Edit tour

Windows Analysis Report
https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f

Overview

General Information

Sample URL:	https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f
Analysis ID:	1559388
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Drops files with a non-matching file extension (content does not match file extension)

HTML page contains hidden javascript code

HTML page contains obfuscated script src

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2256 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 796 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2000,i,3380293206825283762,15677942766615917640,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6356 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

Acrobat.exe (PID: 6976 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3896 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1168 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1560,i,3530712955350696723,17840097560420890255,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f

HTTP Parser: Base64 decoded: (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=!0;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.pare...

Source: https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f	HTTP Parser: Script src: data:text/javascript;base64,KGZ1bmN0aW9uKHcsZCxzLGwsaSl7d1tsXT13W2xdfHxbXTt3W2xdLnB1c2goeydndG0uc3RhcnQnOm5ldyBEYXRlKCkuZ2V0VGltZSgpLGV2ZW50OidndG0uanMnfSk7dmFyIGY9ZC5nZXRFbGVtZW50c0J5VGFnTmFtZShzKVswXSxqPWQuY3JlYXRlRWxlbWVudChzKSxkbD1sIT0nZGF0YUxheW
Source: https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f	HTTP Parser: Script src: data:text/javascript;base64,dmFyIHRlbXBsYXRlVXJsPSdodHRwczovL2tyZXNrYW1ha2kucGwvd3AtY29udGVudC90aGVtZXMva3Jlc2thbWFraSc=
Source: https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f	HTTP Parser: Script src: data:text/javascript;base64,KGZ1bmN0aW9uKHcsZCxzLGwsaSl7d1tsXT13W2xdfHxbXTt3W2xdLnB1c2goeydndG0uc3RhcnQnOm5ldyBEYXRlKCkuZ2V0VGltZSgpLGV2ZW50OidndG0uanMnfSk7dmFyIGY9ZC5nZXRFbGVtZW50c0J5VGFnTmFtZShzKVswXSxqPWQuY3JlYXRlRWxlbWVudChzKSxkbD1sIT0nZGF0YUxheW
Source: https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f	HTTP Parser: Script src: data:text/javascript;base64,KGZ1bmN0aW9uKHcsZCxzLGwsaSl7d1tsXT13W2xdfHxbXTt3W2xdLnB1c2goeydndG0uc3RhcnQnOm5ldyBEYXRlKCkuZ2V0VGltZSgpLGV2ZW50OidndG0uanMnfSk7dmFyIGY9ZC5nZXRFbGVtZW50c0J5VGFnTmFtZShzKVswXSxqPWQuY3JlYXRlRWxlbWVudChzKSxkbD1sIT0nZGF0YUxheW
Source: https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f	HTTP Parser: Script src: data:text/javascript;base64,dmFyIHRlbXBsYXRlVXJsPSdodHRwczovL2tyZXNrYW1ha2kucGwvd3AtY29udGVudC90aGVtZXMva3Jlc2thbWFraSc=
Source: https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f	HTTP Parser: Script src: data:text/javascript;base64,KGZ1bmN0aW9uKHcsZCxzLGwsaSl7d1tsXT13W2xdfHxbXTt3W2xdLnB1c2goeydndG0uc3RhcnQnOm5ldyBEYXRlKCkuZ2V0VGltZSgpLGV2ZW50OidndG0uanMnfSk7dmFyIGY9ZC5nZXRFbGVtZW50c0J5VGFnTmFtZShzKVswXSxqPWQuY3JlYXRlRWxlbWVudChzKSxkbD1sIT0nZGF0YUxheW
Source: https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f	HTTP Parser: Script src: data:text/javascript;base64,KGZ1bmN0aW9uKHcsZCxzLGwsaSl7d1tsXT13W2xdfHxbXTt3W2xdLnB1c2goeydndG0uc3RhcnQnOm5ldyBEYXRlKCkuZ2V0VGltZSgpLGV2ZW50OidndG0uanMnfSk7dmFyIGY9ZC5nZXRFbGVtZW50c0J5VGFnTmFtZShzKVswXSxqPWQuY3JlYXRlRWxlbWVudChzKSxkbD1sIT0nZGF0YUxheW
Source: https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f	HTTP Parser: Script src: data:text/javascript;base64,dmFyIHRlbXBsYXRlVXJsPSdodHRwczovL2tyZXNrYW1ha2kucGwvd3AtY29udGVudC90aGVtZXMva3Jlc2thbWFraSc=
Source: https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f	HTTP Parser: Script src: data:text/javascript;base64,KGZ1bmN0aW9uKHcsZCxzLGwsaSl7d1tsXT13W2xdfHxbXTt3W2xdLnB1c2goeydndG0uc3RhcnQnOm5ldyBEYXRlKCkuZ2V0VGltZSgpLGV2ZW50OidndG0uanMnfSk7dmFyIGY9ZC5nZXRFbGVtZW50c0J5VGFnTmFtZShzKVswXSxqPWQuY3JlYXRlRWxlbWVudChzKSxkbD1sIT0nZGF0YUxheW

Source: https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f	HTTP Parser: No favicon
Source: https://kreskamaki.pl/wp-content/uploads/KRESKA-MAKI-ULOTKA.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon

Source: chromecache_289.2.dr	String found in binary or memory: <a href="https://www.facebook.com/kreskamaki/" title="facebook" target="_blank"> equals www.facebook.com (Facebook)
Source: chromecache_252.2.dr, chromecache_287.2.dr, chromecache_291.2.dr, chromecache_271.2.dr	String found in binary or memory: return b}GD.F="internal.enableAutoEventOnTimer";var Zb=wa(["data-gtm-yt-inspected-"]),ID=["www.youtube.com","www.youtube-nocookie.com"],JD,KD=!1; equals www.youtube.com (Youtube)

Source: chromecache_258.2.dr, downloaded.pdf.crdownload.0.dr, 1e21a5de-4f15-479b-b540-93d56676e759.tmp.0.dr	String found in binary or memory: http://www.npes.org/pdfx/ns/id/
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: chromecache_291.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_289.2.dr	String found in binary or memory: https://api.w.org/
Source: chromecache_252.2.dr, chromecache_287.2.dr, chromecache_291.2.dr, chromecache_271.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_289.2.dr	String found in binary or memory: https://fonts.gstatic.com
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlphgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbqmIE4Ygg.w
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlphgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbqnIE4Ygg.w
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlphgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbqoIE4.woff
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlphgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRfG7qmIE4Ygg.w
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlphgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRfG7qnIE4Ygg.w
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlphgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRfG7qoIE4.woff
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRf-62_B2sl.wof
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRf-62_CGslu50.
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRf-62_CWslu50.
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRf06i_B2sl.wof
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRf06i_CGslu50.
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRf06i_CWslu50.
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRf36y_B2sl.wof
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRf36y_CGslu50.
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRf36y_CWslu50.
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRfi6m_B2sl.wof
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRfi6m_CGslu50.
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRfi6m_CWslu50.
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRfp66_B2sl.wof
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRfp66_CGslu50.
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRfp66_CWslu50.
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRft6u_B2sl.wof
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRft6u_CGslu50.
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRft6u_CWslu50.
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRfw6-_B2sl.wof
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRfw6-_CGslu50.
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRfw6-_CWslu50.
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpjgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbLLEEIAhqSP
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpjgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbLLEEMAhqSP
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpjgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbLLEEwAhg.w
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpkgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbIDAlsno5k.
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpkgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbIDAlsoo5m2
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpkgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbIDAlspo5m2
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpkgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbIPBlsno5k.
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpkgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbIPBlsoo5m2
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpkgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbIPBlspo5m2
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpkgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbITBVsno5k.
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpkgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbITBVsoo5m2
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpkgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbITBVspo5m2
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpkgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbIrB1sno5k.
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpkgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbIrB1soo5m2
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpkgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbIrB1spo5m2
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpkgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbJ3BFsno5k.
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpkgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbJ3BFsoo5m2
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpkgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbJ3BFspo5m2
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpkgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbJbA1sno5k.
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpkgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbJbA1soo5m2
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpkgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbJbA1spo5m2
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpkgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbJnAVsno5k.
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpkgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbJnAVsoo5m2
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpkgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXfbJnAVspo5m2
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpvgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXd4qqOEo.woff
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpvgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXdoqqOEo.woff
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlowsemicondensed/v15/wlpvgxjLBV1hqnzfr-F8sEYMB0Yybp0mudRXeIqq.woff2)
Source: chromecache_265.2.dr, chromecache_282.2.dr, chromecache_279.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_280.2.dr, chromecache_292.2.dr	String found in binary or memory: https://github.com/georgekosmidis/jquery-hashchange
Source: chromecache_273.2.dr	String found in binary or memory: https://github.com/jonsuh/hamburgers
Source: chromecache_276.2.dr, chromecache_254.2.dr	String found in binary or memory: https://github.com/microsoft/clarity
Source: chromecache_265.2.dr, chromecache_282.2.dr, chromecache_279.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_282.2.dr, chromecache_279.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: chromecache_291.2.dr	String found in binary or memory: https://google.com
Source: chromecache_291.2.dr	String found in binary or memory: https://googleads.g.doubleclick.net
Source: chromecache_273.2.dr	String found in binary or memory: https://jonsuh.com/hamburgers
Source: chromecache_289.2.dr	String found in binary or memory: https://kreskamaki.pl/
Source: chromecache_289.2.dr	String found in binary or memory: https://kreskamaki.pl/#lokale
Source: chromecache_289.2.dr	String found in binary or memory: https://kreskamaki.pl/#menu
Source: chromecache_289.2.dr	String found in binary or memory: https://kreskamaki.pl/#onas
Source: chromecache_289.2.dr	String found in binary or memory: https://kreskamaki.pl/promocje/
Source: chromecache_289.2.dr	String found in binary or memory: https://kreskamaki.pl/wp-content/litespeed/css/337468f3ab634f283848c9874971e922.css?ver=1e922
Source: chromecache_289.2.dr	String found in binary or memory: https://kreskamaki.pl/wp-content/litespeed/css/5249450f0b6dbec702c6eddfd93e86c2.css?ver=e86c2
Source: chromecache_289.2.dr	String found in binary or memory: https://kreskamaki.pl/wp-content/litespeed/css/68cd2460d4d9f72fde436a1695d0cea3.css?ver=0cea3
Source: chromecache_289.2.dr	String found in binary or memory: https://kreskamaki.pl/wp-content/themes/kreskamaki/fonts/Holtzman-Textured-PL.woff2
Source: chromecache_289.2.dr	String found in binary or memory: https://kreskamaki.pl/wp-content/themes/kreskamaki/img/btn-arrow.svg
Source: chromecache_289.2.dr	String found in binary or memory: https://kreskamaki.pl/wp-content/uploads/KRESKA-MAKI-ULOTKA.pdf
Source: chromecache_289.2.dr	String found in binary or memory: https://kreskamaki.pl/wp-content/uploads/favicon.png
Source: chromecache_289.2.dr	String found in binary or memory: https://kreskamaki.pl/wp-content/uploads/fb.svg
Source: chromecache_289.2.dr	String found in binary or memory: https://kreskamaki.pl/wp-content/uploads/inst.svg
Source: chromecache_289.2.dr	String found in binary or memory: https://kreskamaki.pl/wp-content/uploads/kreska-maki-polityka-prywatnosci.pdf
Source: chromecache_289.2.dr	String found in binary or memory: https://kreskamaki.pl/wp-content/uploads/logo.svg
Source: chromecache_289.2.dr	String found in binary or memory: https://kreskamaki.pl/wp-json/
Source: chromecache_289.2.dr	String found in binary or memory: https://kreskamaki.pl/xmlrpc.php?rsd
Source: chromecache_291.2.dr, chromecache_271.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_252.2.dr, chromecache_287.2.dr, chromecache_291.2.dr, chromecache_271.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_289.2.dr	String found in binary or memory: https://pomelomedia.pl/
Source: chromecache_272.2.dr, chromecache_281.2.dr, chromecache_259.2.dr, chromecache_251.2.dr, chromecache_275.2.dr, chromecache_277.2.dr	String found in binary or memory: https://sketchapp.com
Source: chromecache_252.2.dr, chromecache_287.2.dr, chromecache_291.2.dr, chromecache_271.2.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_291.2.dr, chromecache_271.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_291.2.dr, chromecache_271.2.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_271.2.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_252.2.dr, chromecache_291.2.dr	String found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_289.2.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-5DJH2VX
Source: chromecache_289.2.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-PQJK382V
Source: chromecache_252.2.dr, chromecache_291.2.dr	String found in binary or memory: https://www.googletagmanager.com/static/service_worker/
Source: chromecache_289.2.dr	String found in binary or memory: https://www.instagram.com/kreska.maki/

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2000,i,3380293206825283762,15677942766615917640,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f"
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1560,i,3530712955350696723,17840097560420890255,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2000,i,3380293206825283762,15677942766615917640,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1560,i,3530712955350696723,17840097560420890255,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 258
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 258			Jump to dropped file

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	11 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service

Source	Detection	Scanner	Label
https://kreskamaki.pl/wp-content/uploads/inst.svg	0%	Avira URL Cloud	safe
https://kreskamaki.pl/wp-content/litespeed/css/5249450f0b6dbec702c6eddfd93e86c2.css?ver=e86c2	0%	Avira URL Cloud	safe
https://kreskamaki.pl/	0%	Avira URL Cloud	safe
https://kreskamaki.pl/wp-content/uploads/fb.svg	0%	Avira URL Cloud	safe
https://kreskamaki.pl/wp-content/themes/kreskamaki/img/btn-arrow.svg	0%	Avira URL Cloud	safe
https://kreskamaki.pl/wp-content/uploads/kreska-maki-polityka-prywatnosci.pdf	0%	Avira URL Cloud	safe
https://kreskamaki.pl/wp-content/litespeed/css/68cd2460d4d9f72fde436a1695d0cea3.css?ver=0cea3	0%	Avira URL Cloud	safe
https://kreskamaki.pl/#menu	0%	Avira URL Cloud	safe
https://kreskamaki.pl/wp-content/uploads/favicon.png	0%	Avira URL Cloud	safe
https://kreskamaki.pl/#onas	0%	Avira URL Cloud	safe
https://kreskamaki.pl/wp-content/litespeed/css/337468f3ab634f283848c9874971e922.css?ver=1e922	0%	Avira URL Cloud	safe
https://kreskamaki.pl/xmlrpc.php?rsd	0%	Avira URL Cloud	safe
https://kreskamaki.pl/promocje/	0%	Avira URL Cloud	safe
https://pomelomedia.pl/	0%	Avira URL Cloud	safe
https://kreskamaki.pl/#lokale	0%	Avira URL Cloud	safe
https://kreskamaki.pl/wp-content/uploads/logo.svg	0%	Avira URL Cloud	safe
https://kreskamaki.pl/wp-content/themes/kreskamaki/fonts/Holtzman-Textured-PL.woff2	0%	Avira URL Cloud	safe
https://kreskamaki.pl/wp-json/	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
https://kreskamaki.pl/wp-content/uploads/KRESKA-MAKI-ULOTKA.pdf	false		unknown
file:///C:/Users/user/Downloads/downloaded.pdf	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.45	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
54.144.73.197	unknown	United States	14618	AMAZON-AESUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.186.36	unknown	United States	15169	GOOGLEUS	false
23.47.168.24	unknown	United States	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.164	unknown	United States	15169	GOOGLEUS	false
193.239.44.233	unknown	Poland	60713	TARRCI-ASPL	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559388
Start date and time:	2024-11-20 13:24:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@39/124@0/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found PDF document Close Viewer

Input	Output
URL: https://kreskamaki.pl Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://kreskamaki.pl
URL: https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f Model: Joe Sandbox AI	```json { "contains_trigger_text": true, "trigger_text": "Ups! Co poszo nie tak...", "prominent_button_name": "PRZEJD DO STRONY GWNEJ", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f Model: Joe Sandbox AI	```json { "brands": [ "Bd 404", "Pomelo Media" ] }
	```json { "brands": [ "Bd 404", "Pomelo Media" ] }
URL: https://kreskamaki.pl/wp-content/uploads/KRESKA-MAKI-ULOTKA.pdf Model: Joe Sandbox AI	```json { "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f Model: Joe Sandbox AI	```json { "contains_trigger_text": true, "trigger_text": "Ups! Co poszo nie tak... Widocznie strona, ktr szukasz nie istnieje. Powr na stron gwn i zacznij od pocztku.", "prominent_button_name": "PRZEJD DO STRONY GWNEJ", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: file:///C:/Users/user/Downloads/downloaded.pdf Model: Joe Sandbox AI	```json { "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://kreskamaki.pl/wp-content/uploads/KRESKA-MAKI-ULOTKA.pdf Model: Joe Sandbox AI	```json { "brands": [] } ``` The provided image does not contain any visible brands or logos. The image appears to be a blank gray screen with no discernible content or branding elements.

URL: https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f Model: Joe Sandbox AI	```json { "brands": [ "Kreska Maki" ] }
	```json { "brands": [ "Kreska Maki" ] }
URL: file:///C:/Users/user/Downloads/downloaded.pdf Model: Joe Sandbox AI	```json { "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: file:///C:/Users/user/Downloads/downloaded.pdf Model: Joe Sandbox AI	```json { "brands": [ "KRESKA-MAKI-ULOTKA" ] }
	```json { "brands": [ "KRESKA-MAKI-ULOTKA" ] }
URL: file:///C:/Users/user/Downloads/downloaded.pdf Model: Joe Sandbox AI	```json { "brands": [ "KRESKA-MAKI-ULOTKA" ] }
	```json { "brands": [ "KRESKA-MAKI-ULOTKA" ] }

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.252433110034585
Encrypted:	false
SSDEEP:	6:HlgD3+q2Pwkn2nKuAl9OmbnIFUt8YlQZmw+YlLqtVkwOwkn2nKuAl9OmbjLJ:QOvYfHAahFUt8x/+e65JfHAaSJ
MD5:	1E8F5DAFE898406FA0364BAE9A82FB46
SHA1:	60F0A4DD764196DB7D8D42A31FD8DA9743FFFE38
SHA-256:	7D69D176FCAB2A7ECCF0510EA4807DC173E27C36FF62F6B4D5DEDFB137BE0E8D
SHA-512:	69EA89CC74532B63308E84E2075580C1556BB0F1D88BF7A450FAFDE3B141254234012E48F3015E1E4970DEEA091DCDE383AAEE7BC46622D8C82443A4238044DF
Malicious:	false
Reputation:	low
Preview:	2024/11/20-07:26:53.167 1a58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/20-07:26:53.169 1a58 Recovering log #3.2024/11/20-07:26:53.170 1a58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Name	Source	Malicious	Antivirus Detection	Reputation
https://kreskamaki.pl/wp-content/uploads/inst.svg	chromecache_289.2.dr	false	Avira URL Cloud: safe	unknown
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://github.com/jonsuh/hamburgers	chromecache_273.2.dr	false		high
https://kreskamaki.pl/#onas	chromecache_289.2.dr	false	Avira URL Cloud: safe	unknown
https://kreskamaki.pl/wp-content/uploads/kreska-maki-polityka-prywatnosci.pdf	chromecache_289.2.dr	false	Avira URL Cloud: safe	unknown
https://jonsuh.com/hamburgers	chromecache_273.2.dr	false		high
https://kreskamaki.pl/wp-content/litespeed/css/5249450f0b6dbec702c6eddfd93e86c2.css?ver=e86c2	chromecache_289.2.dr	false	Avira URL Cloud: safe	unknown
https://kreskamaki.pl/wp-content/uploads/fb.svg	chromecache_289.2.dr	false	Avira URL Cloud: safe	unknown
https://api.w.org/	chromecache_289.2.dr	false		high
https://googleads.g.doubleclick.net	chromecache_291.2.dr	false		high
https://kreskamaki.pl/wp-content/themes/kreskamaki/img/btn-arrow.svg	chromecache_289.2.dr	false	Avira URL Cloud: safe	unknown
https://kreskamaki.pl/#menu	chromecache_289.2.dr	false	Avira URL Cloud: safe	unknown
https://www.instagram.com/kreska.maki/	chromecache_289.2.dr	false		high
https://getbootstrap.com/)	chromecache_265.2.dr, chromecache_282.2.dr, chromecache_279.2.dr	false		high
https://kreskamaki.pl/	chromecache_289.2.dr	false	Avira URL Cloud: safe	unknown
https://cct.google/taggy/agent.js	chromecache_252.2.dr, chromecache_287.2.dr, chromecache_291.2.dr, chromecache_271.2.dr	false		high
https://sketchapp.com	chromecache_272.2.dr, chromecache_281.2.dr, chromecache_259.2.dr, chromecache_251.2.dr, chromecache_275.2.dr, chromecache_277.2.dr	false		high
https://kreskamaki.pl/wp-content/uploads/favicon.png	chromecache_289.2.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com	chromecache_291.2.dr, chromecache_271.2.dr	false		high
https://kreskamaki.pl/wp-content/litespeed/css/68cd2460d4d9f72fde436a1695d0cea3.css?ver=0cea3	chromecache_289.2.dr	false	Avira URL Cloud: safe	unknown
https://kreskamaki.pl/promocje/	chromecache_289.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_282.2.dr, chromecache_279.2.dr	false		high
https://td.doubleclick.net	chromecache_252.2.dr, chromecache_287.2.dr, chromecache_291.2.dr, chromecache_271.2.dr	false		high
https://kreskamaki.pl/wp-content/litespeed/css/337468f3ab634f283848c9874971e922.css?ver=1e922	chromecache_289.2.dr	false	Avira URL Cloud: safe	unknown
https://kreskamaki.pl/xmlrpc.php?rsd	chromecache_289.2.dr	false	Avira URL Cloud: safe	unknown
https://pomelomedia.pl/	chromecache_289.2.dr	false	Avira URL Cloud: safe	unknown
https://kreskamaki.pl/wp-content/uploads/logo.svg	chromecache_289.2.dr	false	Avira URL Cloud: safe	unknown
http://www.npes.org/pdfx/ns/id/	chromecache_258.2.dr, downloaded.pdf.crdownload.0.dr, 1e21a5de-4f15-479b-b540-93d56676e759.tmp.0.dr	false		high
https://kreskamaki.pl/wp-json/	chromecache_289.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_265.2.dr, chromecache_282.2.dr, chromecache_279.2.dr	false		high
https://kreskamaki.pl/#lokale	chromecache_289.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/georgekosmidis/jquery-hashchange	chromecache_280.2.dr, chromecache_292.2.dr	false		high
https://google.com	chromecache_291.2.dr	false		high
https://kreskamaki.pl/wp-content/themes/kreskamaki/fonts/Holtzman-Textured-PL.woff2	chromecache_289.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/microsoft/clarity	chromecache_276.2.dr, chromecache_254.2.dr	false		high
https://adservice.google.com/pagead/regclk?	chromecache_291.2.dr	false		high

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.3, 2 pages
Category:	dropped
Size (bytes):	1226772
Entropy (8bit):	7.992240684125922
Encrypted:	true
SSDEEP:	24576:7RmFN6xsguXbaaAJXv7apWyV0mThxvYGlcV2QsUYkiuC/72npzPG/:Fm+ZuOjJzaQyVPTh1YGZQshkiuG72p7+
MD5:	A3977EDCA33AD89379E30467ECEACC4C
SHA1:	CDC6F7F3161A192D8BD325C423FE591A93B9BF23
SHA-256:	3BCE5F62A799E0DF8FE84AEF521A8AB441A503CFE86F808077DF728FC14C7C20
SHA-512:	95EBB211668F5650A76C820F1D2514FFCCBBEE49EF7CB47CA20B9D9CA61D82F11FF74E524D3B078F3F081064DD3C0B93F99367F6D1DFECF22F0C401AF96D4A0B
Malicious:	false
Reputation:	low
Preview:	%PDF-1.3.%......19 0 obj.<</Linearized 1/L 1226772/O 21/E 224553/N 2/T 1226277/H [ 856 240]>>.endobj. .xref..19 28..0000000016 00000 n..0000001096 00000 n..0000001342 00000 n..0000001732 00000 n..0000001871 00000 n..0000002578 00000 n..0000003249 00000 n..0000003362 00000 n..0000003855 00000 n..0000003965 00000 n..0000004554 00000 n..0000004579 00000 n..0000004849 00000 n..0000013611 00000 n..0000020911 00000 n..0000028396 00000 n..0000035618 00000 n..0000042806 00000 n..0000051609 00000 n..0000059576 00000 n..0000067189 00000 n..0000067472 00000 n..0000074523 00000 n..0000074637 00000 n..0000217277 00000 n..0000217346 00000 n..0000224187 00000 n..0000000856 00000 n..trailer.<</Size 47/Root 20 0 R/Info 18 0 R/ID[<01868BA676EB4DCB98867917E31FAED1><DF8504429FB24F4CB51EA55147A8FC2C>]/Prev 1226266>>.startxref.0.%%EOF. .46 0 obj.<</Filter/FlateDecode/I 180/Length 160/S 89>>stream..h.b``.f``.c`a`N.. ..B..@..........BJ.\|.Rv...Bsu@\|.........V.d.0p.h.iI ...J...v

Target ID:	0
Start time:	07:25:33
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	07:25:36
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2000,i,3380293206825283762,15677942766615917640,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	07:25:39
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	07:26:51
Start date:	20/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	8
Start time:	07:26:52
Start date:	20/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x800000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	9
Start time:	07:26:53
Start date:	20/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1560,i,3530712955350696723,17840097560420890255,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4d28b672-d69c-43d4-88da-44aa79b18466.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF50315b.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fb57a8d8-21cd-4f16-ba7c-595f2b05ed4f.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241120122657Z-192.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Windows Analysis Report
https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre