Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Download

phish_alert_sp2_2.0.0.0-1.eml

RFC 822 mail, ASCII text, with very long lines (2221), with CRLF line terminators

initial sample

Details

Filetype:	RFC 822 mail, ASCII text, with very long lines (2221), with CRLF line terminators
Entropy:	6.167475060713191
Filename:	phish_alert_sp2_2.0.0.0-1.eml
Filesize:	68818
MD5:	b678eaad3ffe326c3a5939a3daeb4ed4
SHA1:	09bedcb0a71e8be46e3ce3470d0a374120dd5313
SHA256:	f7d86787429e7370e0d935f5596d3e10c2dd0ce669f1b7f8b4f5316d0a156ef8
SHA512:	df0616651b08e390eca5c44d988698982f5eb22a7b528b55770c1d0750e77fbe3200d0d38b20767450b4a3d7af35025fbb4bc7896efc6eaab8deddbc98c7f780
SSDEEP:	1536:f42j9f10Ab6FGifKiJC5jLUPBn7gG4VlFHkdgCO2zb:f42jd1W1M4BkxVlKdgCO2f
Preview:	Received: from SJ0PR08MB6478.namprd08.prod.outlook.com.. (2603:10b6:a03:2db::17) by CO1PR08MB7189.namprd08.prod.outlook.com with.. HTTPS; Wed, 26 Mar 2025 17:32:33 +0000..Received: from CH2PR15CA0025.namprd15.prod.outlook.com.. (2603:10b6:610:51::35) by S

C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\AppData\Local\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\7256E2A8-0E52-42EC-B21D-288B322E43C6

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\AppData\Local\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\7256E2A8-0E52-42EC-B21D-288B322E43C6
Category:	dropped
Dump:	7256E2A8-0E52-42EC-B21D-288B322E43C6.16.dr
ID:	dr_0
Target ID:	16
Process:	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	5.296461163932723
Encrypted:	false
Size:	180927
Whitelisted:	false

C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxAccountsAlwaysOnLog.etl

data

dropped

Details

File:	C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxAccountsAlwaysOnLog.etl
Category:	dropped
Dump:	HxAccountsAlwaysOnLog.etl.20.dr
ID:	dr_2
Target ID:	20
Process:	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe
Type:	data
Entropy:	0.20647247672794636
Encrypted:	false
Size:	131072
Whitelisted:	false

C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxmAlwaysOnLog.etl

data

dropped

Details

File:	C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxmAlwaysOnLog.etl
Category:	dropped
Dump:	HxmAlwaysOnLog.etl.16.dr
ID:	dr_1
Target ID:	16
Process:	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe
Type:	data
Entropy:	0.1192931438355786
Encrypted:	false
Size:	65536
Whitelisted:	false

URLs

Name

Malicious

https://future.aue.ae/assets/antibot.js

104.22.43.154

https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015

104.16.80.73

Details

Name:	https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
IP:	104.16.80.73
TargetID:	6
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

https://future.aue.ae/favicon.ico

104.22.43.154

https://future.aue.ae/cdn-cgi/rum?

104.22.43.154

https://future.aue.ae/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

104.22.43.154

Details

Name:	https://future.aue.ae/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
IP:	104.22.43.154
TargetID:	6
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

https://future.aue.ae/wp-includes/images/w-logo-blue-white-bg.png

104.22.43.154

Details

Name:	https://future.aue.ae/wp-includes/images/w-logo-blue-white-bg.png
IP:	104.22.43.154
TargetID:	6
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Domains

Name

Malicious

knitlonger.tuopuwujin.com

172.64.80.1

Details

Name:	knitlonger.tuopuwujin.com
IP:	172.64.80.1
TargetID:	6
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
AI detected suspicious elements in Email content	Phishing	Browser Extensions
Detected suspicious crossdomain redirect	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection
Uses secure TLS version for HTTPS connections	Compliance, Networking

static.cloudflareinsights.com

104.16.80.73

Details

Name:	static.cloudflareinsights.com
IP:	104.16.80.73
TargetID:	6
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Uses secure TLS version for HTTPS connections	Compliance, Networking

nam04.safelinks.eop-tm2.outlook.com

104.47.74.28

future.aue.ae

104.22.43.154

Details

Name:	future.aue.ae
IP:	104.22.43.154
TargetID:	6
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Detected suspicious crossdomain redirect	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Uses secure TLS version for HTTPS connections	Compliance, Networking

www.google.com

142.251.40.228

Details

Name:	www.google.com
IP:	142.251.40.228
TargetID:	6
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Uses secure TLS version for HTTPS connections	Compliance, Networking

s-0005.dual-s-dc-msedge.net

52.123.131.14

nam04.safelinks.protection.outlook.com

unknown

Details

Name:	nam04.safelinks.protection.outlook.com
TargetID:	24
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Detected suspicious crossdomain redirect	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

IPs

Domain

Country

Malicious

172.64.80.1

knitlonger.tuopuwujin.com

United States

142.250.80.35

unknown

United States

104.22.42.154

unknown

United States

23.57.90.112

unknown

United States

192.168.2.16

unknown

142.251.40.228

www.google.com

United States

104.47.73.28

unknown

United States

13.107.42.16

unknown

United States

104.47.74.28

nam04.safelinks.eop-tm2.outlook.com

United States

104.16.80.73

static.cloudflareinsights.com

United States

23.9.183.29

unknown

United States

142.250.81.238

unknown

United States

142.251.167.84

unknown

United States

20.42.73.28

unknown

United States

104.22.43.154

future.aue.ae

United States

52.123.131.14

s-0005.dual-s-dc-msedge.net

United States

52.111.227.28

unknown

United States

52.109.0.91

unknown

United States

There are 8 hidden IPs, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
phish_alert_sp2_2.0.0.0-1.eml

Files

URLs

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportphish_alert_sp2_2.0.0.0-1.eml

Files

URLs

Domains

IPs

IOC Report
phish_alert_sp2_2.0.0.0-1.eml