Windows Analysis Report http://t.rdsv.net/ls/click?upn=cpwegmyFHUuNgEU3lyNXXhPGSYXUqt-2BGXbRNBYBa2g896D4DVCuUlLbtHzBnOscW6qJbOo1xArXiRLhNUJmqbMk7y0c07Wwhd-2B50vpuXpvZoWm4jahZHqBv4QldQQ0YZbzW8_UjuXtHjpHNrQkHhOUKYAq28-2F0Q4sGSdW314MKXxhxNDN4dWOs6ea-2BfxlUCZOmCV9bdkAe-2Bq7ZxF6fKOF-2BbFoN6lR49ezWp6pYyEXYyCx2xJHqh0tHicanG21dXeyuGH2hZLF7vIvxCRl-2Fx7JEkTzcQcb6jsT6ykl2ZNHUJwPvKy2zYCswEDcQhCs2i-2FZkXZqjRVLtLe-2FPHg50AHygfh3npy3FHX0dqegT-2FltXWzgdPgRR17ANwdxTJePU6pbIk63-2BrC-2BAwG9Pa8VEhtQUk35o9wKU3NEI3MbP7446zXRjZj2N4WfFCLcmNgIyJMMTy4YIFCESv5pdcyMrXKcX8lNXYt4HqFEVxQ89cOgMKFrpq8PMtQcWdbbuu3F4IyAj-2Bs3xcKdnkwASyatHiB6Y1PTxlXQ2ai87Qw6hmXZXJiCQ1OoPbl2psrJUn95vFQL2AHT9UoLNvZfSbcFCj1P0QPVSq4B3LhLX5M5A3Kt-2BEYCxIB2u2IwSHwe4zQexVD0rJzb

Overview

General Information

Sample URL: http://t.rdsv.net/ls/click?upn=cpwegmyFHUuNgEU3lyNXXhPGSYXUqt-2BGXbRNBYBa2g896D4DVCuUlLbtHzBnOscW6qJbOo1xArXiRLhNUJmqbMk7y0c07Wwhd-2B50vpuXpvZoWm4jahZHqBv4QldQQ0YZbzW8_UjuXtHjpHNrQkHhOUKYAq28-2F0Q4sGSdW314MKXxhxNDN4dWOs6ea-2BfxlUCZOmCV9bdkAe-2Bq7ZxF6fKOF-2BbFoN6lR49ezWp6pYyEXYyCx2xJHqh0tHicanG21dXeyuGH2hZLF7vIvxCRl-2Fx7JEkTzcQcb6jsT6ykl2ZNHUJwPvKy2zYCswEDcQhCs2i-2FZkXZqjRVLtLe-2FPHg50AHygfh3npy3FHX0dqegT-2FltXWzgdPgRR17ANwdxTJePU6pbIk63-2BrC-2BAwG9Pa8VEhtQUk35o9wKU3NEI3MbP7446zXRjZj2N4WfFCLcmNgIyJMMTy4YIFCESv5pdcyMrXKcX8lNXYt4HqFEVxQ89cOgMKFrpq8PMtQcWdbbuu3F4IyAj-2Bs3xcKdnkwASyatHiB6Y1PTxlXQ2ai87Qw6hmXZXJiCQ1OoPbl2psrJUn95vFQL2AHT9UoLNvZfSbcFCj1P0QPVSq4B3LhLX5M5A3Kt-2BEYCxIB2u2IwSHwe4zQexVD0rJzb
Analysis ID: 445712
Infos:

Most interesting Screenshot:

Detection

Score: 0
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

No high impact signatures.

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

There are no high impact signatures.

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 104.21.75.148:443 -> 192.168.2.3:49704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.75.148:443 -> 192.168.2.3:49705 version: TLS 1.2
Source: unknown HTTPS traffic detected: 18.192.76.182:443 -> 192.168.2.3:49722 version: TLS 1.2
Source: unknown HTTPS traffic detected: 18.192.76.182:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: global traffic HTTP traffic detected: GET /ls/click?upn=cpwegmyFHUuNgEU3lyNXXhPGSYXUqt-2BGXbRNBYBa2g896D4DVCuUlLbtHzBnOscW6qJbOo1xArXiRLhNUJmqbMk7y0c07Wwhd-2B50vpuXpvZoWm4jahZHqBv4QldQQ0YZbzW8_UjuXtHjpHNrQkHhOUKYAq28-2F0Q4sGSdW314MKXxhxNDN4dWOs6ea-2BfxlUCZOmCV9bdkAe-2Bq7ZxF6fKOF-2BbFoN6lR49ezWp6pYyEXYyCx2xJHqh0tHicanG21dXeyuGH2hZLF7vIvxCRl-2Fx7JEkTzcQcb6jsT6ykl2ZNHUJwPvKy2zYCswEDcQhCs2i-2FZkXZqjRVLtLe-2FPHg50AHygfh3npy3FHX0dqegT-2FltXWzgdPgRR17ANwdxTJePU6pbIk63-2BrC-2BAwG9Pa8VEhtQUk35o9wKU3NEI3MbP7446zXRjZj2N4WfFCLcmNgIyJMMTy4YIFCESv5pdcyMrXKcX8lNXYt4HqFEVxQ89cOgMKFrpq8PMtQcWdbbuu3F4IyAj-2Bs3xcKdnkwASyatHiB6Y1PTxlXQ2ai87Qw6hmXZXJiCQ1OoPbl2psrJUn95vFQL2AHT9UoLNvZfSbcFCj1P0QPVSq4B3LhLX5M5A3Kt-2BEYCxIB2u2IwSHwe4zQexVD0rJzb HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: t.rdsv.netConnection: Keep-Alive
Source: unknown DNS traffic detected: queries for: t.rdsv.net
Source: banned[1].htm.3.dr, 5c7e195[1].js.3.dr String found in binary or memory: https://chl.li
Source: c5070a3[1].js.3.dr String found in binary or memory: https://chl.li/
Source: c5070a3[1].js.3.dr String found in binary or memory: https://chl.li/$
Source: {7E25200B-E006-11EB-90E4-ECF4BB862DED}.dat.2.dr String found in binary or memory: https://chl.li/banned
Source: {7E25200B-E006-11EB-90E4-ECF4BB862DED}.dat.2.dr String found in binary or memory: https://chl.li/bannedL
Source: {7E25200B-E006-11EB-90E4-ECF4BB862DED}.dat.2.dr String found in binary or memory: https://chl.li/bannedRoot
Source: {7E25200B-E006-11EB-90E4-ECF4BB862DED}.dat.2.dr String found in binary or memory: https://chl.li/contact
Source: {7E25200B-E006-11EB-90E4-ECF4BB862DED}.dat.2.dr String found in binary or memory: https://chl.li/contactL
Source: ~DFD748ABD5F4183990.TMP.2.dr String found in binary or memory: https://chl.li/contactavelLog
Source: imagestore.dat.3.dr String found in binary or memory: https://chl.li/favicon.ico
Source: {7E25200B-E006-11EB-90E4-ECF4BB862DED}.dat.2.dr String found in binary or memory: https://chl.li/ontact
Source: c5070a3[1].js.3.dr String found in binary or memory: https://ko-fi.com/vincentdoerig
Source: 389e2cc[1].js.3.dr String found in binary or memory: https://s.pageclip.co/v1/pageclip.js
Source: banned[1].htm.3.dr, OND0U4FC.htm.3.dr, contact[1].htm.3.dr String found in binary or memory: https://sa.chl.li/image.gif
Source: pageclip[1].js.3.dr String found in binary or memory: https://send.pageclip.co
Source: 389e2cc[1].js.3.dr, contact[1].htm.3.dr String found in binary or memory: https://send.pageclip.co/V4TI4hdGwPHLUh3G6rElfsYTZZs0N6wJ
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown HTTPS traffic detected: 104.21.75.148:443 -> 192.168.2.3:49704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.75.148:443 -> 192.168.2.3:49705 version: TLS 1.2
Source: unknown HTTPS traffic detected: 18.192.76.182:443 -> 192.168.2.3:49722 version: TLS 1.2
Source: unknown HTTPS traffic detected: 18.192.76.182:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: classification engine Classification label: clean0.win@3/24@5/3
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DF3868AD8133FA3F13.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4424 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4424 CREDAT:17410 /prefetch:2 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 445712 URL: http://t.rdsv.net/ls/click?... Startdate: 08/07/2021 Architecture: WINDOWS Score: 0 11 clientconfig.passport.net 2->11 13 chl.li 2->13 6 iexplore.exe 2 61 2->6         started        process3 process4 8 iexplore.exe 2 50 6->8         started        dnsIp5 15 chl.li 104.21.75.148, 443, 49704, 49705 CLOUDFLARENETUS United States 8->15 17 d4liwvj3ggvqp.cloudfront.net 13.224.99.50, 49696, 49697, 80 AMAZON-02US United States 8->17 19 3 other IPs or domains 8->19
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.21.75.148
 chl.li United States
13335 CLOUDFLARENETUS false
18.192.76.182
 pageclip-static.netlify.com United States
16509 AMAZON-02US false
13.224.99.50
 d4liwvj3ggvqp.cloudfront.net United States
16509 AMAZON-02US false

Contacted Domains

Name IP Active
d4liwvj3ggvqp.cloudfront.net 13.224.99.50 true
pageclip-static.netlify.com 18.192.76.182 true
chl.li 104.21.75.148 true
t.rdsv.net unknown unknown
s.pageclip.co unknown unknown
clientconfig.passport.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://chl.li/contact false
    		unknown
    https://chl.li/banned false
      		unknown
      https://chl.li/ false
        		unknown