Windows Analysis Report
http://bervokter-pdf.vercel.app/

Overview

General Information

Sample URL:	http://bervokter-pdf.vercel.app/
Analysis ID:	1532666
Tags:	openphish
Infos:

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

AI detected phishing page (G)

Antivirus / Scanner detection for submitted sample

Yara detected HtmlPhish64

Phishing site detected (based on logo match)

HTML body contains low number of good links

HTML title does not match URL

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://bervokter-pdf.vercel.app/

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

AI detected phishing page

Source: https://bervokter-pdf.vercel.app/

LLM: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'bervokter-pdf.vercel.app' does not match the legitimate domain for Microsoft., The domain 'vercel.app' is a platform for deploying web applications, which could be used by anyone, including potential phishers., The presence of an email input field suggests a potential attempt to collect user credentials., The URL contains a subdomain 'bervokter-pdf' which is not associated with Microsoft and could be used to disguise a phishing attempt. DOM: 0.0.pages.csv

AI detected phishing page (G)

Source: https://bervokter-pdf.vercel.app/

LLM: Score: 9 Reasons: The URL "bervokter-pdf.vercel.app" does not match the legitimate domain "microsoft.com"., The URL uses a free hosting service, "vercel.app", which is often used for phishing., The input field "Entrez l'adresse e-mail" (Enter email address) suggests potential credential harvesting., The URL and brand name do not align. The presence of 'pdf' in the URL combined with a request for an email address raises suspicion of a document-related phishing attempt. DOM: 0.0.pages.csv

Yara detected HtmlPhish64

Source: Yara match

File source: 0.0.pages.csv, type: HTML

Phishing site detected (based on logo match)

Source: https://bervokter-pdf.vercel.app/

Matcher: Template: microsoft matched

HTML body contains low number of good links

Source: https://bervokter-pdf.vercel.app/

HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://bervokter-pdf.vercel.app/

HTTP Parser: Title: Vite + React does not match URL

Source: https://bervokter-pdf.vercel.app/

HTTP Parser: No <meta name="author".. found

Source: https://bervokter-pdf.vercel.app/

HTTP Parser: No <meta name="copyright".. found

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.206.229.209:443 -> 192.168.2.9:49737 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.9:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.9:49738 version: TLS 1.2

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.206.229.209:443 -> 192.168.2.9:49737 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/index-om7KAz33.css HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://bervokter-pdf.vercel.appsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://bervokter-pdf.vercel.app/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/index-CziX4pvh.js HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://bervokter-pdf.vercel.appsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://bervokter-pdf.vercel.app/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/one-DPd2foRy.png HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://bervokter-pdf.vercel.app/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/index-CziX4pvh.js HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/pdf-C_Kx5N2u.png HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://bervokter-pdf.vercel.app/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cap-gLOFRe8y.png HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://bervokter-pdf.vercel.app/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/pdf-C_Kx5N2u.png HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/one-DPd2foRy.png HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vite.svg HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://bervokter-pdf.vercel.app/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cap-gLOFRe8y.png HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vite.svg HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=TeEbNNf6GOeoyh4&MD=V8ylHyrs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=TeEbNNf6GOeoyh4&MD=V8ylHyrs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: bervokter-pdf.vercel.app
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: chromecache_73.2.dr, chromecache_72.2.dr

String found in binary or memory: https://api.telegram.org/bot$

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.9:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.9:49738 version: TLS 1.2

Source: classification engine

Classification label: mal76.phis.win@17/27@8/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1820,i,2443516456565889193,15840801216138353134,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://bervokter-pdf.vercel.app/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1820,i,2443516456565889193,15840801216138353134,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
76.76.21.123	unknown	United States	16509	AMAZON-02US	false
76.76.21.164	bervokter-pdf.vercel.app	United States	16509	AMAZON-02US	true
76.76.21.241	unknown	United States	16509	AMAZON-02US	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.8
192.168.2.9

Contacted Domains

Name	IP	Active
bervokter-pdf.vercel.app	76.76.21.164	true
www.google.com	142.250.185.100	true

Contacted URLs

Name	Malicious	Reputation
https://bervokter-pdf.vercel.app/assets/cap-gLOFRe8y.png	true	unknown
http://bervokter-pdf.vercel.app/	true	unknown
https://bervokter-pdf.vercel.app/assets/one-DPd2foRy.png	true	unknown
https://bervokter-pdf.vercel.app/assets/pdf-C_Kx5N2u.png	true	unknown
https://bervokter-pdf.vercel.app/	true	unknown
https://bervokter-pdf.vercel.app/assets/index-CziX4pvh.js	true	unknown
https://bervokter-pdf.vercel.app/assets/index-om7KAz33.css	true	unknown
https://bervokter-pdf.vercel.app/vite.svg	true	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 13 17:04:23 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide	A139B687E1870B2A09CDA11DD66619CC	B45F1BB29FBA8706947CD366D8B242F01C0A2116	B9F5535E421B7C1895F42B936BD7D367935C70B236D98F2635BE9A6EF44B5AE8
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 13 17:04:23 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide	B7AAF96B27E117F918D1C24D472282B3	9BBA18609548071FC68109A51B7565D8B7C0B307	C9593CD88E4BE822C559BB879CAA1E074DD28ECC9D1870374458D163BF7D684D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:56:51 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide	466A66C8866260FC1E3DD6E4537D0B84	C363C474CEB3D201926D5242E6C222647FD2F330	FF698CB6BE814AE8065594430033589742C47B9B1AA838672E5B28C69F60F07B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 13 17:04:23 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide	0022C479FA4B550F520F1665E27846C5	BB6716C324C31E7E7F3C16E3E298BEA6BEC1C5EE	51E0824836DA00B99422103AE1D1AF1239988EA78B1EBB7F822A122915F861C1
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 13 17:04:23 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide	F0DDB90C333486DBB996295E2BD19A3E	59EC115F79114082F3CC5B88F246FF37CB144E2C	A78114BDDBDA2A26632033A23C233C742FAFCDB1B722B81E5F277A4C5717DE4D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 13 17:04:23 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide	9DEAC08BEBC38B9CF3DEA9445F343E7A	83E34EFD7D8F7ED6106A1E738D12E8EB728560A9	6F68BFE7B4ABEC37E4A6D50F3F62A0F59E5684211E8AA5EF972B85B19528B696
Chrome Cache Entry: 64	SVG Scalable Vector Graphics image	8E3A10E157F75ADA21AB742C022D5430	F7F39D7237B791A945D52A5CD7A8FB365F313366	4A748AFD443918BB16591C834C401DAE33E87861AB5DBAD0811C3A3B4A9214FB
Chrome Cache Entry: 65	ASCII text, with no line terminators	F3155BDCB85075E0B4BCF727139D5AD6	0F099341DFDF8B3CE0BF4AF8A51A6693772F7EAF	90CC57D323091ADB634C0BCA441ED89A6BD83959E243D0580B80D2CD976F70CE
Chrome Cache Entry: 66	HTML document, ASCII text	16E4D9ADC00E40993447D8F6AA38BF87	3525CF3C15E87C4708851AD8B1CC4C4558F9D92F	041A092A01757D7B43B4C18ACD1B09F6A140EF8B2F82B6F6EAB2D0B12CE42278
Chrome Cache Entry: 67	SVG Scalable Vector Graphics image	8E3A10E157F75ADA21AB742C022D5430	F7F39D7237B791A945D52A5CD7A8FB365F313366	4A748AFD443918BB16591C834C401DAE33E87861AB5DBAD0811C3A3B4A9214FB
Chrome Cache Entry: 68	ASCII text, with very long lines (1785)	3B419C38517388222CB4A35C2DED1B8B	EFD61FA2388A9DC06D89332BFDFCC7FB7DAEAC36	BB740C11564321E47FD1DD7D9166865768DD4E2430BEA03AE4CD3DC396258B77
Chrome Cache Entry: 69	PNG image data, 400 x 206, 8-bit/color RGBA, non-interlaced	DB23FD5BA63C04F0D75AD6A15EEC1E0E	71AD87E225AE7D7357121193F952E99372251AE0	39F1107B38D187B7AE1C895DF8E4ACB805117D22DD090A8A64082EC9DDBA39D7
Chrome Cache Entry: 70	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced	49D4041B8E7E375F3E2950A9738BC59B	CD3DC4E38CE48E26DF8F216503D6027BFBD22378	1D6F06C578FBE919BEEC761B4B1F7D75445753B0DB44EAD4039BD71E4C3C098E
Chrome Cache Entry: 71	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced	49D4041B8E7E375F3E2950A9738BC59B	CD3DC4E38CE48E26DF8F216503D6027BFBD22378	1D6F06C578FBE919BEEC761B4B1F7D75445753B0DB44EAD4039BD71E4C3C098E
Chrome Cache Entry: 72	ASCII text, with very long lines (37509)	262A7312092CC5724E74ADEAFEAAA6B9	0454C1A4EEE035A226E0E6F2D21A532B67073277	453517D5B0145F1AC3837E2FA306796706DAC5EFE5C5E32A3F9EC9B95126487C
Chrome Cache Entry: 73	ASCII text, with very long lines (37509)	262A7312092CC5724E74ADEAFEAAA6B9	0454C1A4EEE035A226E0E6F2D21A532B67073277	453517D5B0145F1AC3837E2FA306796706DAC5EFE5C5E32A3F9EC9B95126487C
Chrome Cache Entry: 74	PNG image data, 606 x 116, 8-bit/color RGBA, non-interlaced	769E47EC9E2528C2D27CB544028BA052	8CA13D1D50DF7CF95E2534E64BAF182FC5C68E0C	279719B16BCD2D76128567447A3B0587654C6B6E506E6D2DA266703BC2010059
Chrome Cache Entry: 75	PNG image data, 606 x 116, 8-bit/color RGBA, non-interlaced	769E47EC9E2528C2D27CB544028BA052	8CA13D1D50DF7CF95E2534E64BAF182FC5C68E0C	279719B16BCD2D76128567447A3B0587654C6B6E506E6D2DA266703BC2010059
Chrome Cache Entry: 76	PNG image data, 400 x 206, 8-bit/color RGBA, non-interlaced	DB23FD5BA63C04F0D75AD6A15EEC1E0E	71AD87E225AE7D7357121193F952E99372251AE0	39F1107B38D187B7AE1C895DF8E4ACB805117D22DD090A8A64082EC9DDBA39D7

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://bervokter-pdf.vercel.app/

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

AI detected phishing page

Source: https://bervokter-pdf.vercel.app/

AI detected phishing page (G)

Source: https://bervokter-pdf.vercel.app/

Yara detected HtmlPhish64

Source: Yara match

File source: 0.0.pages.csv, type: HTML

Phishing site detected (based on logo match)

Source: https://bervokter-pdf.vercel.app/

Matcher: Template: microsoft matched

HTML body contains low number of good links

Source: https://bervokter-pdf.vercel.app/

HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://bervokter-pdf.vercel.app/

HTTP Parser: Title: Vite + React does not match URL

Source: https://bervokter-pdf.vercel.app/

HTTP Parser: No <meta name="author".. found

Source: https://bervokter-pdf.vercel.app/

HTTP Parser: No <meta name="copyright".. found

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.206.229.209:443 -> 192.168.2.9:49737 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.9:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.9:49738 version: TLS 1.2

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.206.229.209:443 -> 192.168.2.9:49737 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/index-om7KAz33.css HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://bervokter-pdf.vercel.appsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://bervokter-pdf.vercel.app/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/index-CziX4pvh.js HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://bervokter-pdf.vercel.appsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://bervokter-pdf.vercel.app/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/one-DPd2foRy.png HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://bervokter-pdf.vercel.app/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/index-CziX4pvh.js HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/pdf-C_Kx5N2u.png HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://bervokter-pdf.vercel.app/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cap-gLOFRe8y.png HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://bervokter-pdf.vercel.app/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/pdf-C_Kx5N2u.png HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/one-DPd2foRy.png HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vite.svg HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://bervokter-pdf.vercel.app/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cap-gLOFRe8y.png HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vite.svg HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=TeEbNNf6GOeoyh4&MD=V8ylHyrs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=TeEbNNf6GOeoyh4&MD=V8ylHyrs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: bervokter-pdf.vercel.appConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: bervokter-pdf.vercel.app
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: chromecache_73.2.dr, chromecache_72.2.dr

String found in binary or memory: https://api.telegram.org/bot$

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.9:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.9:49738 version: TLS 1.2

Source: classification engine

Classification label: mal76.phis.win@17/27@8/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1820,i,2443516456565889193,15840801216138353134,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://bervokter-pdf.vercel.app/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1820,i,2443516456565889193,15840801216138353134,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1532666
Product:	CloudBasic
Start time:	20:03:14
Start date:	13.10.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
http://bervokter-pdf.vercel.app/

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report http://bervokter-pdf.vercel.app/

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
http://bervokter-pdf.vercel.app/