Windows Analysis Report
https://ca.docusign.net/Signing/EmailStart.aspx?a=1cdabf46-ff5a-4450-ae28-4b5293077687&etti=24&acct=938a1226-4cc2-4b96-95f9-d33be464ae6b&er=5b95ae4e-7414-40c0-b9fc-e2de228fcc1b

Overview

General Information

Sample URL: https://ca.docusign.net/Signing/EmailStart.aspx?a=1cdabf46-ff5a-4450-ae28-4b5293077687&etti=24&acct=938a1226-4cc2-4b96-95f9-d33be464ae6b&er=5b95ae4e-7414-40c0-b9fc-e2de228fcc1b
Analysis ID: 1500772

Detection

Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

AI detected landing page (webpage, office document or email)
Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)
Detected non-DNS traffic on DNS port
Stores files to the Windows start menu directory

Classification

Phishing
barindex
Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)
Source: https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/24.6.60-5/signing-conversations.js?cs=94f18f29 HTTP Parser: /*! for license information please see signing-conversations.js.license.txt */!function(){var e,t,n={6468:function(e,t,n){"use strict";var r=n(82068);object.defineproperty(t,"__esmodule",{value:!0}),t.default=void 0;var o=r(n(36488)),i=r(n(28636)),a=r(n(12944)),u=r(n(55552)),s=function(){function e(){(0,i.default)(this,e),(0,u.default)(this,"queue",new array),(0,u.default)(this,"workingonpromise",!1)}return(0,a.default)(e,[{key:"enqueue",value:function(e){var t=this;return new o.default((function(n,r){t.queue.push({worker:e,resolve:n,reject:r}),t.dequeue()}))}},{key:"dequeue",value:function(){var e=this;if(this.workingonpromise)return!1;var t=this.queue.shift();if(!t)return!1;try{this.workingonpromise=!0,t.worker().then((function(n){e.workingonpromise=!1,t.resolve(n),e.dequeue()})).catch((function(n){e.workingonpromise=!1,t.reject(n),e.dequeue()}))}catch(e){this.workingonpromise=!1,t.reject(e),this.dequeue()}return!0}}]),e}();t.default=s},92432:function(e,t,n){"use strict";var r=n(27828);object.definepropert...
Source: https://ca.docusign.net/Signing/?ti=1c89f53b54dd4e79bb69deb1114abc6b HTTP Parser: No favicon
Source: unknown HTTPS traffic detected: 23.32.114.26:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.32.114.26:443 -> 192.168.2.16:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.140.118.28:443 -> 192.168.2.16:49762 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49772 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.31.67:443 -> 192.168.2.16:49775 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.11.168.232:443 -> 192.168.2.16:49783 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.11.168.232:443 -> 192.168.2.16:49792 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.11.168.232:443 -> 192.168.2.16:49825 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.11.168.232:443 -> 192.168.2.16:49843 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.16:49846 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:64475 version: TLS 1.2
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.16:64473 -> 162.159.36.2:53
Source: global traffic TCP traffic: 192.168.2.16:64473 -> 162.159.36.2:53
Source: global traffic TCP traffic: 192.168.2.16:64473 -> 162.159.36.2:53
Source: global traffic TCP traffic: 192.168.2.16:64473 -> 162.159.36.2:53
Source: global traffic TCP traffic: 192.168.2.16:64473 -> 162.159.36.2:53
Source: global traffic TCP traffic: 192.168.2.16:64473 -> 162.159.36.2:53
Source: global traffic TCP traffic: 192.168.2.16:64473 -> 162.159.36.2:53
Source: global traffic TCP traffic: 192.168.2.16:64473 -> 162.159.36.2:53
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 23.32.114.26
Source: unknown TCP traffic detected without corresponding DNS query: 23.32.114.26
Source: unknown TCP traffic detected without corresponding DNS query: 23.32.114.26
Source: unknown TCP traffic detected without corresponding DNS query: 23.32.114.26
Source: unknown TCP traffic detected without corresponding DNS query: 23.32.114.26
Source: unknown TCP traffic detected without corresponding DNS query: 23.32.114.26
Source: unknown TCP traffic detected without corresponding DNS query: 23.32.114.26
Source: unknown TCP traffic detected without corresponding DNS query: 23.32.114.26
Source: unknown TCP traffic detected without corresponding DNS query: 23.32.114.26
Source: unknown TCP traffic detected without corresponding DNS query: 23.32.114.26
Source: unknown TCP traffic detected without corresponding DNS query: 23.32.114.26
Source: unknown TCP traffic detected without corresponding DNS query: 23.32.114.26
Source: unknown TCP traffic detected without corresponding DNS query: 23.32.114.26
Source: unknown TCP traffic detected without corresponding DNS query: 23.32.114.26
Source: unknown TCP traffic detected without corresponding DNS query: 23.32.114.26
Source: unknown TCP traffic detected without corresponding DNS query: 23.32.114.26
Source: unknown TCP traffic detected without corresponding DNS query: 23.32.114.26
Source: unknown TCP traffic detected without corresponding DNS query: 23.32.114.26
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 52.140.118.28
Source: unknown TCP traffic detected without corresponding DNS query: 52.140.118.28
Source: unknown TCP traffic detected without corresponding DNS query: 52.140.118.28
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 52.140.118.28
Source: unknown TCP traffic detected without corresponding DNS query: 52.140.118.28
Source: unknown TCP traffic detected without corresponding DNS query: 52.140.118.28
Source: unknown TCP traffic detected without corresponding DNS query: 52.140.118.28
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: global traffic DNS traffic detected: DNS query: ca.docusign.net
Source: global traffic DNS traffic detected: DNS query: docucdn-a.akamaihd.net
Source: global traffic DNS traffic detected: DNS query: a.docusign.com
Source: global traffic DNS traffic detected: DNS query: api.mixpanel.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: cmedthai.com
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 64475 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 64481 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64481
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 64475
Source: unknown Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown HTTPS traffic detected: 23.32.114.26:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.32.114.26:443 -> 192.168.2.16:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.140.118.28:443 -> 192.168.2.16:49762 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49772 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.31.67:443 -> 192.168.2.16:49775 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.11.168.232:443 -> 192.168.2.16:49783 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.11.168.232:443 -> 192.168.2.16:49792 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.11.168.232:443 -> 192.168.2.16:49825 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.11.168.232:443 -> 192.168.2.16:49843 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.16:49846 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:64475 version: TLS 1.2
Source: classification engine Classification label: mal48.phis.win@15/57@20/139
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ca.docusign.net/Signing/EmailStart.aspx?a=1cdabf46-ff5a-4450-ae28-4b5293077687&etti=24&acct=938a1226-4cc2-4b96-95f9-d33be464ae6b&er=5b95ae4e-7414-40c0-b9fc-e2de228fcc1b
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1936,i,2858316504608736229,6758583932469063561,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1936,i,2858316504608736229,6758583932469063561,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: Window Recorder Window detected: More than 3 window changes detected

Persistence and Installation Behavior
barindex
AI detected landing page (webpage, office document or email)
Source: https://ca.docusign.net/Signing/?ti=1c89f53b54dd4e79bb69deb1114abc6b LLM: Page with brand: 'docusign' contains button: 'CLICK HERE TO NAVIGATE TO MICROSOFT SHAREPOINT' Source: '1.1.pages.csv'
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.186.35
 unknown United States
15169 GOOGLEUS false
1.1.1.1
 unknown Australia
13335 CLOUDFLARENETUS false
216.58.206.78
 unknown United States
15169 GOOGLEUS false
2.19.126.227
 unknown European Union
16625 AKAMAI-ASUS false
203.78.107.122
 cmedthai.com Thailand
18362 NETWAY-AS-APNetwayCommunicationCoLtdTH false
64.233.166.84
 unknown United States
15169 GOOGLEUS false
35.190.25.25
 api.mixpanel.com United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
142.250.185.163
 unknown United States
15169 GOOGLEUS false
52.32.246.233
 arya-1323461286.us-west-2.elb.amazonaws.com United States
16509 AMAZON-02US false
142.250.186.164
 www.google.com United States
15169 GOOGLEUS false
52.235.59.100
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
142.250.186.42
 unknown United States
15169 GOOGLEUS false
172.217.16.142
 unknown United States
15169 GOOGLEUS false
52.235.63.109
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false

Private

IP
192.168.2.16

Contacted Domains

Name IP Active
cmedthai.com 203.78.107.122 true
www.google.com 142.250.186.164 true
api.mixpanel.com 35.190.25.25 true
arya-1323461286.us-west-2.elb.amazonaws.com 52.32.246.233 true
a.docusign.com unknown unknown
docucdn-a.akamaihd.net unknown unknown
ca.docusign.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://ca.docusign.net/Signing/?ti=1c89f53b54dd4e79bb69deb1114abc6b true
    		unknown
    https://cmedthai.com/n/?c3Y9bzM2NV8xX3NwJnJhbmQ9ZW5kbFVsRT0mdWlkPVVTRVIyNjA3MjAyNFVOSVFVRTAzNDQwNzI2NTIyMDI0MjAyNDA3MjY0NDAzNTI=N0123N false
      		unknown