Windows Analysis Report
https://spamchallenge.msftemail.com/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3cUlvcXhnRlhWaFBaSDJIMnMyYVN0MGpGNGN3c0Q1NE0xMUpGT3JuT2xOaVZKczlQL2VBWE9sa0pRN2VuUERVTlFWMkdmNjZoUlV4SGhDaFJQR2RQNGg2UVRmaUNIVFM2cVl4WXBaTTNCMTg4eS9XU1RyNEJ1R2VsdVdPN0JBaWZtUWRWb25EN3pIdkgyNGRYaHhjRHFWNnJ6NWFuREk4N3Q5WmdUOXI

Overview

General Information

Sample URL:	https://spamchallenge.msftemail.com/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3cUlvcXhnRlhWaFBaSDJIMnMyYVN0MGpGNGN3c0Q1NE0xMUpGT3JuT2xOaVZKczlQL2VBWE9sa0pRN2VuUERVTlFWMkdmNjZoUlV4SGhDaFJQR2RQNGg2UVRmaUN
Analysis ID:	1580112
Infos:

Detection

HTMLPhisher, KnowBe4

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Yara detected HtmlPhish10

Yara detected KnowBe4 simulated phishing

HTML body contains low number of good links

No HTML title found

Classification

Signatures

AV Detection

Antivirus detection for URL or domain

Source: https://oops.yourgunnalovetraining.com/pages/377bd84051ec/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3c	Avira URL Cloud: Label: phishing
Source: https://oops.yourgunnalovetraining.com/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js	Avira URL Cloud: Label: malware
Source: https://oops.yourgunnalovetraining.com/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css	Avira URL Cloud: Label: malware
Source: https://oops.yourgunnalovetraining.com/favicon.ico	Avira URL Cloud: Label: malware

Phishing

Yara detected HtmlPhish10

Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: 2.1.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_54, type: DROPPED

Yara detected KnowBe4 simulated phishing

Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: 2.1.pages.csv, type: HTML

HTML body contains low number of good links

Source: https://oops.yourgunnalovetraining.com/pages/377bd84051ec/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3cUlvcXhnRlhWaFBaSDJIMnMyYVN0MGpGNGN3c0Q1NE0xMUpGT3JuT2xOaVZKczlQL2VBWE9sa0pRN2VuUERVTlFWMkdmNjZoUlV4SGhDaFJQR2RQNGg2UVRmaUNIVFM2cVl4WXBaTTNCMTg4eS9XU1RyNEJ1R2VsdVdPN0JBaWZtUWRWb25EN3pIdkgyNGRYaHhjRHFWNnJ6NWFuREk4N3Q5WmdUOXIwNFYxeDA9LS1FQ0krTzhnQnV6bDJBd2tOLS1vZDl3bzRPTTR5Nk4wandOR3dTZDd3PT0=

HTTP Parser: Number of links: 0

No HTML title found

HTTP Parser: HTML title missing

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

HTTP Parser: No <meta name="author".. found

HTTP Parser: No <meta name="copyright".. found

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3cUlvcXhnRlhWaFBaSDJIMnMyYVN0MGpGNGN3c0Q1NE0xMUpGT3JuT2xOaVZKczlQL2VBWE9sa0pRN2VuUERVTlFWMkdmNjZoUlV4SGhDaFJQR2RQNGg2UVRmaUNIVFM2cVl4WXBaTTNCMTg4eS9XU1RyNEJ1R2VsdVdPN0JBaWZtUWRWb25EN3pIdkgyNGRYaHhjRHFWNnJ6NWFuREk4N3Q5WmdUOXIwNFYxeDA9LS1FQ0krTzhnQnV6bDJBd2tOLS1vZDl3bzRPTTR5Nk4wandOR3dTZDd3PT0=?cid=2315281580 HTTP/1.1Host: spamchallenge.msftemail.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pages/377bd84051ec/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3cUlvcXhnRlhWaFBaSDJIMnMyYVN0MGpGNGN3c0Q1NE0xMUpGT3JuT2xOaVZKczlQL2VBWE9sa0pRN2VuUERVTlFWMkdmNjZoUlV4SGhDaFJQR2RQNGg2UVRmaUNIVFM2cVl4WXBaTTNCMTg4eS9XU1RyNEJ1R2VsdVdPN0JBaWZtUWRWb25EN3pIdkgyNGRYaHhjRHFWNnJ6NWFuREk4N3Q5WmdUOXIwNFYxeDA9LS1FQ0krTzhnQnV6bDJBd2tOLS1vZDl3bzRPTTR5Nk4wandOR3dTZDd3PT0= HTTP/1.1Host: oops.yourgunnalovetraining.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://spamchallenge.msftemail.com/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3cUlvcXhnRlhWaFBaSDJIMnMyYVN0MGpGNGN3c0Q1NE0xMUpGT3JuT2xOaVZKczlQL2VBWE9sa0pRN2VuUERVTlFWMkdmNjZoUlV4SGhDaFJQR2RQNGg2UVRmaUNIVFM2cVl4WXBaTTNCMTg4eS9XU1RyNEJ1R2VsdVdPN0JBaWZtUWRWb25EN3pIdkgyNGRYaHhjRHFWNnJ6NWFuREk4N3Q5WmdUOXIwNFYxeDA9LS1FQ0krTzhnQnV6bDJBd2tOLS1vZDl3bzRPTTR5Nk4wandOR3dTZDd3PT0=?cid=2315281580Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1Host: oops.yourgunnalovetraining.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://oops.yourgunnalovetraining.com/pages/377bd84051ec/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3cUlvcXhnRlhWaFBaSDJIMnMyYVN0MGpGNGN3c0Q1NE0xMUpGT3JuT2xOaVZKczlQL2VBWE9sa0pRN2VuUERVTlFWMkdmNjZoUlV4SGhDaFJQR2RQNGg2UVRmaUNIVFM2cVl4WXBaTTNCMTg4eS9XU1RyNEJ1R2VsdVdPN0JBaWZtUWRWb25EN3pIdkgyNGRYaHhjRHFWNnJ6NWFuREk4N3Q5WmdUOXIwNFYxeDA9LS1FQ0krTzhnQnV6bDJBd2tOLS1vZDl3bzRPTTR5Nk4wandOR3dTZDd3PT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: oops.yourgunnalovetraining.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oops.yourgunnalovetraining.com/pages/377bd84051ec/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3cUlvcXhnRlhWaFBaSDJIMnMyYVN0MGpGNGN3c0Q1NE0xMUpGT3JuT2xOaVZKczlQL2VBWE9sa0pRN2VuUERVTlFWMkdmNjZoUlV4SGhDaFJQR2RQNGg2UVRmaUNIVFM2cVl4WXBaTTNCMTg4eS9XU1RyNEJ1R2VsdVdPN0JBaWZtUWRWb25EN3pIdkgyNGRYaHhjRHFWNnJ6NWFuREk4N3Q5WmdUOXIwNFYxeDA9LS1FQ0krTzhnQnV6bDJBd2tOLS1vZDl3bzRPTTR5Nk4wandOR3dTZDd3PT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: oops.yourgunnalovetraining.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: oops.yourgunnalovetraining.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://oops.yourgunnalovetraining.com/pages/377bd84051ec/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3cUlvcXhnRlhWaFBaSDJIMnMyYVN0MGpGNGN3c0Q1NE0xMUpGT3JuT2xOaVZKczlQL2VBWE9sa0pRN2VuUERVTlFWMkdmNjZoUlV4SGhDaFJQR2RQNGg2UVRmaUNIVFM2cVl4WXBaTTNCMTg4eS9XU1RyNEJ1R2VsdVdPN0JBaWZtUWRWb25EN3pIdkgyNGRYaHhjRHFWNnJ6NWFuREk4N3Q5WmdUOXIwNFYxeDA9LS1FQ0krTzhnQnV6bDJBd2tOLS1vZDl3bzRPTTR5Nk4wandOR3dTZDd3PT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: oops.yourgunnalovetraining.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: spamchallenge.msftemail.com
Source: global traffic	DNS traffic detected: DNS query: oops.yourgunnalovetraining.com
Source: global traffic	DNS traffic detected: DNS query: use.typekit.net
Source: global traffic	DNS traffic detected: DNS query: img.freepik.com
Source: global traffic	DNS traffic detected: DNS query: p.typekit.net

Source: chromecache_54.2.dr	String found in binary or memory: http://ajax.googleapis.com/ajax/libs/jquery/1/jquery.min.js
Source: chromecache_60.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735b977
Source: chromecache_60.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735b97e
Source: chromecache_60.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735b97f
Source: chromecache_60.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735b984
Source: chromecache_60.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735b988
Source: chromecache_60.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735b995
Source: chromecache_60.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735b998
Source: chromecache_60.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735b99c
Source: chromecache_54.2.dr	String found in binary or memory: https://img.freepik.com/premium-photo/business-woman-ceo-standing-office-arms-crossed-pose_146508-65
Source: chromecache_50.2.dr	String found in binary or memory: https://oops.yourgunnalovetraining.com/pages/377bd84051ec/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3c
Source: chromecache_60.2.dr	String found in binary or memory: https://p.typekit.net/p.css?s=1&k=zhs8hwa&ht=tk&f=40407.40409.40411.40415.40522.40523.40528.40529&a=
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/5205f7/00000000000000007735b998/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/5205f7/00000000000000007735b998/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/5205f7/00000000000000007735b998/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/52b15f/00000000000000007735b977/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/52b15f/00000000000000007735b977/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/52b15f/00000000000000007735b977/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/6b07ca/00000000000000007735b99c/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/6b07ca/00000000000000007735b99c/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/6b07ca/00000000000000007735b99c/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/74b049/00000000000000007735b97f/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/74b049/00000000000000007735b97f/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/74b049/00000000000000007735b97f/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/9edcf7/00000000000000007735b988/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/9edcf7/00000000000000007735b988/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/9edcf7/00000000000000007735b988/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/b43e5b/00000000000000007735b984/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/b43e5b/00000000000000007735b984/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/b43e5b/00000000000000007735b984/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/dde969/00000000000000007735b995/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/dde969/00000000000000007735b995/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/dde969/00000000000000007735b995/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/f23782/00000000000000007735b97e/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/f23782/00000000000000007735b97e/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/f23782/00000000000000007735b97e/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_54.2.dr	String found in binary or memory: https://use.typekit.net/zhs8hwa.css

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: classification engine

Classification label: mal64.phis.win@17/22@16/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=1988,i,6699881340216569343,6692458490416922373,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://spamchallenge.msftemail.com/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3cUlvcXhnRlhWaFBaSDJIMnMyYVN0MGpGNGN3c0Q1NE0xMUpGT3JuT2xOaVZKczlQL2VBWE9sa0pRN2VuUERVTlFWMkdmNjZoUlV4SGhDaFJQR2RQNGg2UVRmaUNIVFM2cVl4WXBaTTNCMTg4eS9XU1RyNEJ1R2VsdVdPN0JBaWZtUWRWb25EN3pIdkgyNGRYaHhjRHFWNnJ6NWFuREk4N3Q5WmdUOXIwNFYxeDA9LS1FQ0krTzhnQnV6bDJBd2tOLS1vZDl3bzRPTTR5Nk4wandOR3dTZDd3PT0=?cid=2315281580"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=1988,i,6699881340216569343,6692458490416922373,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.165.133.35	oops.yourgunnalovetraining.com	United States	14618	AMAZON-AESUS	false
3.224.166.12	landing.training.knowbe4.com	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
216.58.208.228	www.google.com	United States	15169	GOOGLEUS	false
34.195.197.181	unknown	United States	14618	AMAZON-AESUS	false

Private

IP
192.168.2.4

Contacted Domains

Name	IP	Active
oops.yourgunnalovetraining.com	54.165.133.35	true
www.google.com	216.58.208.228	true
landing.training.knowbe4.com	3.224.166.12	true
use.typekit.net	unknown	unknown
p.typekit.net	unknown	unknown
img.freepik.com	unknown	unknown
spamchallenge.msftemail.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://spamchallenge.msftemail.com/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3cUlvcXhnRlhWaFBaSDJIMnMyYVN0MGpGNGN3c0Q1NE0xMUpGT3JuT2xOaVZKczlQL2VBWE9sa0pRN2VuUERVTlFWMkdmNjZoUlV4SGhDaFJQR2RQNGg2UVRmaUNIVFM2cVl4WXBaTTNCMTg4eS9XU1RyNEJ1R2VsdVdPN0JBaWZtUWRWb25EN3pIdkgyNGRYaHhjRHFWNnJ6NWFuREk4N3Q5WmdUOXIwNFYxeDA9LS1FQ0krTzhnQnV6bDJBd2tOLS1vZDl3bzRPTTR5Nk4wandOR3dTZDd3PT0=?cid=2315281580	false		high
https://oops.yourgunnalovetraining.com/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js	false	Avira URL Cloud: malware	unknown
https://oops.yourgunnalovetraining.com/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css	false	Avira URL Cloud: malware	unknown
https://oops.yourgunnalovetraining.com/favicon.ico	false	Avira URL Cloud: malware	unknown
https://oops.yourgunnalovetraining.com/pages/377bd84051ec/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3cUlvcXhnRlhWaFBaSDJIMnMyYVN0MGpGNGN3c0Q1NE0xMUpGT3JuT2xOaVZKczlQL2VBWE9sa0pRN2VuUERVTlFWMkdmNjZoUlV4SGhDaFJQR2RQNGg2UVRmaUNIVFM2cVl4WXBaTTNCMTg4eS9XU1RyNEJ1R2VsdVdPN0JBaWZtUWRWb25EN3pIdkgyNGRYaHhjRHFWNnJ6NWFuREk4N3Q5WmdUOXIwNFYxeDA9LS1FQ0krTzhnQnV6bDJBd2tOLS1vZDl3bzRPTTR5Nk4wandOR3dTZDd3PT0=#	false		unknown
https://oops.yourgunnalovetraining.com/pages/377bd84051ec/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3cUlvcXhnRlhWaFBaSDJIMnMyYVN0MGpGNGN3c0Q1NE0xMUpGT3JuT2xOaVZKczlQL2VBWE9sa0pRN2VuUERVTlFWMkdmNjZoUlV4SGhDaFJQR2RQNGg2UVRmaUNIVFM2cVl4WXBaTTNCMTg4eS9XU1RyNEJ1R2VsdVdPN0JBaWZtUWRWb25EN3pIdkgyNGRYaHhjRHFWNnJ6NWFuREk4N3Q5WmdUOXIwNFYxeDA9LS1FQ0krTzhnQnV6bDJBd2tOLS1vZDl3bzRPTTR5Nk4wandOR3dTZDd3PT0=	false		unknown

Name	Type	MD5	SHA1	SHA256
Chrome Cache Entry: 49	ASCII text, with very long lines (65447)	67A0C4DBD69561F3226243034423F1ED	88C1B5C7EBBFA24D8196290206BF544F28EEB406	74B9F1CFE7CAD31AE1C1901200890B76676E6D92AC817641F5EF9BFD552F2110
Chrome Cache Entry: 50	HTML document, ASCII text, with very long lines (440)	9CE5C4386C2ED281497D2F47F46BC8EB	C0761D12E7E3F65A5F0B6E9AA9D7A367DCF20CBC	40835A67F327D233FBEEBE744547425A9E666C2463B4E7F38F64A20177D2B429
Chrome Cache Entry: 51	ISO Media, AVIF Image	53CF2536C148E6CE8A94D3D12645CE85	9700FE1C7C392E71B5099672509F583F82FCE2D1	4A71D66CAAE38401807025E8F49E7E17E0B389443D4ADA842A94758A6AE00FB1
Chrome Cache Entry: 52	ASCII text, with no line terminators	4C42AB4890733A2B01B1B3269C4855E7	5B68BFE664DCBC629042EA45C23954EEF1A9F698	F69E8FC1414A82F108CFA0725E5211AF1865A9CEA342A5F01E6B2B5ABE47E010
Chrome Cache Entry: 53	Web Open Font Format (Version 2), TrueType, length 19528, version 1.0	A4A77ECD30A02C05F455E5D63A8D9916	28263E31416C42052D753BE314422F808609F762	9D9EA9CEB3C34A236A9D39BBED407519F00880DDD310376BCC723E58A2301127
Chrome Cache Entry: 54	HTML document, ASCII text, with very long lines (560)	CBFA9E32254C723FEFC5CE72279E6D67	0692580B92D8ADB466A23B561DDCCBBC60186470	4E336D7D6F61D9C94C96DB59073F6FCA0A8A80F2C79E68D6E7BA8946532C69B9
Chrome Cache Entry: 55	ASCII text, with very long lines (65447)	67A0C4DBD69561F3226243034423F1ED	88C1B5C7EBBFA24D8196290206BF544F28EEB406	74B9F1CFE7CAD31AE1C1901200890B76676E6D92AC817641F5EF9BFD552F2110
Chrome Cache Entry: 56	ASCII text	83D24D4B43CC7EEF2B61E66C95F3D158	F0CAFC285EE23BB6C28C5166F305493C4331C84D	1C0FF118A4290C99F39C90ABB38703A866E47251B23CCA20266C69C812CCAFEB
Chrome Cache Entry: 57	ASCII text	15E89F9684B18EC43EE51F8D62A787C3	9CBAAACEAE96845ECD3497F41EE3B02588ABEC11	16F13E16A7EF02FB6F94250AA1931DED83DBEE5D9FAD278E33DD5792D085194F
Chrome Cache Entry: 58	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 626x417, components 3	8708552A02FF3B31F0BC291641E5EB7D	2C275CABD85A1C73E40828CB80358560839CCB15	8BC4E19A9EA18ED008B99170D3F92C8207B652FCB1C4D5713B04797E0C51294D
Chrome Cache Entry: 59	Web Open Font Format (Version 2), TrueType, length 19404, version 1.0	9298BF244BBB18C05A10A477073D87B0	5CF95B591A337FCC8B94A0887C8818419444E6B6	FF93863C00AC954D1E4925EF871CAAC849093A4BAB1F612CB7B3D39D68F7D673
Chrome Cache Entry: 60	Unicode text, UTF-8 text, with very long lines (516)	216F0CE7EE923D5D0736930AAE6E0683	6964818F4192E155AD9565A25A9A9F7B5CA8D4F3	1AEF5FBC25BFAE6C53991092A487AC5B977F886901C30CC1999B18E9F32CEC07

AV Detection

Antivirus detection for URL or domain

Source: https://oops.yourgunnalovetraining.com/pages/377bd84051ec/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3c	Avira URL Cloud: Label: phishing
Source: https://oops.yourgunnalovetraining.com/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js	Avira URL Cloud: Label: malware
Source: https://oops.yourgunnalovetraining.com/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css	Avira URL Cloud: Label: malware
Source: https://oops.yourgunnalovetraining.com/favicon.ico	Avira URL Cloud: Label: malware

Phishing

Yara detected HtmlPhish10

Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: 2.1.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_54, type: DROPPED

Yara detected KnowBe4 simulated phishing

Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: 2.1.pages.csv, type: HTML

HTML body contains low number of good links

HTTP Parser: Number of links: 0

No HTML title found

HTTP Parser: HTML title missing

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

HTTP Parser: No <meta name="author".. found

HTTP Parser: No <meta name="copyright".. found

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3cUlvcXhnRlhWaFBaSDJIMnMyYVN0MGpGNGN3c0Q1NE0xMUpGT3JuT2xOaVZKczlQL2VBWE9sa0pRN2VuUERVTlFWMkdmNjZoUlV4SGhDaFJQR2RQNGg2UVRmaUNIVFM2cVl4WXBaTTNCMTg4eS9XU1RyNEJ1R2VsdVdPN0JBaWZtUWRWb25EN3pIdkgyNGRYaHhjRHFWNnJ6NWFuREk4N3Q5WmdUOXIwNFYxeDA9LS1FQ0krTzhnQnV6bDJBd2tOLS1vZDl3bzRPTTR5Nk4wandOR3dTZDd3PT0=?cid=2315281580 HTTP/1.1Host: spamchallenge.msftemail.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pages/377bd84051ec/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3cUlvcXhnRlhWaFBaSDJIMnMyYVN0MGpGNGN3c0Q1NE0xMUpGT3JuT2xOaVZKczlQL2VBWE9sa0pRN2VuUERVTlFWMkdmNjZoUlV4SGhDaFJQR2RQNGg2UVRmaUNIVFM2cVl4WXBaTTNCMTg4eS9XU1RyNEJ1R2VsdVdPN0JBaWZtUWRWb25EN3pIdkgyNGRYaHhjRHFWNnJ6NWFuREk4N3Q5WmdUOXIwNFYxeDA9LS1FQ0krTzhnQnV6bDJBd2tOLS1vZDl3bzRPTTR5Nk4wandOR3dTZDd3PT0= HTTP/1.1Host: oops.yourgunnalovetraining.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://spamchallenge.msftemail.com/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3cUlvcXhnRlhWaFBaSDJIMnMyYVN0MGpGNGN3c0Q1NE0xMUpGT3JuT2xOaVZKczlQL2VBWE9sa0pRN2VuUERVTlFWMkdmNjZoUlV4SGhDaFJQR2RQNGg2UVRmaUNIVFM2cVl4WXBaTTNCMTg4eS9XU1RyNEJ1R2VsdVdPN0JBaWZtUWRWb25EN3pIdkgyNGRYaHhjRHFWNnJ6NWFuREk4N3Q5WmdUOXIwNFYxeDA9LS1FQ0krTzhnQnV6bDJBd2tOLS1vZDl3bzRPTTR5Nk4wandOR3dTZDd3PT0=?cid=2315281580Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1Host: oops.yourgunnalovetraining.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://oops.yourgunnalovetraining.com/pages/377bd84051ec/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3cUlvcXhnRlhWaFBaSDJIMnMyYVN0MGpGNGN3c0Q1NE0xMUpGT3JuT2xOaVZKczlQL2VBWE9sa0pRN2VuUERVTlFWMkdmNjZoUlV4SGhDaFJQR2RQNGg2UVRmaUNIVFM2cVl4WXBaTTNCMTg4eS9XU1RyNEJ1R2VsdVdPN0JBaWZtUWRWb25EN3pIdkgyNGRYaHhjRHFWNnJ6NWFuREk4N3Q5WmdUOXIwNFYxeDA9LS1FQ0krTzhnQnV6bDJBd2tOLS1vZDl3bzRPTTR5Nk4wandOR3dTZDd3PT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: oops.yourgunnalovetraining.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oops.yourgunnalovetraining.com/pages/377bd84051ec/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3cUlvcXhnRlhWaFBaSDJIMnMyYVN0MGpGNGN3c0Q1NE0xMUpGT3JuT2xOaVZKczlQL2VBWE9sa0pRN2VuUERVTlFWMkdmNjZoUlV4SGhDaFJQR2RQNGg2UVRmaUNIVFM2cVl4WXBaTTNCMTg4eS9XU1RyNEJ1R2VsdVdPN0JBaWZtUWRWb25EN3pIdkgyNGRYaHhjRHFWNnJ6NWFuREk4N3Q5WmdUOXIwNFYxeDA9LS1FQ0krTzhnQnV6bDJBd2tOLS1vZDl3bzRPTTR5Nk4wandOR3dTZDd3PT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: oops.yourgunnalovetraining.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: oops.yourgunnalovetraining.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://oops.yourgunnalovetraining.com/pages/377bd84051ec/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3cUlvcXhnRlhWaFBaSDJIMnMyYVN0MGpGNGN3c0Q1NE0xMUpGT3JuT2xOaVZKczlQL2VBWE9sa0pRN2VuUERVTlFWMkdmNjZoUlV4SGhDaFJQR2RQNGg2UVRmaUNIVFM2cVl4WXBaTTNCMTg4eS9XU1RyNEJ1R2VsdVdPN0JBaWZtUWRWb25EN3pIdkgyNGRYaHhjRHFWNnJ6NWFuREk4N3Q5WmdUOXIwNFYxeDA9LS1FQ0krTzhnQnV6bDJBd2tOLS1vZDl3bzRPTTR5Nk4wandOR3dTZDd3PT0=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: oops.yourgunnalovetraining.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: spamchallenge.msftemail.com
Source: global traffic	DNS traffic detected: DNS query: oops.yourgunnalovetraining.com
Source: global traffic	DNS traffic detected: DNS query: use.typekit.net
Source: global traffic	DNS traffic detected: DNS query: img.freepik.com
Source: global traffic	DNS traffic detected: DNS query: p.typekit.net

Source: chromecache_54.2.dr	String found in binary or memory: http://ajax.googleapis.com/ajax/libs/jquery/1/jquery.min.js
Source: chromecache_60.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735b977
Source: chromecache_60.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735b97e
Source: chromecache_60.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735b97f
Source: chromecache_60.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735b984
Source: chromecache_60.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735b988
Source: chromecache_60.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735b995
Source: chromecache_60.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735b998
Source: chromecache_60.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735b99c
Source: chromecache_54.2.dr	String found in binary or memory: https://img.freepik.com/premium-photo/business-woman-ceo-standing-office-arms-crossed-pose_146508-65
Source: chromecache_50.2.dr	String found in binary or memory: https://oops.yourgunnalovetraining.com/pages/377bd84051ec/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3c
Source: chromecache_60.2.dr	String found in binary or memory: https://p.typekit.net/p.css?s=1&k=zhs8hwa&ht=tk&f=40407.40409.40411.40415.40522.40523.40528.40529&a=
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/5205f7/00000000000000007735b998/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/5205f7/00000000000000007735b998/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/5205f7/00000000000000007735b998/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/52b15f/00000000000000007735b977/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/52b15f/00000000000000007735b977/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/52b15f/00000000000000007735b977/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/6b07ca/00000000000000007735b99c/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/6b07ca/00000000000000007735b99c/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/6b07ca/00000000000000007735b99c/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/74b049/00000000000000007735b97f/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/74b049/00000000000000007735b97f/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/74b049/00000000000000007735b97f/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/9edcf7/00000000000000007735b988/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/9edcf7/00000000000000007735b988/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/9edcf7/00000000000000007735b988/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/b43e5b/00000000000000007735b984/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/b43e5b/00000000000000007735b984/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/b43e5b/00000000000000007735b984/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/dde969/00000000000000007735b995/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/dde969/00000000000000007735b995/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/dde969/00000000000000007735b995/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/f23782/00000000000000007735b97e/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/f23782/00000000000000007735b97e/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_60.2.dr	String found in binary or memory: https://use.typekit.net/af/f23782/00000000000000007735b97e/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_54.2.dr	String found in binary or memory: https://use.typekit.net/zhs8hwa.css

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: classification engine

Classification label: mal64.phis.win@17/22@16/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=1988,i,6699881340216569343,6692458490416922373,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://spamchallenge.msftemail.com/XdEd3bDVBUzZOQUwzUmxzRWVLU3huK0JqbXFtZHA3cUlvcXhnRlhWaFBaSDJIMnMyYVN0MGpGNGN3c0Q1NE0xMUpGT3JuT2xOaVZKczlQL2VBWE9sa0pRN2VuUERVTlFWMkdmNjZoUlV4SGhDaFJQR2RQNGg2UVRmaUNIVFM2cVl4WXBaTTNCMTg4eS9XU1RyNEJ1R2VsdVdPN0JBaWZtUWRWb25EN3pIdkgyNGRYaHhjRHFWNnJ6NWFuREk4N3Q5WmdUOXIwNFYxeDA9LS1FQ0krTzhnQnV6bDJBd2tOLS1vZDl3bzRPTTR5Nk4wandOR3dTZDd3PT0=?cid=2315281580"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=1988,i,6699881340216569343,6692458490416922373,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

ID:	1580112
Product:	CloudBasic
Start time:	00:20:16
Start date:	24.12.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs