Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 67

HTML document, ASCII text, with very long lines (20357)

downloaded

Details

File:	Chrome Cache Entry: 67
Category:	downloaded
Dump:	chromecache_67.1.dr
ID:	dr_0
Target ID:	1
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with very long lines (20357)
Entropy:	3.2670392113290387
Encrypted:	false
Size:	20792
Whitelisted:	false

Chrome Cache Entry: 68

ASCII text, with very long lines (65447)

downloaded

Details

File:	Chrome Cache Entry: 68
Category:	downloaded
Dump:	chromecache_68.1.dr
ID:	dr_1
Target ID:	1
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (65447)
Entropy:	5.289893677458563
Encrypted:	false
Size:	89501
Whitelisted:	false

Chrome Cache Entry: 71

ASCII text, with very long lines (47459)

dropped

Details

File:	Chrome Cache Entry: 71
Category:	dropped
Dump:	chromecache_71.1.dr
ID:	dr_2
Target ID:	1
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (47459)
Entropy:	5.397735966179774
Encrypted:	false
Size:	47460
Whitelisted:	false

Chrome Cache Entry: 72

PNG image data, 59 x 70, 8-bit/color RGB, non-interlaced

downloaded

Details

File:	Chrome Cache Entry: 72
Category:	downloaded
Dump:	chromecache_72.1.dr
ID:	dr_3
Target ID:	1
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 59 x 70, 8-bit/color RGB, non-interlaced
Entropy:	4.035372245524405
Encrypted:	false
Size:	61
Whitelisted:	false

Chrome Cache Entry: 73

PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced

downloaded

Details

File:	Chrome Cache Entry: 73
Category:	downloaded
Dump:	chromecache_73.1.dr
ID:	dr_4
Target ID:	1
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Entropy:	3.990210155325004
Encrypted:	false
Size:	61
Whitelisted:	false

Chrome Cache Entry: 75

ASCII text, with very long lines (47992), with no line terminators

dropped

Details

File:	Chrome Cache Entry: 75
Category:	dropped
Dump:	chromecache_75.1.dr
ID:	dr_5
Target ID:	1
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (47992), with no line terminators
Entropy:	5.605846858683577
Encrypted:	false
Size:	47992
Whitelisted:	false

Chrome Cache Entry: 77

HTML document, Unicode text, UTF-8 text, with very long lines (515), with CRLF line terminators

dropped

Details

File:	Chrome Cache Entry: 77
Category:	dropped
Dump:	chromecache_77.1.dr
ID:	dr_6
Target ID:	1
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, Unicode text, UTF-8 text, with very long lines (515), with CRLF line terminators
Entropy:	4.760890326647764
Encrypted:	false
Size:	6761
Whitelisted:	false

Chrome Cache Entry: 79

XML 1.0 document, ASCII text, with no line terminators

downloaded

Details

File:	Chrome Cache Entry: 79
Category:	downloaded
Dump:	chromecache_79.1.dr
ID:	dr_7
Target ID:	1
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	XML 1.0 document, ASCII text, with no line terminators
Entropy:	5.19189477487854
Encrypted:	false
Size:	253
Whitelisted:	false

Chrome Cache Entry: 80

HTML document, ASCII text, with very long lines (3330), with CRLF, LF line terminators

downloaded

Details

File:	Chrome Cache Entry: 80
Category:	downloaded
Dump:	chromecache_80.1.dr
ID:	dr_8
Target ID:	1
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with very long lines (3330), with CRLF, LF line terminators
Entropy:	5.608153129639936
Encrypted:	false
Size:	6591
Whitelisted:	false

URLs

Name

Malicious

http://email-tracking.jotelulu.com/c/eJx0yjFyhSAQANDTQBeHXVaFgiKN90B29ZMQdRCSGU-fyQFSv8dhHdmSlgAzOjIEnvQrgLeSVgTrMPlRmBmtoMA2-W1NE-gc0CCBMQ4mmCwNntfkeJxnEYpuc4rMx9mk9NKHdH7pEl6tXbey7woXhUvNdyySj17b8xcULj_XWz5S6Sy3wqXVmD7zsSu0u9R8D5dUeRSZ_YxxOOuua_gHvgP-BgAA__-1WEOb

Details

Filetype:	URL
Filename:	http://email-tracking.jotelulu.com/c/eJx0yjFyhSAQANDTQBeHXVaFgiKN90B29ZMQdRCSGU-fyQFSv8dhHdmSlgAzOjIEnvQrgLeSVgTrMPlRmBmtoMA2-W1NE-gc0CCBMQ4mmCwNntfkeJxnEYpuc4rMx9mk9NKHdH7pEl6tXbey7woXhUvNdyySj17b8xcULj_XWz5S6Sy3wqXVmD7zsSu0u9R8D5dUeRSZ_YxxOOuua_gHvgP-BgAA__-1WEOb

Signature Hits	Behavior Group	Mitre Attack
AI detected phishing page	Phishing	Extra Window Memory Injection
Yara detected HtmlPhish70	Phishing	Extra Window Memory Injection
HTML page contains hidden URLs	Phishing	Extra Window Memory Injection
HTML page contains obfuscated javascript	Phishing	Extra Window Memory Injection
HTML page contains suspicious javascript code	Phishing	Extra Window Memory Injection
HTML body contains low number of good links	Phishing
HTML body contains password input but no form action	Phishing	Extra Window Memory Injection
HTML body with high number of embedded images detected	Phishing	Extra Window Memory Injection
HTML page contains hidden javascript code	Phishing	Extra Window Memory Injection
HTML title does not match URL	Phishing	Extra Window Memory Injection
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder
Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)	Phishing	Scripting Deobfuscate/Decode Files or Information
Allocates a big amount of memory (probably used for heap spraying)	Software Vulnerabilities	Extra Window Memory Injection
Classification label	System Summary	Extra Window Memory Injection
Connects to IPs without corresponding DNS lookups	Networking	Extra Window Memory Injection
Creates files inside the user directory	System Summary	Masquerading
Downloads files from webservers via HTTP	Networking	Extra Window Memory Injection Ingress Tool Transfer
HTML body contains password input	Phishing	Extra Window Memory Injection
HTML page is missing a favicon	Phishing	Extra Window Memory Injection
META author tag missing	Phishing
META copyright tag missing	Phishing
Performs DNS lookups	Networking	Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection
Uses HTTPS	Networking	Application Layer Protocol
Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis		Encrypted Channel
Uses secure TLS version for HTTPS connections	Compliance, Networking
Found graphical window changes (likely an installer)	System Summary

https://oracle-edw-optim-analytics-platform.se-sto-1.linodeobjects.com/index.html#6geris.perez@goaa.org

Details

Name:	https://oracle-edw-optim-analytics-platform.se-sto-1.linodeobjects.com/index.html#6geris.perez@goaa.org
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser

Signature Hits	Behavior Group	Mitre Attack
AI detected phishing page	Phishing
HTML page contains hidden URLs	Phishing
HTML page contains suspicious javascript code	Phishing
HTML body contains low number of good links	Phishing
HTML body contains password input but no form action	Phishing
HTML body with high number of embedded images detected	Phishing
HTML page contains hidden javascript code	Phishing
HTML title does not match URL	Phishing
Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)	Phishing	Scripting Deobfuscate/Decode Files or Information
HTML body contains password input	Phishing
HTML page is missing a favicon	Phishing
META author tag missing	Phishing
META copyright tag missing	Phishing

https://risaleinurtz.com/wp-includes/tracking/#geris.perez@goaa.org

185.31.22.130

Details

Name:	http://email-tracking.jotelulu.com/c/eJx0yjFyhSAQANDTQBeHXVaFgiKN90B29ZMQdRCSGU-fyQFSv8dhHdmSlgAzOjIEnvQrgLeSVgTrMPlRmBmtoMA2-W1NE-gc0CCBMQ4mmCwNntfkeJxnEYpuc4rMx9mk9NKHdH7pEl6tXbey7woXhUvNdyySj17b8xcULj_XWz5S6Sy3wqXVmD7zsSu0u9R8D5dUeRSZ_YxxOOuua_gHvgP-BgAA__-1WEOb
IP:	185.31.22.130
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

Domains

Name

Malicious

quantumazurao.com.de

172.67.175.211

oracle-edw-optim-analytics-platform.se-sto-1.linodeobjects.com

unknown

risaleinurtz.com

188.125.160.35

code.jquery.com

151.101.130.137

cdnjs.cloudflare.com

104.17.24.14

challenges.cloudflare.com

104.18.94.41

www.google.com

216.58.206.68

ha-dcx.jotelulu.com

185.31.22.130

email-tracking.jotelulu.com

unknown

goaa.org

unknown

IPs

Domain

Country

Malicious

172.67.175.211

quantumazurao.com.de

United States

104.21.83.121

unknown

United States

104.17.24.14

cdnjs.cloudflare.com

United States

1.1.1.1

unknown

Australia

142.250.74.206

unknown

United States

104.18.94.41

challenges.cloudflare.com

United States

192.168.2.16

unknown

104.18.95.41

unknown

United States

172.232.133.61

unknown

United States

185.31.22.130

ha-dcx.jotelulu.com

Spain

216.58.206.68

www.google.com

United States

151.101.130.137

code.jquery.com

United States

142.250.181.227

unknown

United States

239.255.255.250

unknown

Reserved

142.250.185.131

unknown

United States

142.250.184.238

unknown

United States

151.101.194.137

unknown

United States

188.125.160.35

risaleinurtz.com

Turkey

104.17.25.14

unknown

United States

66.102.1.84

unknown

United States

There are 10 hidden IPs, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
http://email-tracking.jotelulu.com/c/eJx0yjFyhSAQANDTQBeHXVaFgiKN90B29ZMQdRCSGU-fyQFSv8dhHdmSlgAzOjIEnvQrgLeSVgTrMPlRmBmtoMA2-W1NE-gc0CCBMQ4mmCwNntfkeJxnEYpuc4rMx9mk9NKHdH7pEl6tXbey7woXhUvNdyySj17b8xcULj_XWz5S6Sy3wqXVmD7zsSu0u9R8D5dUeRSZ_YxxOOuua_gHvgP-BgAA__-1WEOb

Files

URLs

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttp://email-tracking.jotelulu.com/c/eJx0yjFyhSAQANDTQBeHXVaFgiKN90B29ZMQdRCSGU-fyQFSv8dhHdmSlgAzOjIEnvQrgLeSVgTrMPlRmBmtoMA2-W1NE-gc0CCBMQ4mmCwNntfkeJxnEYpuc4rMx9mk9NKHdH7pEl6tXbey7woXhUvNdyySj17b8xcULj_XWz5S6Sy3wqXVmD7zsSu0u9R8D5dUeRSZ_YxxOOuua_gHvgP-BgAA__-1WEOb

Files

URLs

Domains

IPs

IOC Report
http://email-tracking.jotelulu.com/c/eJx0yjFyhSAQANDTQBeHXVaFgiKN90B29ZMQdRCSGU-fyQFSv8dhHdmSlgAzOjIEnvQrgLeSVgTrMPlRmBmtoMA2-W1NE-gc0CCBMQ4mmCwNntfkeJxnEYpuc4rMx9mk9NKHdH7pEl6tXbey7woXhUvNdyySj17b8xcULj_XWz5S6Sy3wqXVmD7zsSu0u9R8D5dUeRSZ_YxxOOuua_gHvgP-BgAA__-1WEOb