Windows Analysis Report
https://pyjkcyxab.cc.rs6.net/tn.jsp?f=001IbK3GZLVT0KXXSICUeuFel78j7wCy8B6he1f3AlvJNCj7L3Tr3vaUbbZHdzSBzKSvjkjxwQM3egsC01YjGRUM3-E6Ih9u56wGylxoE3ZIX2t0YQjkMe6vD6-ksSfWdWGjc7pOtAizwe5e6VrUVQcN8WPdvZkFATe3-1CkLWmDNUiI2ORCANpAriJueHtG_2Pt77VnRU85md2FYnlhJZ7K_0IO30uoin4Pcz6tLvoY9u52iZJdLMWtyx5cFtxdQoD&c=

Overview

General Information

Sample URL:	https://pyjkcyxab.cc.rs6.net/tn.jsp?f=001IbK3GZLVT0KXXSICUeuFel78j7wCy8B6he1f3AlvJNCj7L3Tr3vaUbbZHdzSBzKSvjkjxwQM3egsC01YjGRUM3-E6Ih9u56wGylxoE3ZIX2t0YQjkMe6vD6-ksSfWdWGjc7pOtAizwe5e6VrUVQcN8WPdvZkFAT
Analysis ID:	1525212

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Detected non-DNS traffic on DNS port

Stores files to the Windows start menu directory

Classification

Signatures

Source: https://files.constantcontact.com/f072520f501/f53f7cdb-ea30-4d30-b608-1e40464eb687.pdf?rdr=true	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/PubliChem%20Introduction.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/PubliChem%20Introduction.pdf	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49720 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 27MB later: 36MB

Detected non-DNS traffic on DNS port

Source: global traffic	TCP traffic: 192.168.2.16:49698 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49698 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49698 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49698 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49698 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49698 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49698 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49698 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49698 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49698 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49698 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49698 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50

Source: global traffic	DNS traffic detected: DNS query: pyjkcyxab.cc.rs6.net
Source: global traffic	DNS traffic detected: DNS query: files.constantcontact.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49720 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@26/8@6/108

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1992,i,11546081076512848561,12896576646402765687,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://pyjkcyxab.cc.rs6.net/tn.jsp?f=001IbK3GZLVT0KXXSICUeuFel78j7wCy8B6he1f3AlvJNCj7L3Tr3vaUbbZHdzSBzKSvjkjxwQM3egsC01YjGRUM3-E6Ih9u56wGylxoE3ZIX2t0YQjkMe6vD6-ksSfWdWGjc7pOtAizwe5e6VrUVQcN8WPdvZkFATe3-1CkLWmDNUiI2ORCANpAriJueHtG_2Pt77VnRU85md2FYnlhJZ7K_0IO30uoin4Pcz6tLvoY9u52iZJdLMWtyx5cFtxdQoD&c=35MwI76ctpBATKx2X54aQ_R9XC5ZpBchUw7Rbib_QUFl_dPUyyloWg==&ch=NiFihMKUJmfqgevZoJKRcqOxoa9IPK282o4mfBabuyP90srDMYNbRw=="
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1992,i,11546081076512848561,12896576646402765687,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.99	unknown	United States	15169	GOOGLEUS	false
142.251.167.84	unknown	United States	15169	GOOGLEUS	false
142.250.185.206	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
143.204.98.108	d6j37cnssol7h.cloudfront.net	United States	16509	AMAZON-02US	false
216.58.212.164	www.google.com	United States	15169	GOOGLEUS	false
216.58.206.78	unknown	United States	15169	GOOGLEUS	false
208.75.122.11	pyjkcyxab.cc.rs6.net	United States	40444	ASN-CCUS	false
142.250.185.227	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
d6j37cnssol7h.cloudfront.net	143.204.98.108	true
www.google.com	216.58.212.164	true
pyjkcyxab.cc.rs6.net	208.75.122.11	true
files.constantcontact.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://files.constantcontact.com/f072520f501/f53f7cdb-ea30-4d30-b608-1e40464eb687.pdf?rdr=true	false		unknown
file:///C:/Users/user/Downloads/PubliChem%20Introduction.pdf	false		unknown

ID:	1525212
Product:	CloudBasic
Start time:	21:31:06
Start date:	03.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 18:31:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6D908C641B6024A5D98C80659AA827F6	A925F2670FFCCFE9F24B06881B1E6B98C8BF4960	A12D3221D31324140950ACF92F76795AFF6791BC0CB8C7A69335350F30222838
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 18:31:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	651E9D224E72659562DF3A0B69794259	C62458FE33A42EF2066408336AF19B37EB69345D	9E05F2D04BF862AD44697B3B138080919294460C8BB0880595C950F9E60A1897
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	C81F8562656CD820A3D40E70CA378935	81E146032FB3AD560EF663A008022466D3791056	F6DAAFB626B4E86527C1684634416A72F75F7664EEB9E3C161617351D36159D8
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 18:31:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	F220DBE1DF10F3627B0DFA74CE24AE0C	B93590A73A4DCD0C877D296611D8308C2EF791CC	93016AB7816184437017DD6A7F750297A4EAE4EA231BCB4CBD962D1910EAF6E9
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 18:31:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	E5740DEE874B95B0856A4A5C76CED69A	754C8D16BB5FE065E232FB559D0C0DB922D2470C	9BF1DAED14E1F9F713DBE579E10BFF12B7B807264B7E1398E67AD67B7928B3EB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 18:31:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	44ED1C5561AAC69218CDBC75FB88D8B0	4F42CAEA72909868EAB2F24B87308DE4AE73A9A2	C9ACBAA68D15BF15646891128B36FD5D663D2B52BF570F83F0ED1671E6A2115E
C:\Users\user\Downloads\PubliChem Introduction.pdf (copy)	PDF document, version 1.6 (zip deflate encoded)	5945EBB34219D60F04C09F1B573A0350	884AEB35B09E4E760A40300856768D5ECD2E3955	C031E505646FA92BE45E48D60ABDFE02685592244ACBF38CD10270B3AFE7973C
C:\Users\user\Downloads\PubliChem Introduction.pdf.crdownload (copy)	PDF document, version 1.6 (zip deflate encoded)	5945EBB34219D60F04C09F1B573A0350	884AEB35B09E4E760A40300856768D5ECD2E3955	C031E505646FA92BE45E48D60ABDFE02685592244ACBF38CD10270B3AFE7973C
C:\Users\user\Downloads\downloaded.pdf.crdownload	PDF document, version 1.6 (zip deflate encoded)	5945EBB34219D60F04C09F1B573A0350	884AEB35B09E4E760A40300856768D5ECD2E3955	C031E505646FA92BE45E48D60ABDFE02685592244ACBF38CD10270B3AFE7973C
Chrome Cache Entry: 62	XML 1.0 document, ASCII text	D0EBCA33E669A7B6934086FC9D181D79	D22068EEE937C2542B2448E90DC42A3D18609A04	398CC0C7D1B744A10931435E3F8D2FFE6E921A8F95E837F03FA9DDBE07F5DD68

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs