20.58	widget.uservoice.com	United States	13335	CLOUDFLARENETUS	false
18.196.235.131	unknown	United States	16509	AMAZON-02US	false
18.235.168.50	unknown	United States	14618	AMAZON-AESUS	false
184.28.89.29	unknown	United States	16625	AKAMAI-ASUS	false
52.207.40.124	unknown	United States	14618	AMAZON-AESUS	false
104.18.32.195	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.181.234	unknown	United States	15169	GOOGLEUS	false
18.239.18.46	prod.adobeccstatic.com	United States	16509	AMAZON-02US	false
142.250.181.238	unknown	United States	15169	GOOGLEUS	false

IP
127.0.0.1
192.168.2.17
192.168.2.16

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1547038
Start date and time:	2024-11-01 20:09:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:595729f4-6ee1-464c-a534-c9dd79612c8d
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.phis.win@19/304@90/675

Input	Output
URL: Model: claude-3-5-sonnet-latest	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: URL: https://acrobat.adobe.com
URL: https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:595729f4-6ee1-464c-a534-c9dd79612c8d Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "VOUS AVEZ UN NOUVEAU PAIEMENT DE FACTURE D'ENTRE", "prominent_button_name": "VOIR VOTRE RECU", "text_input_field_labels": [ "Reu #", "Lecteur distance:", "Date:", "Longueur Pages:", "Transmettre Temps:" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:595729f4-6ee1-464c-a534-c9dd79612c8d Model: claude-3-haiku-20240307	```json { "brands": [ "Adobe" ] }
	```json { "brands": [ "Adobe" ] }
URL: Model: claude-3-5-sonnet-latest	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": true, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: URL: https://gomomodapafozxas.erfvqedajm.workers.dev
URL: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkb Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Select your email provider to login", "prominent_button_name": "unknown", "text_input_field_labels": [ "Please verify that you are not a robot." ], "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkb Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Select your email provider to login", "prominent_button_name": "unknown", "text_input_field_labels": [ "Please verify that you are not a robot." ], "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkb Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Select your email provider to login", "prominent_button_name": "unknown", "text_input_field_labels": [ "Please verify that you are not a robot." ], "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkb Model: claude-3-haiku-20240307	```json { "brands": [ "Dropbox" ] }
	```json { "brands": [ "Dropbox" ] }
URL: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkb Model: claude-3-haiku-20240307	```json { "brands": [ "Dropbox" ] }
	```json { "brands": [ "Dropbox" ] }
URL: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkb Model: claude-3-haiku-20240307	```json { "brands": [ "Dropbox" ] }
	```json { "brands": [ "Dropbox" ] }
URL: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkb Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Select all squares with traffic lights", "prominent_button_name": "SKIP", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkb Model: gpt-4o	```json{ "legit_domain": "dropbox.com", "classification": "wellknown", "reasons": [ "The brand 'Dropbox' is well-known and typically associated with the domain 'dropbox.com'.", "The URL 'gomomodapafozxas.erfvqedajm.workers.dev' does not match the legitimate domain for Dropbox.", "The URL uses a subdomain structure that is not typical for Dropbox, which usually uses 'dropbox.com'.", "The domain 'workers.dev' is a generic domain often used for cloud services, which can be legitimate but is suspicious when combined with unrelated subdomains.", "The presence of a CAPTCHA-like input field ('Please verify that you are not a robot') is common in phishing attempts to appear legitimate." ], "riskscore": 9} Google indexed: False
URL: gomomodapafozxas.erfvqedajm.workers.dev Brands: Dropbox Input Fields: Please verify that you are not a robot.
URL: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkb Model: claude-3-haiku-20240307	```json { "brands": [ "Dropbox" ] }
	```json { "brands": [ "Dropbox" ] }
URL: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkb Model: gpt-4o	```json{ "legit_domain": "dropbox.com", "classification": "wellknown", "reasons": [ "The brand 'Dropbox' is well-known and typically associated with the domain 'dropbox.com'.", "The URL 'gomomodapafozxas.erfvqedajm.workers.dev' does not match the legitimate domain for Dropbox.", "The URL contains a random string and uses a 'workers.dev' domain, which is not associated with Dropbox.", "The presence of a CAPTCHA-like input field ('Please verify that you are not a robot') is common in phishing attempts to appear legitimate.", "The use of a cloud service domain ('workers.dev') can be a tactic to obscure the true nature of the site." ], "riskscore": 9} Google indexed: False
URL: gomomodapafozxas.erfvqedajm.workers.dev Brands: Dropbox Input Fields: Please verify that you are not a robot.
URL: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkb Model: gpt-4o	```json{ "legit_domain": "dropbox.com", "classification": "wellknown", "reasons": [ "The brand 'Dropbox' is well-known and typically associated with the domain 'dropbox.com'.", "The URL 'gomomodapafozxas.erfvqedajm.workers.dev' does not match the legitimate domain for Dropbox.", "The URL uses a subdomain structure that is not associated with Dropbox's official services.", "The domain 'workers.dev' is a generic domain often used for cloud services, which can be legitimate but is suspicious in this context due to the unrelated subdomain.", "The presence of random characters in the subdomain 'gomomodapafozxas.erfvqedajm' is a common tactic used in phishing to confuse users." ], "riskscore": 9} Google indexed: False
URL: gomomodapafozxas.erfvqedajm.workers.dev Brands: Dropbox Input Fields: u, n, k, n, o, w, n
URL: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkb Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Select all squares with traffic lights", "prominent_button_name": "NEXT", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkb Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Select all squares with traffic lights If there are none, click skip", "prominent_button_name": "SKIP", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://gomomodapafozxas.erfvqedajm.workers.dev/ZBJMbNR30exbrq5HNVOBVsK3wzDquAUyeOjeK3ETdJnvc-bbpappre-oIV1AeoxxBJEOsAiOLLQRB8Ha2dtBYm593nEJ1EiuwHOzvRWuiyesRzeFltY0IvFEfs1L62kK3GKAwpgjqRLzOy6dt8YeZ2oga24kLX9l-4VJDJ9TAT2eSlr0VsBheF5dzTQYgq7RQZYlTTXZCt9ObFn Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Select your email provider to login", "prominent_button_name": "unknown", "text_input_field_labels": [ "Office 365", "Outlook", "Gmail", "Yahoo", "Aol", "Others" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkb Model: claude-3-haiku-20240307	```json { "brands": [ "Dropbox" ] }
	```json { "brands": [ "Dropbox" ] }
URL: https://gomomodapafozxas.erfvqedajm.workers.dev/6zWMzeYFTl8r5DIUNva6ap71tAQnknCehnGzE4a-&!@Dqc4m7YZtMdJxrTGSV&!@nrMG67gEFuz19o5Z3vAdxT&!-TulIWNtzKkrkbQX8CPLEsaaVtBJMeBwKGXwE5Xe3wNMwbR94R74PUkcihgYvZ6PGtaM1uY6ftqylmzFhKRTJcKdwJJeNGXV-YYwtHAM18FcneW8JkeRHkb Model: claude-3-haiku-20240307	```json { "brands": [ "Dropbox" ] }
	```json { "brands": [ "Dropbox" ] }
URL: https://gomomodapafozxas.erfvqedajm.workers.dev/ZBJMbNR30exbrq5HNVOBVsK3wzDquAUyeOjeK3ETdJnvc-bbpappre-oIV1AeoxxBJEOsAiOLLQRB8Ha2dtBYm593nEJ1EiuwHOzvRWuiyesRzeFltY0IvFEfs1L62kK3GKAwpgjqRLzOy6dt8YeZ2oga24kLX9l-4VJDJ9TAT2eSlr0VsBheF5dzTQYgq7RQZYlTTXZCt9ObFn Model: claude-3-haiku-20240307	```json { "brands": [ "Dropbox" ] }
	```json { "brands": [ "Dropbox" ] }
URL: Model: claude-3-5-sonnet-latest	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: URL: https://adobe.com

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 18:10:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9764962436701126
Encrypted:	false
SSDEEP:
MD5:	B8378050007181879565CFC6B4012BE2
SHA1:	C9EE7B05B81B4321E9A284F4553C22C9619EF7D1
SHA-256:	9A778B01D98ED5CF9FAB212C7FAAF21D23DC61D45AFAF52F1E4EA51A1B20ADAE
SHA-512:	823A16D69A99F54B75B29C168AEA4478E2DFC6269A19E7AE8F875E2C847ABC8B01754F3E7D2662B122AF85EF8BD31873F1CC3F0CE378771E22C633F2B5348143
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....b:J..,..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IaY:.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaYD.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VaYD.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VaYD............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VaYF............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............%.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:595729f4-6ee1-464c-a534-c9dd79612c8d

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 446

Chrome Cache Entry: 447

Chrome Cache Entry: 449

Chrome Cache Entry: 451

Chrome Cache Entry: 452

Chrome Cache Entry: 453

Chrome Cache Entry: 455

Chrome Cache Entry: 457

Chrome Cache Entry: 458

Chrome Cache Entry: 459

Chrome Cache Entry: 460

Chrome Cache Entry: 462

Chrome Cache Entry: 463

Chrome Cache Entry: 466

Chrome Cache Entry: 467

Chrome Cache Entry: 469

Chrome Cache Entry: 471

Chrome Cache Entry: 474

Chrome Cache Entry: 475

Chrome Cache Entry: 476

Chrome Cache Entry: 479

Chrome Cache Entry: 485

Chrome Cache Entry: 487

Chrome Cache Entry: 488

Chrome Cache Entry: 489

Chrome Cache Entry: 491

Chrome Cache Entry: 493

Chrome Cache Entry: 496

Windows Analysis Report
https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:595729f4-6ee1-464c-a534-c9dd79612c8d