Windows Analysis Report
https://trk.pmifunds.com/y.z?l=http://security1.b-cdn.net&j=375634604&e=3028&p=1&t=h&D6EBE0CCEBB74CE191551D6EE653FA1E

Overview

General Information

Sample URL: https://trk.pmifunds.com/y.z?l=http://security1.b-cdn.net&j=375634604&e=3028&p=1&t=h&D6EBE0CCEBB74CE191551D6EE653FA1E
Analysis ID: 1500941
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
AI detected landing page (webpage, office document or email)
Detected suspicious crossdomain redirect

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: https://trk.pmifunds.com/y.z?l=http://security1.b-cdn.net&j=375634604&e=3028&p=1&t=h&D6EBE0CCEBB74CE191551D6EE653FA1E SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering
Antivirus detection for URL or domain
Source: https://l4wjyimk.zone.investir-sur-mesure.fr/preview Avira URL Cloud: Label: malware
Source: https://l4wjyimk.zone.investir-sur-mesure.fr/?_js=_1 Avira URL Cloud: Label: malware
Source: https://l4wjyimk.zone.investir-sur-mesure.fr/?_r= Avira URL Cloud: Label: malware
Source: http://l4wjyimk.zone.investir-sur-mesure.fr/favicon.ico Avira URL Cloud: Label: malware
Source: https://l4wjyimk.zone.investir-sur-mesure.fr/favicon.ico Avira URL Cloud: Label: malware
Source: http://l4wjyimk.zone.investir-sur-mesure.fr/preview/ HTTP Parser: No favicon
Source: http://l4wjyimk.zone.investir-sur-mesure.fr/preview/ HTTP Parser: No favicon
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49745 version: TLS 1.2
Detected suspicious crossdomain redirect
Source: C:\Program Files\Google\Chrome\Application\chrome.exe HTTP traffic: Redirect from: trk.pmifunds.com to http://security1.b-cdn.net
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 29 Aug 2024 04:46:36 GMTContent-Type: text/html; charset=UTF-8Content-Length: 2153Connection: keep-aliveServer: ApacheUpgrade: h2Vary: Accept-EncodingContent-Encoding: gzipData Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 59 ef 72 db b8 11 ff 9e a7 40 99 f1 51 99 8a 12 45 4a 8a a3 48 9e c6 8e 3d be 99 b8 c9 34 3e 4f ef 23 44 82 24 2e 24 c1 03 40 c9 f2 35 2f d1 e9 f7 be 62 1f a1 0b 90 92 f8 57 76 ef 4a db 34 b4 58 2c 16 3f ec 2e 16 ab 57 cb 3f 7d fc 7c 75 ff f3 97 6b 14 c9 24 be 78 b5 54 ff 50 8c d3 70 65 90 d4 50 04 82 fd 8b 57 08 9e 65 42 24 46 5e 84 b9 20 72 65 fc 74 7f 63 9d 1b d5 ae 14 27 64 65 6c 28 d9 66 8c 4b 03 79 2c 95 24 05 d6 2d f5 65 b4 f2 c9 86 7a c4 d2 1f 86 88 a6 54 52 1c 5b c2 c3 31 59 4d 46 76 4d 54 24 65 66 91 5f 73 ba 59 19 7f b7 7e fa 60 5d b1 24 c3 92 ae 63 52 91 fb e3 f5 8a f8 21 e9 1d 79 55 30 5a 5f 89 97 73 2a 77 d6 17 16 53 6f 57 91 e0 93 00 e7 b1 b4 04 f7 90 29 48 1c 98 ef 91 f0 38 cd aa 24 64 e6 a9 c0 01 b1 68 1a d3 94 28 16 b9 8b c9 49 0e 9a 84 d5 7e 1f 4b bc 78 8f 02 98 b7 36 57 c0 01 b3 82 92 32 3d 90 ad 7f 21 9e ac 92 3a 30 e6 24 20 9c 13 5e 59 49 ca ac 03 b5 3d c0 27 c5 aa 28 4b 2b 63 1e 08 a7 c1 0e ed 58 ce 11 f5 81 04 18 21 c9 10 f6 3c 22 04 ba a3 1e 67 82 05 12 69 00 09 fa c8 bc 3c 01 b6 fd 04 c0 1f 93 8b 5e 36 64 21 3d 03 f5 b0 9a 78 39 2e f8 8b b1 1a c2 a2 ad 9e 35 f3 77 e8 b7 c3 47 f5 68 b0 02 9c d0 78 b7 40 e6 df d8 9a 49 66 0e d1 07 0e 66 33 44 02 a7 c2 12 4a fc fb da 28 49 1e a5 85 63 1a a6 0b e4 81 12 84 d7 fb 13 cc 43 0a 7d 76 9d 9c 61 df a7 69 d8 a2 fb 54 64 31 06 05 82 98 3c d6 bb 14 c5 f2 29 87 ed 82 d5 c1 6c 2c ce 93 b4 ce f3 4b 2e 24 40 6c 95 90 f7 a8 44 53 2b 22 34 8c a0 7f 62 db 9b a8 de bd c6 de b7 90 b3 3c f5 17 48 59 17 e6 56 c8 b1 4f 41 d2 60 e2 ce 7c 12 0e d1 eb e0 3c 78 17 60 64 9f 41 9b bc 23 1e 09 94 a8 b3 37 8d 55 32 41 0b 65 39 89 61 53 36 a4 de cf 36 84 07 31 db 2e 50 44 7d 30 88 63 ef f7 da 4e 2d 16 6b 12 30 d8 ea fa 8e 1d 56 69 9a 7d f3 e2 b5 00 98 64 63 5e c9 b2 16 f2 31 09 64 8b c8 0b 94 1a 54 b0 0c c9 92 36 f9 00 9c 45 13 1c 92 05 ca 79 3c 30 b4 2f 6a c2 58 6c c2 3f 3f 26 f1 f0 cc bd 82 26 2a e2 94 39 b7 4d 54 ec 47 d1 56 11 ed 92 3d ae 4c 1b d9 68 ae 7e 4d 04 a3 52 b1 32 55 b4 59 8c c7 db ed 76 b4 75 47 8c 87 63 c7 b6 6d 25 d7 3c 73 af 41 6c 88 02 1a c7 ab c2 95 75 db e2 39 04 3c 93 6c 48 ca 7c bf c1 76 e6 b8 b6 7e 4a 5e 96 61 0f 9c 12 a6 1e d9 b3 92 17 e2 60 84 fc 95 79 e7 ce 91 3b dd 58 d3 c8 72 36 f0 9a 6e 9c 68 0a 0d 47 91 80 ee 00 e9 29 b1 2d d7 7e b0 9b 2c 0f f3 68 fa a0 08 4f 77 a5 90 5b a0 df da 4d 11 b7 73 c5 30 7d b0 eb dd c5 70 e8 34 c7 85 4e e3 b0 f1 1f 10 80 96 d1 b0 bf 72 39 b0 53 a3 59 bd e7 09 42 a7 4f 1e 17 c8 9a 74 19 dd 48 99 16 06 e3 e7 0d 93 3b f8 ad 6b 67 8f bd db 0f ae c9 f8 02 bc 24 08 9a 96 c3 7d c2 2d e5 4e b9 58 a0 f3 96 0c f6 68 89 08 fb ca 25 6c e4 64 8f e0 55 f0 e2 e1 1a 0f ec 21 2a 7f 47 93 37 cd 20 f3 58 9c 73 0b 34 75 5a 8a ed 43 10 ce 25 fb df fc f3 80 52 37 48 31 f3 be 59 14 a0 ea 8a a4 82 3e 81 07 cc e6 dd da
Source: global traffic HTTP traffic detected: GET /y.z?l=http://security1.b-cdn.net&j=375634604&e=3028&p=1&t=h&D6EBE0CCEBB74CE191551D6EE653FA1E HTTP/1.1Host: trk.pmifunds.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /z.aspx?page=y&l=http%3a%2f%2fsecurity1.b-cdn.net&j=375634604&e=3028&p=1&t=h&D6EBE0CCEBB74CE191551D6EE653FA1E HTTP/1.1Host: trk.pmifunds.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ASPSESSIONIDQCRABSBD=FEELKHODDGLOKNDDADAEFDOG
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: security1.b-cdn.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: l4wjyimk.zone.investir-sur-mesure.frConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://security1.b-cdn.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /?_js=_1 HTTP/1.1Host: l4wjyimk.zone.investir-sur-mesure.frConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://l4wjyimk.zone.investir-sur-mesure.fr/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: l4wjyimk.zone.investir-sur-mesure.frConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l4wjyimk.zone.investir-sur-mesure.fr/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /?_js=_1 HTTP/1.1Host: l4wjyimk.zone.investir-sur-mesure.frConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /botd/v1 HTTP/1.1Host: openfpcdn.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://l4wjyimk.zone.investir-sur-mesure.frsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://l4wjyimk.zone.investir-sur-mesure.fr/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /?_r= HTTP/1.1Host: l4wjyimk.zone.investir-sur-mesure.frConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://l4wjyimk.zone.investir-sur-mesure.fr/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /preview HTTP/1.1Host: l4wjyimk.zone.investir-sur-mesure.frConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://l4wjyimk.zone.investir-sur-mesure.fr/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /botd/v1 HTTP/1.1Host: openfpcdn.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: security1.b-cdn.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /preview/ HTTP/1.1Host: l4wjyimk.zone.investir-sur-mesure.frConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: l4wjyimk.zone.investir-sur-mesure.frConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic DNS traffic detected: DNS query: trk.pmifunds.com
Source: global traffic DNS traffic detected: DNS query: security1.b-cdn.net
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: l4wjyimk.zone.investir-sur-mesure.fr
Source: global traffic DNS traffic detected: DNS query: openfpcdn.io
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 04:46:35 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 282Connection: closeServer: Apache
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 04:46:36 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 282Connection: keep-aliveServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 6c 34 77 6a 79 69 6d 6b 2e 7a 6f 6e 65 2e 69 6e 76 65 73 74 69 72 2d 73 75 72 2d 6d 65 73 75 72 65 2e 66 72 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at l4wjyimk.zone.investir-sur-mesure.fr Port 80</address></body></html>
Source: chromecache_49.2.dr, chromecache_48.2.dr String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_49.2.dr, chromecache_48.2.dr String found in binary or memory: https://fingerprint.com)
Source: chromecache_46.2.dr, chromecache_44.2.dr String found in binary or memory: https://openfpcdn.io/botd/v1
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: classification engine Classification label: mal60.win@19/16@18/9
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2192,i,10110161044368454811,7874456063879550184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://trk.pmifunds.com/y.z?l=http://security1.b-cdn.net&j=375634604&e=3028&p=1&t=h&D6EBE0CCEBB74CE191551D6EE653FA1E"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2192,i,10110161044368454811,7874456063879550184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected

Persistence and Installation Behavior
barindex
AI detected landing page (webpage, office document or email)
Source: http://l4wjyimk.zone.investir-sur-mesure.fr/preview/ LLM: Page with brand: 'Microsoft' contains button: 'verify it's you' Source: '4.2.pages.csv'
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1500941 URL: https://trk.pmifunds.com/y.... Startdate: 29/08/2024 Architecture: WINDOWS Score: 60 24 Antivirus detection for URL or domain 2->24 26 Antivirus / Scanner detection for submitted sample 2->26 28 AI detected landing page (webpage, office document or email) 2->28 6 chrome.exe 1 2->6         started        9 chrome.exe 2->9         started        process3 dnsIp4 14 192.168.2.4, 138, 443, 49735 unknown unknown 6->14 16 239.255.255.250 unknown Reserved 6->16 11 chrome.exe 6->11         started        process5 dnsIp6 18 security1.b-cdn.net 169.150.247.36, 443, 49739, 49740 SPIRITTEL-ASUS United States 11->18 20 www.google.com 142.250.185.132, 443, 49741, 49762 GOOGLEUS United States 11->20 22 7 other IPs or domains 11->22
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
3.160.150.111
 unknown United States
16509 AMAZON-02US false
52.205.53.110
 unknown United States
14618 AMAZON-AESUS false
142.250.185.132
 www.google.com United States
15169 GOOGLEUS false
3.160.150.40
 openfpcdn.io United States
16509 AMAZON-02US false
34.233.69.206
 fien-198008767.us-east-1.elb.amazonaws.com United States
14618 AMAZON-AESUS false
169.150.247.36
 security1.b-cdn.net United States
2711 SPIRITTEL-ASUS false
104.248.15.35
 jngo.net United States
14061 DIGITALOCEAN-ASNUS false
239.255.255.250
 unknown Reserved
unknown unknown false

Private

IP
192.168.2.4

Contacted Domains

Name IP Active
openfpcdn.io 3.160.150.40 true
jngo.net 104.248.15.35 true
fien-198008767.us-east-1.elb.amazonaws.com 34.233.69.206 true
www.google.com 142.250.185.132 true
security1.b-cdn.net 169.150.247.36 true
fp2e7a.wpc.phicdn.net 192.229.221.95 true
l4wjyimk.zone.investir-sur-mesure.fr unknown unknown
trk.pmifunds.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://trk.pmifunds.com/y.z?l=http://security1.b-cdn.net&j=375634604&e=3028&p=1&t=h&D6EBE0CCEBB74CE191551D6EE653FA1E true
    		unknown
    https://trk.pmifunds.com/z.aspx?page=y&l=http%3a%2f%2fsecurity1.b-cdn.net&j=375634604&e=3028&p=1&t=h&D6EBE0CCEBB74CE191551D6EE653FA1E false
    • 1%, Virustotal, Browse
    • Avira URL Cloud: safe
    		 unknown
    https://l4wjyimk.zone.investir-sur-mesure.fr/preview false
    • Avira URL Cloud: malware
    		 unknown
    https://l4wjyimk.zone.investir-sur-mesure.fr/ false
      		unknown
      http://security1.b-cdn.net/ false
      • 0%, Virustotal, Browse
      • Avira URL Cloud: safe
      		 unknown
      http://l4wjyimk.zone.investir-sur-mesure.fr/preview/ true
        		unknown
        https://l4wjyimk.zone.investir-sur-mesure.fr/?_js=_1 false
        • Avira URL Cloud: malware
        		 unknown
        https://l4wjyimk.zone.investir-sur-mesure.fr/?_r= false
        • Avira URL Cloud: malware
        		 unknown
        https://security1.b-cdn.net/ false
        • 0%, Virustotal, Browse
        • Avira URL Cloud: safe
        		 unknown
        http://l4wjyimk.zone.investir-sur-mesure.fr/favicon.ico false
        • Avira URL Cloud: malware
        		 unknown
        https://l4wjyimk.zone.investir-sur-mesure.fr/favicon.ico false
        • Avira URL Cloud: malware
        		 unknown
        https://openfpcdn.io/botd/v1 false
        • 0%, Virustotal, Browse
        • Avira URL Cloud: safe
        		 unknown