Windows Analysis Report
https://pckg.ai/X5KpCErF

Overview

General Information

Sample URL:	https://pckg.ai/X5KpCErF
Analysis ID:	1559728

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML body with high number of embedded images detected

Stores files to the Windows start menu directory

Classification

Signatures

HTML body with high number of embedded images detected

Source: https://app.package.ai/recipient/dons/#/app/tracking?app=dons&deliveryId=fqacXADiBJaGnxG

HTTP Parser: Total embedded image size: 17385

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.17:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.17:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.11:443 -> 192.168.2.17:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.170:443 -> 192.168.2.17:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49806 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.109.164

Source: global traffic	DNS traffic detected: DNS query: pckg.ai
Source: global traffic	DNS traffic detected: DNS query: app.package.ai
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: ws-mt1.pusher.com
Source: global traffic	DNS traffic detected: DNS query: cdn.mxpnl.com
Source: global traffic	DNS traffic detected: DNS query: api.package.ai
Source: global traffic	DNS traffic detected: DNS query: sockjs-mt1.pusher.com
Source: global traffic	DNS traffic detected: DNS query: api-js.mixpanel.com
Source: global traffic	DNS traffic detected: DNS query: packageai-static.s3.amazonaws.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.17:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.17:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.11:443 -> 192.168.2.17:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.170:443 -> 192.168.2.17:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.17:49806 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@18/49@32/238

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=2040,i,17384319226956729670,16612116269087594830,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://pckg.ai/X5KpCErF"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=2040,i,17384319226956729670,16612116269087594830,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.206	unknown	United States	15169	GOOGLEUS	false
130.211.34.183	api-js.mixpanel.com	United States	15169	GOOGLEUS	false
172.217.17.67	unknown	United States	15169	GOOGLEUS	false
216.58.208.227	unknown	United States	15169	GOOGLEUS	false
108.158.75.46	app.package.ai	United States	16509	AMAZON-02US	false
107.178.240.159	unknown	United States	15169	GOOGLEUS	false
52.55.106.120	unknown	United States	14618	AMAZON-AESUS	false
172.217.19.170	unknown	United States	15169	GOOGLEUS	false
172.217.21.35	unknown	United States	15169	GOOGLEUS	false
34.201.239.212	ingress-sticky-haproxy-mt1-912d8b7308f82d6c.elb.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
52.84.45.12	unknown	United States	55960	BJ-GUANGHUAN-APBeijingGuanghuanXinwangDigitalCN	false
35.186.235.23	cdn.mxpnl.com	United States	15169	GOOGLEUS	false
172.217.19.238	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
65.9.112.89	pckg.ai	United States	16509	AMAZON-02US	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
151.101.65.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
18.214.171.71	socket-mt1-ingress-1987402783.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
216.58.208.234	unknown	United States	15169	GOOGLEUS	false
64.233.165.84	unknown	United States	15169	GOOGLEUS	false
52.217.86.124	s3-w.us-east-1.amazonaws.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.84.45.89	api.package.ai	United States	55960	BJ-GUANGHUAN-APBeijingGuanghuanXinwangDigitalCN	false
172.217.19.10	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17

Contacted Domains

Name	IP	Active
jsdelivr.map.fastly.net	151.101.65.229	true
s3-w.us-east-1.amazonaws.com	52.217.86.124	true
api.package.ai	52.84.45.89	true
api-js.mixpanel.com	130.211.34.183	true
app.package.ai	108.158.75.46	true
socket-mt1-ingress-1987402783.us-east-1.elb.amazonaws.com	18.214.171.71	true
www.google.com	142.250.181.100	true
pckg.ai	65.9.112.89	true
cdn.mxpnl.com	35.186.235.23	true
ingress-sticky-haproxy-mt1-912d8b7308f82d6c.elb.us-east-1.amazonaws.com	34.201.239.212	true
packageai-static.s3.amazonaws.com	unknown	unknown
cdn.jsdelivr.net	unknown	unknown
sockjs-mt1.pusher.com	unknown	unknown
ws-mt1.pusher.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://app.package.ai/recipient/dons/#/app/tracking?app=dons&deliveryId=fqacXADiBJaGnxG	false		unknown

ID:	1559728
Product:	CloudBasic
Start time:	21:24:53
Start date:	20.11.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 19:25:24 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	82EA6217D5E3608357FBE28089FE690F	3AF552AA0BC32D4CB5F2C4660A72736302F9B1E8	A945AC32362F52C7CF291855E19455EB8CFF9E9CC42F400D29A585FA51BE907D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 19:25:24 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	B55F9AA4F7294374885E00031B9FEDBE	C4139A7CDB8151DBB7810B1D7559F2FA6F313EAA	83FF1D0EB436E2F8AD644183B6942995D780A749A220DA337720B3D08DE74659
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	D9FDAA7D946D0C8F940E69891FE9025B	7B9C560E5F381E9EAB18D89E25264F2441570132	209638E450801EA2B06DFF928116015E76B34EC00C3FD5B91CFFAA6759E81113
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 19:25:24 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	7771D658F41BE770C53904B9F633DFB9	292FB5182F4371AD546DC1525180F6B830C6CBED	B1D2B6228F9833AFD8537D394C1C0C0EB196BEFE7E1261602A29E4A2C4357163
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 19:25:24 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	70657EF2B02E426B8A12CCDD545E5BB9	15925DAC9D71852287239018D7A5885212ED5F6E	9FC484149E7E2443BE92B0832F0FDC96CC3B966273FB9772E145923DDD546807
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 19:25:24 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	F660470659AA8C5F3758E7CF17B538FF	59E5C3FBBD66682294549B2944C701A63C7E2BA9	F1A8E9A8EC12AC78BB2182060B15280630BAABB423492CEB05695DCBCC07756D
Chrome Cache Entry: 102	ASCII text, with very long lines (10034), with no line terminators	087F9956C20D42C202070BD8EDDB44E9	504EAAD4072D3C1DDD25F58D3FFBBCFF7966A920	EBAFBFE06F88122795C360E8DB07EA0862535C2D664096FF40DE68D77D8F0004
Chrome Cache Entry: 104	ASCII text, with very long lines (1712)	835A75928B7D86C64AFB03767C8C99E2	159E13B4B5D16AB48C85780BE28CCA4976859CEA	D422128EEA28CCDF1E598004F0E8CE733E387FD0B4978AC4DBA23FF131461C0E
Chrome Cache Entry: 106	RIFF (little-endian) data, Web/P image	52328E854955B7BF365DDF58D3C2FAEF	D2E2978DC69EB5D394FD5AC09ED69F161DF41578	8812012A40724659614F2866734B04E36CAF573E1098C09E049DD4C0B51C700C
Chrome Cache Entry: 107	RIFF (little-endian) data, Web/P image	3DCED4776C86F8F49126EB10CA9AAAFF	F9AC0B813850679DF0F7CE8D28CA087210C77D07	95D6CB77A8B2EA2BA0D211EA62E43786FE4AD3A3B9522174D24FA1A0B4B4F86B
Chrome Cache Entry: 108	Web Open Font Format (Version 2), TrueType, length 168824, version 331.-31196	A3D7D331957546AE10AD69BB44B83A04	D1A227A182628C48649912E8BCD9251113E9C783	3BBB0DF89B8DBE8001E8C24DE4E2D1693F94997B29F007A7BDA22A9802832768
Chrome Cache Entry: 109	HTML document, ASCII text, with very long lines (528)	1A95482371FFBC440F403A0889352DBD	2234C46FC60A82AE0DAA729DD41F898A71F0952C	FF4A17F8BE027CBCED94ACE15E357660853390EEF5A0F2EBF436D52942455976
Chrome Cache Entry: 110	RIFF (little-endian) data, Web/P image	FD0C0D31DDE15A07CB0DB78432AE6541	8F679B6956D8C2F161B35E7693075274AE16A819	5E32D0515417E989760CC1802B24F13B1AFEA6B683CDF036767EE311BE8E59E7
Chrome Cache Entry: 111	ASCII text, with very long lines (3861)	92A49B1E55FD68B539DB8C5273EF210A	2190F9E644A3BEEBC046BED0F926826E89AA5046	759386A83F95F27E04FB38FBE189AD00BDDBC601523745311D13D246446B9D47
Chrome Cache Entry: 113	ASCII text, with very long lines (2242)	41039E33B02C8A2C2518E4A5729873BA	E58E51EAF60767EB8AA6886F447F6E8D21E048E7	6709B08448650F2444E9A96D782E86D51DD781F815FF978B0D52920536A8BC2F
Chrome Cache Entry: 114	RIFF (little-endian) data, Web/P image	1F6356B740078E27E34BBAFC646AD3BA	E4B8F8B6B04AB9791DA79358241A1B3853C2C44E	AAE4D9C56FB224C3C9F03853E5C113AA71F6FA3A7BE6766ABCA91D9185D5B0C6
Chrome Cache Entry: 118	Unicode text, UTF-8 text, with very long lines (50869)	3514554F2C13738374DB1A0C54060C1C	47C9630D8ABC1E09E1658361B6B92C7405EAB1C3	C4A4E239DB8A5BD4E3B60E4425533C6825070129EBB4BE093A2877742FADBD19
Chrome Cache Entry: 120	ASCII text, with very long lines (65454)	605144044ACA2026C04B65F1FE98AA91	138C3C8B9D9A82F21F9130BE364BC4314E397ED0	C7116C62C26E3C6206367288E3DC08BE56080FE8C0CFED85FE79875A8B909E11
Chrome Cache Entry: 121	Web Open Font Format (Version 2), TrueType, length 18536, version 1.0	8EFF0B8045FD1959E117F85654AE7770	227FEE13CEB7C410B5C0BB8000258B6643CB6255	89978E658E840B927DDDB5CB3A835C7D8526ECE79933BD9F3096B301FE1A8571
Chrome Cache Entry: 122	ASCII text, with very long lines (574)	45CB322309336C5F4F7B49B7695F0BBA	08483FAA3750E62CE1A478CD9E293F64A3B83A54	BC94AC4CF8C40825AD44690336B1DE510A0B5DD6428A5759B0CC5284DCDC7E08
Chrome Cache Entry: 123	RIFF (little-endian) data, Web/P image	0421F8833712C3EFF19EA0F442E4A72C	1F3E4CC69B2C13F3BBE6580C366A787E98C097E2	9B2DDC0EB2424FA45CA3F2CE40BDA4EC1664E63E7AABC37AC899323A45BD6A86
Chrome Cache Entry: 126	JSON data	25DBBEE5BF0A983244AE427DCEAA0C04	0103F741C300CD00951AB8EE98366B16F9CA3176	98AAD1B76960AD12636B7EB216E2416EA693461E918D3348C7B47099447103CE
Chrome Cache Entry: 127	ASCII text, with very long lines (1572)	D7BAF05C6E14C13A23F448AC65FF9D1F	DBE0994634F05F9E1AD254193AC747A9840FB18C	8F52BE836A7F2E7003CA45F889E310551763B925DFBE105C3A1E31D18D132958
Chrome Cache Entry: 129	PNG image data, 1 x 1, 8-bit gray+alpha, non-interlaced	8327A6037AE00A5BE9F75E63EE1B9FBE	A812C79B0D125E4946B33446EAE0353F518627E2	FE67E12A6497F8518EF1673FD8CF5622871935FF85F204715E78B2009DD48588
Chrome Cache Entry: 131	ASCII text, with very long lines (65536), with no line terminators	DC663F2307F9AB02CF06AB357EFA7845	D43EB079ACC592CAEE325AB01694641459C82853	29E461B3A66DFB905A602E4C0EA68A1E541100DEEE2CB8F385F15607F162F914
Chrome Cache Entry: 132	ASCII text	B57627B7D75E5FC098E34276F4CFFDAE	0598FCB9DA1E13E34B42B6ED6FC1A55C1B4394EC	DFF47BAE4175B044A3E8020EAC2480B834691A0C39A3344128B3D2EE958930BB
Chrome Cache Entry: 141	ASCII text, with very long lines (554)	F54C9060740C6FA2FAE1FA614D66AF32	ABF34C2F549FCCFD616C1C136A4F5DFF23033DAD	BFD7735BA4BBCCDAFB1FD3C00D9182D5ED058E194A1C33A15C096091B5A2A630
Chrome Cache Entry: 143	Unicode text, UTF-8 text, with very long lines (50869)	9303D98EF9F6C9E5948BBE73A0C06154	89A00ADCB9273A9B2EC9220905CAC0B010A28B0A	636FE6BCCF1C3E9B55C0739A3543CC8BE23ADFA013CD077DCDCE2FBEA588BFF2
Chrome Cache Entry: 144	ASCII text, with no line terminators	2945E434F2EDD02EC9991BC99B37D4A5	73AAFE1129C1BD4D4DAAD7CD56340B52870BEBCA	E6209BC46231A4C3B987B7911012984250D9AEB2EF66346A993A35AB9E31FF6B
Chrome Cache Entry: 145	JSON data	8A80554C91D9FCA8ACB82F023DE02F11	5F36B2EA290645EE34D943220A14B54EE5EA5BE5	CA3D163BAB055381827226140568F3BEF7EAAC187CEBD76878E0B63E9E442356
Chrome Cache Entry: 147	RIFF (little-endian) data, Web/P image	6E0AD64491A6E1A80F74BCD0676686A9	A756BF4AB55228D430847073CF98DB47FD26372A	159E8B542F2551CF2C340A2ECFC19D81DA7C2A09122F1F69BEC2A15475C9E7CF
Chrome Cache Entry: 148	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel	7B307A6768B994EAEAFDE39A93BE6F08	224140840E17315FE3621211969B594A0C39A2F3	CB9811F8B0BBA5029378208F71B5C763E70D7C2A5115A2B05C66F09FDBDBF870
Chrome Cache Entry: 151	ASCII text, with no line terminators	67A20B0E73D087EFEBD60AE5C33BB644	2E949C2A20D7C8D593B5F44671A39FF3E4C49532	346508016877D53C76ED6C533F79857246EC6FFCCE31322D3F7D0D15EDA68093
Chrome Cache Entry: 152	RIFF (little-endian) data, Web/P image	DEDF67B24230FB0BF87AEBEB5B352BC9	0DB088E557EBFE96598C9C9210BB4454ADCF08FA	E97B30523F4E85EC5C0A3329D76A97EF729443EC9EC4F5C44EA365DA6F5EAB2A
Chrome Cache Entry: 154	RIFF (little-endian) data, Web/P image	728FD6BD3603C7585BE9802A81AB8295	75D4A6C13DAC65A875E65424BD1C1CD7DFBF0936	F7F0104E8F0E8C7C7E4C11AE2A9D51A66837DB820BBC7A3D407EF347DAC6A02C
Chrome Cache Entry: 155	RIFF (little-endian) data, Web/P image	8530AC763C1323FC6C900F99B3B514DC	60D074611D4B49BA868009EC8A53B65B43ACAAD1	589BF065D91CE4D9D869E2452CFE2F7FCB72279A994F49C40ED38BDB1554ED1D
Chrome Cache Entry: 156	RIFF (little-endian) data, Web/P image	76E53D9367ECA7F6850A045BDA6A77C5	5D1174C429C9835D5148E3C76EDD099E6F526D6C	3825975047D64A637C253DC7EC3AB5F2A667C88D5024F5FCC97F989D4721DE90
Chrome Cache Entry: 157	ASCII text, with very long lines (1384)	7A7D938DA8CD67456649986B801AF7A6	74D6F01FCEF06247DC0837BC007890CAD9C904FB	CA1161932E6164658ADEEC3C6605C8B9BFFA9D02E1A0478BFD512AA0A328BD99
Chrome Cache Entry: 159	RIFF (little-endian) data, Web/P image	0004114AB33B87BCE7BBE64AE47FB3FE	E4BC49C050E3442AC124A0B7699D56CD3013E158	BC3206E024D56BEEE8C2B02742BB75F77B2DE03B7BE80165CAC6EFA866CA9BB2
Chrome Cache Entry: 161	JSON data	B831C276BFB2BC0FFE1DA25565A895DD	350FBE6339B0A22DB0A143D3BA4E75AF9659D6ED	F98773A972B07E49223A255CACE4107BBC09184FE7192D50EDDAFBA89E523095
Chrome Cache Entry: 163	ASCII text, with very long lines (12264)	D8BB8C39C059272A282C3764F2F7E712	E15C6BF42DFDBE0D05AE8E764D73C1842B6521C4	1DA85F422ADAF4A09DF9D729B46D09BA21FDF404A4F00EBF02E1BF80C0C4D3C0
Chrome Cache Entry: 165	PNG image data, 51 x 51, 8-bit colormap, interlaced	AE6C9AAA42A16CF14120D22A5B8D9A51	2178EA0D53A054DE0A772FBF594E621C414B57AA	FAF6169C2CE501F4F5E437711593F5A0F454FB5E7AA8C99BD8CFD74FCB2D51D6
Chrome Cache Entry: 166	PNG image data, 400 x 787, 1-bit colormap, non-interlaced	2F2169B4969614968AC3864C9D1B559C	8B8AB6184D6AEFC8FA104F76F208DFD717C21DEF	119EA8EF3F48892AD4C291B28EAA0D3622C30672D4D162318C9ED8C2F28E37FE
Chrome Cache Entry: 167	ASCII text, with very long lines (10106)	C80C822A0297DD817361DB1ABE7EEDBE	11D77914252B4A43A0B344B1079B8B7E71B1EF09	87969313EC0E62CA6DD87F362F5D80BE5D5850DF5CC92E40AEA16D405A80B9B0
Chrome Cache Entry: 168	MS Windows cursor resource - 1 icon, 32x32, 2 colors, hotspot @8x8	FEFF9159F56CB2069041D660B484EB07	0D0A08CF25A258511957F357B89D3908F3C5E6E3	7342F390B12F636D14E25F698FC5E38CF6240994DC0C07FEFBBB4E78EC4D03C7
Chrome Cache Entry: 169	JSON data	9A4C8AFFC76B1F491444BBD9F94EF43D	4CF4DD20F5AD4A22633746233E9C2AF7CD351263	1BC8AA786E51AB650D8D43007ED395F69B6AB1395405EA5D9AEF6569A1DFFAAF
Chrome Cache Entry: 96	RIFF (little-endian) data, Web/P image	1703881FB68F819E538DF89BC7B2C507	EB301CFB4136F393438F73F364FD45EB3371DF0E	BCE768DFFAE945893B27A8FC833993C58E57002EC838BFC676784B7276A097EC
Chrome Cache Entry: 97	ASCII text	A61BAD8B26EF8914546AED6B68CCF7A3	AA77241CCEDDDBCBFB19BA28E07DE8280E1F1CBF	9E06028665131F0A17F015003AC578BA216CE432EB0A6B787A7A1153F4A9721B
Chrome Cache Entry: 99	ASCII text, with very long lines (1245)	90B2EAD7507DE0EB39444E113F72934C	01F88A7C207B9E6278D584AFF2E1392649F8B1ED	25A789FE0F64877FDEFBFCE9239189E6EBB0493B44317F6CEF6DE3609A88FE4A

Windows Analysis Report
https://pckg.ai/X5KpCErF

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://pckg.ai/X5KpCErF

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://pckg.ai/X5KpCErF