Analysis Report https://www.amazon.co.uk/gp/r.html?C=SVULMK1YZBEX&M=urn:rtn:msg:20210405031457899c6af757194d7cb466ffbe44f0p0eu&R=3DUSOE0YLT886&T=C&U=http%3A%2F%2Fwww.amazon.co.uk&H=6XJAFDSABE9H7TDSRPDMTPJNJVYA

Overview

General Information

Sample URL: https://www.amazon.co.uk/gp/r.html?C=SVULMK1YZBEX&M=urn:rtn:msg:20210405031457899c6af757194d7cb466ffbe44f0p0eu&R=3DUSOE0YLT886&T=C&U=http%3A%2F%2Fwww.amazon.co.uk&H=6XJAFDSABE9H7TDSRPDMTPJNJVYA
Analysis ID: 382629
Infos:

Most interesting Screenshot:

Detection

Score: 0
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

No high impact signatures.

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

There are no high impact signatures.

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 13.32.29.79:443 -> 192.168.2.3:49693 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.32.29.79:443 -> 192.168.2.3:49694 version: TLS 1.2
Source: unknown HTTPS traffic detected: 65.9.65.211:443 -> 192.168.2.3:49695 version: TLS 1.2
Source: unknown HTTPS traffic detected: 65.9.65.211:443 -> 192.168.2.3:49696 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.16:443 -> 192.168.2.3:49699 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.16:443 -> 192.168.2.3:49700 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.48.219.205:443 -> 192.168.2.3:49697 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.48.219.205:443 -> 192.168.2.3:49698 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.32.29.79:443 -> 192.168.2.3:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 65.9.65.211:443 -> 192.168.2.3:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 65.9.65.211:443 -> 192.168.2.3:49717 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.181.18.61:443 -> 192.168.2.3:49719 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.181.18.61:443 -> 192.168.2.3:49718 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.239.35.28:443 -> 192.168.2.3:49720 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.95.123.241:443 -> 192.168.2.3:49721 version: TLS 1.2
Source: 41eF0jJqsmL._RC_71oUy0QR4mL.js,61bGBFWLvlL.js,41W9ohA0e+L.js,11nffi0GnAL.js,21cmvUGs-3L.js,11k47yUMOjL.js,41SZNgvX4oL.js,51pktuVkksL.js,31qkpNdCLUL.js,01KW1GJCT1L.js,31PkUbXQSXL.js_[1].js.3.dr String found in binary or memory: activate:"onclick",width:530},B=function(){d.hide();A.hide();t.hide()},D={facebook:{server:"//www.facebook.com",template:"/share.php?u\x3d__FULLURL__"},twitter:{server:"https://twitter.com",template:"/intent/tweet?original_referer\x3d__FULLURL__\x26text\x3d__DESCRIPTION__\x26related\x3d__RELATEDACCOUNTS__\x26url\x3d__SHORTURL__\x26via\x3d__VIA__",relatedAccounts:"amazondeals,amazonmp3"},ameba:{server:"https://blog.ameba.jp",template:"/ucs/entry/srventryinsertinput.do?entry_text\x3d__HTMLTAG__"},goo:{server:"https://blog.goo.ne.jp", equals www.facebook.com (Facebook)
Source: 41eF0jJqsmL._RC_71oUy0QR4mL.js,61bGBFWLvlL.js,41W9ohA0e+L.js,11nffi0GnAL.js,21cmvUGs-3L.js,11k47yUMOjL.js,41SZNgvX4oL.js,51pktuVkksL.js,31qkpNdCLUL.js,01KW1GJCT1L.js,31PkUbXQSXL.js_[1].js.3.dr String found in binary or memory: activate:"onclick",width:530},B=function(){d.hide();A.hide();t.hide()},D={facebook:{server:"//www.facebook.com",template:"/share.php?u\x3d__FULLURL__"},twitter:{server:"https://twitter.com",template:"/intent/tweet?original_referer\x3d__FULLURL__\x26text\x3d__DESCRIPTION__\x26related\x3d__RELATEDACCOUNTS__\x26url\x3d__SHORTURL__\x26via\x3d__VIA__",relatedAccounts:"amazondeals,amazonmp3"},ameba:{server:"https://blog.ameba.jp",template:"/ucs/entry/srventryinsertinput.do?entry_text\x3d__HTMLTAG__"},goo:{server:"https://blog.goo.ne.jp", equals www.twitter.com (Twitter)
Source: unknown DNS traffic detected: queries for: www.amazon.co.uk
Source: XPEZBV78.js.3.dr String found in binary or memory: http://jquery.com/
Source: XPEZBV78.js.3.dr String found in binary or memory: http://jquery.org/license
Source: XPEZBV78.js.3.dr String found in binary or memory: http://sizzlejs.com/
Source: N4KOD6ZY.htm.3.dr String found in binary or memory: https://affiliate-program.amazon.co.uk/gp/advertising/api/detail/main.html/ref=rm_c_ac
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://amazoncustomerservice.d2.sc.omtrdc.net/b/ss/acsuk-prod/1/H.25.2--NS/0
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://authorcentral.amazon.co.uk/
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://authorcentral.amazon.co.uk/gp/help?topicID=200649520
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://aws.amazon.com/what-is-cloud-computing/?sc_channel=EL&sc_campaign=UK_amazonfooter
Source: 41eF0jJqsmL._RC_71oUy0QR4mL.js,61bGBFWLvlL.js,41W9ohA0e+L.js,11nffi0GnAL.js,21cmvUGs-3L.js,11k47yUMOjL.js,41SZNgvX4oL.js,51pktuVkksL.js,31qkpNdCLUL.js,01KW1GJCT1L.js,31PkUbXQSXL.js_[1].js.3.dr String found in binary or memory: https://blog.ameba.jp
Source: 41eF0jJqsmL._RC_71oUy0QR4mL.js,61bGBFWLvlL.js,41W9ohA0e+L.js,11nffi0GnAL.js,21cmvUGs-3L.js,11k47yUMOjL.js,41SZNgvX4oL.js,51pktuVkksL.js,31qkpNdCLUL.js,01KW1GJCT1L.js,31PkUbXQSXL.js_[1].js.3.dr String found in binary or memory: https://blog.goo.ne.jp
Source: 41eF0jJqsmL._RC_71oUy0QR4mL.js,61bGBFWLvlL.js,41W9ohA0e+L.js,11nffi0GnAL.js,21cmvUGs-3L.js,11k47yUMOjL.js,41SZNgvX4oL.js,51pktuVkksL.js,31qkpNdCLUL.js,01KW1GJCT1L.js,31PkUbXQSXL.js_[1].js.3.dr String found in binary or memory: https://blog.hatena.ne.jp
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://brandservices.amazon.co.uk/
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://cnpd.public.lu/fr.html
Source: N4KOD6ZY.htm.3.dr String found in binary or memory: https://developer.amazonservices.co.uk/gp/mws/api.html/276-5247872-0590350?ie=UTF8&section=subscript
Source: N4KOD6ZY.htm.3.dr String found in binary or memory: https://developer.amazonservices.co.uk/ref=rm_c_sv
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://ec.europa.eu/consumers/odr
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://feedback-form.truste.com/watchdog/request.
Source: N4KOD6ZY.htm.3.dr String found in binary or memory: https://fls-eu.amaz
Source: N4KOD6ZY.htm.3.dr String found in binary or memory: https://fls-eu.amazon.co.uk/1/oc-csi/1/OP/requestId=DA1HTJEVC5HAZ0262QFD&js=0
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://ico.org.uk/
Source: N4KOD6ZY.htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/G/01/csminstrumentation/
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/G/02/Recommendations/MissionExperience/BIA/bia-atc-co
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/G/02/digital/video/AIV/SWMtest/SWM_400x39_new_style_F
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/G/02/gno/sprites/nav-sprite-global-1x-hm-dsk-reorg._C
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/G/02/gno/sprites/nav-sprite-global-2x-hm-dsk-reorg._C
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/G/02/gno/sprites/timeline_sprite_1x._CB439968193_.png
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/G/02/gno/sprites/timeline_sprite_2x._CB443581191_.png
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/G/02/javascripts/lib/popover/images/snake._CB48593556
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/G/02/omaha/images/yoda/flyout_72dpi._V270092858_.png
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/G/02/prime/yourprime/yourprime-widget-piv-fallback._V
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/G/02/x-locale/common/transparent-pixel._CB485934990_.
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/G/02/x-locale/cs/help/images/gateway/Box_smaller._CB4
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/G/02/x-locale/cs/help/images/gateway/Payments_clear-b
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/G/02/x-locale/cs/help/images/gateway/Prime_clear-bg._
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/G/02/x-locale/cs/help/images/gateway/carrier-qs._CB48
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/G/02/x-locale/cs/help/images/gateway/profile-qs._CB48
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/G/02/x-locale/cs/help/images/gateway/returns-box-qs._
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/G/02/x-locale/cs/help/images/indexcard_note._CB485970
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/G/02/x-locale/cs/help/images/indexcard_takeaction._CB
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/I/014RtUpX9vL.js?AUIClients/CSHelpHMDJS
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/I/01LUlxh28%2BL.css?AUIClients/CSHelpVideoPlayerCSS
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/I/11EIQ5IGqaL._RC
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/I/11VbV%2B%2BKhQL.js?AUIClients/RetailWebsiteOverlayA
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/I/21O3D37o9-L.js?AUIClients/CSHelpSearchAutocompleteJ
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/I/31673BXVCbL.css?AUIClients/CSHelpV4CSS
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/I/31jHCv8SKKL.js?AUIClients/CSHelpVideoPlayerJS
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/I/419ZIIK4ICL.css?AUIClients/CSHelpCoreCSS
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/I/41eF0jJqsmL._RC
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/I/41icwgAxVqL._RC
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/I/513wjXyQk9L.js?AUIClients/CSHelpOmnitureJS
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-eu.ssl-images-amazon.com/images/I/61-6nKPKyWL._RC
Source: N4KOD6ZY.htm.3.dr String found in binary or memory: https://images-na.ssl-images-amazon.com/captcha/qamfifum/Captcha_rvchlcmdhc.jpg
Source: csm-captcha-instrumentation.min[1].js.3.dr String found in binary or memory: https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/
Source: N4KOD6ZY.htm.3.dr String found in binary or memory: https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-3c913031596ca78a3768f4e934b1
Source: csm-captcha-instrumentation.min[1].js.3.dr String found in binary or memory: https://images-na.ssl-images-amazon.com/images/G/01/csminstrumentation/ue-base-1c399ad9886cab69575e1
Source: 41eF0jJqsmL._RC_71oUy0QR4mL.js,61bGBFWLvlL.js,41W9ohA0e+L.js,11nffi0GnAL.js,21cmvUGs-3L.js,11k47yUMOjL.js,41SZNgvX4oL.js,51pktuVkksL.js,31qkpNdCLUL.js,01KW1GJCT1L.js,31PkUbXQSXL.js_[1].js.3.dr String found in binary or memory: https://images-na.ssl-images-amazon.com/images/G/01/poppin/JavaScript/moment-timezone-with-data.min.
Source: 41eF0jJqsmL._RC_71oUy0QR4mL.js,61bGBFWLvlL.js,41W9ohA0e+L.js,11nffi0GnAL.js,21cmvUGs-3L.js,11k47yUMOjL.js,41SZNgvX4oL.js,51pktuVkksL.js,31qkpNdCLUL.js,01KW1GJCT1L.js,31PkUbXQSXL.js_[1].js.3.dr String found in binary or memory: https://images-na.ssl-images-amazon.com/images/G/01/poppin/JavaScript/moment.min._TTD_.js
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-na.ssl-images-amazon.com/images/I/31OVaxqP8wL.js
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://images-na.ssl-images-amazon.com/images/I/711Mqp
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://kdp.amazon.com/
Source: 41eF0jJqsmL._RC_71oUy0QR4mL.js,61bGBFWLvlL.js,41W9ohA0e+L.js,11nffi0GnAL.js,21cmvUGs-3L.js,11k47yUMOjL.js,41SZNgvX4oL.js,51pktuVkksL.js,31qkpNdCLUL.js,01KW1GJCT1L.js,31PkUbXQSXL.js_[1].js.3.dr String found in binary or memory: https://livedoor.blogcms.jp
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://m.media-amazon.com/images/G/01/csm/showads.v2.js?adtag=csm
Source: 41eF0jJqsmL._RC_71oUy0QR4mL.js,61bGBFWLvlL.js,41W9ohA0e+L.js,11nffi0GnAL.js,21cmvUGs-3L.js,11k47yUMOjL.js,41SZNgvX4oL.js,51pktuVkksL.js,31qkpNdCLUL.js,01KW1GJCT1L.js,31PkUbXQSXL.js_[1].js.3.dr String found in binary or memory: https://m.media-amazon.com/images/G/01/shopbylook/shoppable-images/next_tab_control._CB416468320_.sv
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/$sHbyC9RXGbeM5j.gif)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/2SazJx$EeTHfhMN.woff2)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/333EUydyi8ioCvL.gif)
Source: 41icwgAxVqL._RC_71nLq0lOl6L.css,21-QxUt197L.css,31fpQAEX7EL.css,21MKjoYL8wL.css,41OiMQkB+EL.css,01yCq3WXEcL.css,11kO7yAgiQL.css,31OvHRW+XiL.css,01XHMOHpK1L.css,01ucgi+I44L.css,31IrUp[1].css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/5uJUWEszo9hoRiT.png);background-size:contain
Source: 41icwgAxVqL._RC_71nLq0lOl6L.css,21-QxUt197L.css,31fpQAEX7EL.css,21MKjoYL8wL.css,41OiMQkB+EL.css,01yCq3WXEcL.css,11kO7yAgiQL.css,31OvHRW+XiL.css,01XHMOHpK1L.css,01ucgi+I44L.css,31IrUp[1].css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/7Nf$80pr8M8iP8U.png)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/7O72$1VoupinvhC.png)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/CjbL$jCCegyfqZ7.woff)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/Dv1WQ5DdeMS5qP7.woff2)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/ERY32s26gzTIrBH.png)
Source: 41icwgAxVqL._RC_71nLq0lOl6L.css,21-QxUt197L.css,31fpQAEX7EL.css,21MKjoYL8wL.css,41OiMQkB+EL.css,01yCq3WXEcL.css,11kO7yAgiQL.css,31OvHRW+XiL.css,01XHMOHpK1L.css,01ucgi+I44L.css,31IrUp[1].css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/GfikJ0xvVSRQIzY.png)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/JJsp0ZvgpfwzJM6.woff)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/KFPk-9IF4FqAqY-.woff2)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/KwhNPG8Jz-Vz2X7.woff2)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/McBZv0ZvnbehkIx.png);background-repeat:no-repeat;background
Source: 41icwgAxVqL._RC_71nLq0lOl6L.css,21-QxUt197L.css,31fpQAEX7EL.css,21MKjoYL8wL.css,41OiMQkB+EL.css,01yCq3WXEcL.css,11kO7yAgiQL.css,31OvHRW+XiL.css,01XHMOHpK1L.css,01ucgi+I44L.css,31IrUp[1].css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/MzBlK1UBudXJetO.png)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/VjTR4RqBzY0mUYx.woff2)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/WOnTLzkiaEccV7F.woff2)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/XIvhNCZAsrT80Wz.woff)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/YAEPfuhs1l-argd.woff)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/e0LnMbFWJC-TMQz.woff)
Source: 41icwgAxVqL._RC_71nLq0lOl6L.css,21-QxUt197L.css,31fpQAEX7EL.css,21MKjoYL8wL.css,41OiMQkB+EL.css,01yCq3WXEcL.css,11kO7yAgiQL.css,31OvHRW+XiL.css,01XHMOHpK1L.css,01ucgi+I44L.css,31IrUp[1].css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/hmVNTQDah1G18pL.png)
Source: 41icwgAxVqL._RC_71nLq0lOl6L.css,21-QxUt197L.css,31fpQAEX7EL.css,21MKjoYL8wL.css,41OiMQkB+EL.css,01yCq3WXEcL.css,11kO7yAgiQL.css,31OvHRW+XiL.css,01XHMOHpK1L.css,01ucgi+I44L.css,31IrUp[1].css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/jkRuHu16eujI0WC.png)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/kfKKBuoqcD$AUKL.woff)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/mzVbGSgvdBfRLX9.woff)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/o0-5CNwwMa9asQf.gif)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/ozb5-CLHQWI6Soc.woff2)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/pDxWAF1pBB0dzGB.woff2)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/rggOAUTytY$L7q6.png)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/twzZHebXjCHBb6v.woff)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/ydDD9hnRfziI$y7.png)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/yjhdAZvUlA6DD-t.gif)
Source: R5NPXOQT.css.3.dr String found in binary or memory: https://m.media-amazon.com/images/S/sash/zr3RbTDdfR367Va.gif)
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://music.amazon.co.uk?ref=dm_aff_amz_couk
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://sellercentral.amazon.co.uk/gp/homepage.html?ld=AZUKSOAFooter
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://services.amazon.co.uk/standards/privacy-notice.html
Source: 41eF0jJqsmL._RC_71oUy0QR4mL.js,61bGBFWLvlL.js,41W9ohA0e+L.js,11nffi0GnAL.js,21cmvUGs-3L.js,11k47yUMOjL.js,41SZNgvX4oL.js,51pktuVkksL.js,31qkpNdCLUL.js,01KW1GJCT1L.js,31PkUbXQSXL.js_[1].js.3.dr String found in binary or memory: https://twitter.com
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://unagi-eu.amazon.com/1/events/com.amazon.csm.nexusclient.prod
Source: 31OVaxqP8wL[1].js.3.dr String found in binary or memory: https://unagi-na.amazon.com/1/events/com.amazon.csm.nexusclient.gamma
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://unagi.amazon.co.uk/1/events/com.amazon.csm.csa.prod
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://www.abebooks.co.uk/
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://www.acx.com/
Source: {6CF3118B-9706-11EB-90E4-ECF4BB862DED}.dat.2.dr String found in binary or memory: https://www.amazon.co.
Source: ~DF25992C2CCCB19408.TMP.2.dr String found in binary or memory: https://www.amazon.co.uk/?ref_=pe_undef
Source: {6CF3118B-9706-11EB-90E4-ECF4BB862DED}.dat.2.dr String found in binary or memory: https://www.amazon.co.uk/?ref_=pe_undefRoot
Source: ~DF25992C2CCCB19408.TMP.2.dr, {6CF3118B-9706-11EB-90E4-ECF4BB862DED}.dat.2.dr String found in binary or memory: https://www.amazon.co.uk/?ref_=pe_undefp
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/adprefs
Source: ref=footer_cou[1].htm.3.dr, ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/ap/register?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.a
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.ama
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/b/?node=14856936031
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/cancellationform
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/contactus
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/cookieprefs/partners
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/cookieprefs?ref_=cookies_notice_cpp
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/cpe/managepaymentmethods?ref_=ya_d_c_pmt_mpo
Source: imagestore.dat.3.dr String found in binary or memory: https://www.amazon.co.uk/favicon.ico
Source: imagestore.dat.3.dr String found in binary or memory: https://www.amazon.co.uk/favicon.ico~
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/BIT/InternetBasedAds
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/advertising/oo
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/cart/view.html?ref_=nav_cart
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/css/order-history
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/gss/ccp
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/contact-us/general-questions.html
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.html/?nodeId=201890250
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.html/?nodeId=202025250
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.html/?nodeId=GA7E98TJFEJLYSFR
Source: ~DF25992C2CCCB19408.TMP.2.dr, N4KOD6ZY.htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.html/ref=footer_cou?ie=UTF8&nodeId=1040616
Source: ~DF25992C2CCCB19408.TMP.2.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.html/ref=footer_cou?ie=UTF8&nodeId=1040616HAmazon.
Source: ~DF25992C2CCCB19408.TMP.2.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.html/ref=footer_cou?ie=UTF8&nodeId=1040616p
Source: ~DF25992C2CCCB19408.TMP.2.dr, N4KOD6ZY.htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&nodeId=502584
Source: ~DF25992C2CCCB19408.TMP.2.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&nodeId=502584s://w
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.html?nodeId=200127470
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.html?nodeId=201909000
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.html?nodeId=201929730
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.html?nodeId=201929740
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.html?nodeId=201929880
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.html?nodeId=201945460
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.html?nodeId=502480
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.html?nodeId=508510
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.html?nodeId=GLSBYFE9MGKKQXXM
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.html?nodeId=GQFYXZHZB2H629WN
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.html?nodeId=GR2TDVTNRVM2PY2M
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.html?nodeId=GX7NJQ4ZB8MHFRNJ
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.html?nodeId=GYT8SUSD2E9EWE8Q
Source: {6CF3118B-9706-11EB-90E4-ECF4BB862DED}.dat.2.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/customer/display.htmlp
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/help/reports/infringement
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/privacycentral/dsar/preview.html
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/yourstore/home
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/yourstore/iyr/
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/gp/yourstore/pym/cc/
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/returns
Source: ref=footer_cou[1].htm.3.dr, ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.amazon.co.uk/youraccount
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://www.audible.co.uk/
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://www.bookdepository.com/
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.commerce.gov/tags/eu-us-privacy-shield
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://www.dpreview.com
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://www.goodreads.com/
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://www.imdb.com/
Source: ref=footer_privacy[1].htm.3.dr String found in binary or memory: https://www.privacyshield.gov/participant?id=a2zt0000000TOWQAA4&status=Active
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://www.shopbop.com/uk/welcome
Source: ref=footer_cou[1].htm.3.dr String found in binary or memory: https://www.wholefoodsmarket.com
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown HTTPS traffic detected: 13.32.29.79:443 -> 192.168.2.3:49693 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.32.29.79:443 -> 192.168.2.3:49694 version: TLS 1.2
Source: unknown HTTPS traffic detected: 65.9.65.211:443 -> 192.168.2.3:49695 version: TLS 1.2
Source: unknown HTTPS traffic detected: 65.9.65.211:443 -> 192.168.2.3:49696 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.16:443 -> 192.168.2.3:49699 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.16:443 -> 192.168.2.3:49700 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.48.219.205:443 -> 192.168.2.3:49697 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.48.219.205:443 -> 192.168.2.3:49698 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.32.29.79:443 -> 192.168.2.3:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 65.9.65.211:443 -> 192.168.2.3:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 65.9.65.211:443 -> 192.168.2.3:49717 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.181.18.61:443 -> 192.168.2.3:49719 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.181.18.61:443 -> 192.168.2.3:49718 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.239.35.28:443 -> 192.168.2.3:49720 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.95.123.241:443 -> 192.168.2.3:49721 version: TLS 1.2
Source: classification engine Classification label: clean0.win@3/70@9/7
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DFDAE6D940B8658D6D.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:632 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:632 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Windows\SysWOW64\Macromed\Flash\ss.cfg Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 382629 URL: https://www.amazon.co.uk/gp... Startdate: 06/04/2021 Architecture: WINDOWS Score: 0 11 www.amazon.co.uk 2->11 13 tp.bfbdc3ca1-frontier.amazon.co.uk 2->13 15 dmv2chczz9u6u.cloudfront.net 2->15 6 iexplore.exe 10 61 2->6         started        process3 process4 8 iexplore.exe 6 106 6->8         started        dnsIp5 17 media.amazon.map.fastly.net 151.101.1.16, 443, 49699, 49700 FASTLYUS United States 8->17 19 dmv2chczz9u6u.cloudfront.net 13.32.29.79, 443, 49693, 49694 ATT-INTERNET4US United States 8->19 21 14 other IPs or domains 8->21
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
65.9.65.211
 c.media-amazon.com United States
16509 AMAZON-02US false
35.181.18.61
 amazoncustomerservice.d2.sc.omtrdc.net United States
16509 AMAZON-02US false
13.32.29.79
 dmv2chczz9u6u.cloudfront.net United States
7018 ATT-INTERNET4US false
52.48.219.205
 endpoint.prod.eu-west-1.forester.a2z.com United States
16509 AMAZON-02US false
151.101.1.16
 media.amazon.map.fastly.net United States
54113 FASTLYUS false
54.239.35.28
 unagi-eu.amazon.com United States
16509 AMAZON-02US false
52.95.123.241
 unknown United States
16509 AMAZON-02US false

Contacted Domains

Name IP Active
unagi-eu.amazon.com 54.239.35.28 true
c.media-amazon.com 65.9.65.211 true
dmv2chczz9u6u.cloudfront.net 13.32.29.79 true
endpoint.prod.eu-west-1.forester.a2z.com 52.48.219.205 true
media.amazon.map.fastly.net 151.101.1.16 true
amazoncustomerservice.d2.sc.omtrdc.net 35.181.18.61 true
images-eu.ssl-images-amazon.com unknown unknown
www.amazon.co.uk unknown unknown
fls-eu.amazon.co.uk unknown unknown
m.media-amazon.com unknown unknown
images-na.ssl-images-amazon.com unknown unknown
unagi.amazon.co.uk unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://www.amazon.co.uk/?ref_=pe_undef false
    		unknown