Edit tour

Windows Analysis Report
http://ghostbin.cafe24.com/

Overview

General Information

Sample URL:	http://ghostbin.cafe24.com/
Analysis ID:	1582622
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious Javascript

Javascript uses Telegram API

Connects to several IPs in different countries

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

None HTTPS page querying sensitive user data (password, username or email)

Suricata IDS alerts with low severity for network traffic

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4904 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2140 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 --field-trial-handle=2300,i,16461641179892585274,11951433757454360875,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6540 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://ghostbin.cafe24.com/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Suricata Signatures

ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T05:47:27.973084+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	49901	14.128.128.198	443	TCP
2024-12-31T05:47:29.632738+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	49929	14.128.128.198	443	TCP
2024-12-31T05:47:33.731792+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	49966	35.214.136.108	443	TCP
2024-12-31T05:47:34.309070+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	49964	14.128.128.198	443	TCP
2024-12-31T05:47:35.140219+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	49977	104.18.27.193	443	TCP
2024-12-31T05:47:35.356442+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	49973	52.213.253.241	443	TCP
2024-12-31T05:47:35.813026+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	49974	14.128.128.198	443	TCP
2024-12-31T05:47:36.229053+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	49984	52.208.179.93	443	TCP
2024-12-31T05:47:37.707252+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	50009	3.72.38.170	443	TCP

ET EXPLOIT_KIT WindowBase64.atob Function In Edwards Packed JavaScript - Possible iFrame Injection Detected

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T05:47:31.224224+0100	2020605	1	Exploit Kit Activity Detected	203.245.1.130	80	192.168.2.4	49946	TCP
2024-12-31T05:47:33.232788+0100	2020605	1	Exploit Kit Activity Detected	203.245.1.130	80	192.168.2.4	49924	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected suspicious Javascript

Source: 0.16.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: http://ghostbin.cafe24.com/... The script demonstrates high-risk behavior by dynamically loading and executing a remote JavaScript file. This can potentially lead to the execution of malicious code on the user's system. The use of a random query parameter to bypass caching further increases the risk of this being a malicious script.

Javascript uses Telegram API

Source: https://cdn.megadata.co.kr/dist/prod/enp_tracker_cafe24_smart.min.js	HTTP Parser: (()=>{var __webpack_modules__={85914:function(t,e,r){var o;/! https://mths.be/base64 v1.0.0 by @mathias \| mit license /t=r.nmd(t),function(){var a=e,n=(t&&t.exports,"object"==typeof r.g&&r.g);n.global!==n&&n.window;var s=function(t){this.message=t};(s.prototype=new error).name="invalidcharactererror";var i=function(t){throw new s(t)},c="abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789+/",d=/[\t\n\f\r ]/g,l={encode:function(t){t=string(t),/[^\0-\xff]/.test(t)&&i("the string to be encoded contains characters outside of the latin1 range.");for(var e,r,o,a,n=t.length%3,s="",d=-1,l=t.length-n;++d<l;)e=t.charcodeat(d)<<16,r=t.charcodeat(++d)<<8,o=t.charcodeat(++d),s+=c.charat((a=e+r+o)>>18&63)+c.charat(a>>12&63)+c.charat(a>>6&63)+c.charat(63&a);return 2==n?(e=t.charcodeat(d)<<8,r=t.charcodeat(++d),s+=c.charat((a=e+r)>>10)+c.charat(a>>4&63)+c.charat(a<<2&63)+"="):1==n&&(a=t.charcodeat(d),s+=c.charat(a>>2)+c.charat(a<<4&63)+"=="),s},decode:function(t){var e=(t=string(t).replace(d,"")).length;e%4==0&&(...
Source: https://cdn.megadata.co.kr/crm_dist/prod/mobtune_crm_cafe24.min.js	HTTP Parser: !function(t){var n={};function e(r){if(n[r])return n[r].t;var i=n[r]={i:r,o:!1,t:{}};return t[r].call(i.t,i,i.t,e),i.o=!0,i.t}e.u=t,e.c=n,e.d=function(t,n,r){e.s(t,n)\|\|object.defineproperty(t,n,{h:!0,get:r})},e.r=function(t){"undefined"!=typeof symbol&&symbol.tostringtag&&object.defineproperty(t,symbol.tostringtag,{value:"module"}),object.defineproperty(t,"m",{value:!0})},e.l=function(t,n){if(1&n&&(t=e(t)),8&n)return t;if(4&n&&"object"==typeof t&&t&&t.m)return t;var r=object.create(null);if(e.r(r),object.defineproperty(r,"default",{h:!0,value:t}),2&n&&"string"!=typeof t)for(var i in t)e.d(r,i,function(n){return t[n]}.bind(null,i));return r},e.n=function(t){var n=t&&t.m?function(){return t.default}:function(){return t};return e.d(n,"a",n),n},e.s=function(t,n){return object.prototype.hasownproperty.call(t,n)},e.v="",e(e._=60)}([function(t,n,e){"use strict";object.defineproperty(n,"m",{value:!0}),n.p="mobtune_adver_info",function(t){t.cafe24="cafe24",t.makeshop_d2="makeshop_d2",t.makeshop_d4="makeshop_d4",t.firs...