Windows Analysis Report
https://viewer.grandtransfer.io/junita-naude/b0jnd84d

Overview

General Information

Sample URL: https://viewer.grandtransfer.io/junita-naude/b0jnd84d
Analysis ID: 1541828
Infos:

Detection

Score: 1
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

HTML page contains hidden javascript code
Program does not show much activity (idle)

Classification

HTML page contains hidden javascript code
Source: https://viewer.grandtransfer.io/junita-naude/b0jnd84d HTTP Parser: Base64 decoded: <?xml version="1.0" encoding="UTF-8" standalone="no"?><svg width="9px" height="29px" viewBox="0 0 9 29" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <!-- Generator: Sketch 39 (31667) - http://www.bohemi...
Source: https://www.grandtransfer.io/ HTTP Parser: No favicon
Source: chromecache_248.2.dr String found in binary or memory: Math.round(q);u["gtm.videoElapsedTime"]=Math.round(f);u["gtm.videoPercent"]=r;u["gtm.videoVisible"]=t;return u},lk:function(){e=zb()},ud:function(){d()}}};var gc=ma(["data-gtm-yt-inspected-"]),pD=["www.youtube.com","www.youtube-nocookie.com"],qD,rD=!1; equals www.youtube.com (Youtube)
Source: chromecache_248.2.dr String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=WA(a,c,e);U(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return U(122),!0;if(d&&f){for(var m=Kb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},ZA=function(){var a=[],b=function(c){return pb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_248.2.dr String found in binary or memory: if(!(e||f||g||k.length||m.length))return;var p={rh:e,ph:f,qh:g,bi:k,di:m,Je:n,Fb:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};F(function(){for(var t=E.getElementsByTagName("script"),v=t.length,u=0;u<v;u++){var w=t[u].getAttribute("src");if(AD(w,"iframe_api")||AD(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!rD&&yD(x[A],p.Je))return xc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_248.2.dr String found in binary or memory: var CC=function(a,b,c,d,e){var f=tA("fsl",c?"nv.mwt":"mwt",0),g;g=c?tA("fsl","nv.ids",[]):tA("fsl","ids",[]);if(!g.length)return!0;var k=yA(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);U(121);if(m==="https://www.facebook.com/tr/")return U(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!fz(k,hz(b, equals www.facebook.com (Facebook)
Source: chromecache_257.2.dr String found in binary or memory: http://fian.my.id/Waves
Source: chromecache_257.2.dr String found in binary or memory: http://opensource.org/licenses/MIT
Source: chromecache_303.2.dr String found in binary or memory: http://scripts.sil.org/OFLThis
Source: chromecache_303.2.dr String found in binary or memory: http://scripts.sil.org/OFLhttps://rsms.me/Rasmus
Source: chromecache_248.2.dr String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_257.2.dr String found in binary or memory: https://animate.style/
Source: chromecache_248.2.dr String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_222.2.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/tilt.js/1.0.3/tilt.jquery.min.js
Source: chromecache_222.2.dr String found in binary or memory: https://code.jquery.com/jquery-3.6.4.min.js
Source: chromecache_257.2.dr String found in binary or memory: https://fengyuanchen.github.io/cropperjs
Source: chromecache_217.2.dr String found in binary or memory: https://flareapp.io/?utm_campaign=ignition&utm_source=ignition
Source: chromecache_217.2.dr String found in binary or memory: https://flareapp.io/docs/ignition-for-laravel/security
Source: chromecache_217.2.dr String found in binary or memory: https://flareapp.io/docs/ignition/introducing-ignition/overview
Source: chromecache_207.2.dr String found in binary or memory: https://fonts.gstatic.com/s/cairo/v28/SLXVc1nY6HkvangtZmpQdkhzfH5lkSscQyyS4J0.woff2)
Source: chromecache_207.2.dr String found in binary or memory: https://fonts.gstatic.com/s/cairo/v28/SLXVc1nY6HkvangtZmpQdkhzfH5lkSscRiyS.woff2)
Source: chromecache_207.2.dr String found in binary or memory: https://fonts.gstatic.com/s/cairo/v28/SLXVc1nY6HkvangtZmpQdkhzfH5lkSscSCyS4J0.woff2)
Source: chromecache_228.2.dr String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2)
Source: chromecache_228.2.dr String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS2mu1aB.woff2)
Source: chromecache_228.2.dr String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2)
Source: chromecache_228.2.dr String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2)
Source: chromecache_228.2.dr String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2)
Source: chromecache_228.2.dr String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2)
Source: chromecache_228.2.dr String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2)
Source: chromecache_228.2.dr String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSymu1aB.woff2)
Source: chromecache_228.2.dr String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2)
Source: chromecache_228.2.dr String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2)
Source: chromecache_257.2.dr String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_303.2.dr String found in binary or memory: https://github.com/rsms/inter)
Source: chromecache_217.2.dr String found in binary or memory: https://github.com/spatie/ignition/issues/new?title=$
Source: chromecache_217.2.dr String found in binary or memory: https://github.com/spatie/laravel-ignition
Source: chromecache_257.2.dr String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: chromecache_248.2.dr String found in binary or memory: https://google.com
Source: chromecache_248.2.dr String found in binary or memory: https://googleads.g.doubleclick.net
Source: chromecache_217.2.dr String found in binary or memory: https://laravel.com
Source: chromecache_257.2.dr String found in binary or memory: https://opensource.org/licenses/MIT/
Source: chromecache_248.2.dr String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_248.2.dr String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_257.2.dr String found in binary or memory: https://pqina.nl/filepond/
Source: chromecache_248.2.dr String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_217.2.dr, chromecache_257.2.dr String found in binary or memory: https://tailwindcss.com
Source: chromecache_248.2.dr String found in binary or memory: https://td.doubleclick.net
Source: chromecache_248.2.dr String found in binary or memory: https://www.google.com
Source: chromecache_350.2.dr, chromecache_309.2.dr String found in binary or memory: https://www.google.com/pagead/1p-user-list/11457722959/?random
Source: chromecache_248.2.dr String found in binary or memory: https://www.googleadservices.com
Source: chromecache_248.2.dr String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_248.2.dr String found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_222.2.dr String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-CRDV6LS71H
Source: chromecache_248.2.dr String found in binary or memory: https://www.googletagmanager.com/static/service_worker/
Source: chromecache_248.2.dr String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_248.2.dr String found in binary or memory: https://www.youtube.com/iframe_api
Source: classification engine Classification label: clean1.win@27/240@0/37
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=2004,i,16540415504840008357,3679919954908434296,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://viewer.grandtransfer.io/junita-naude/b0jnd84d"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=2004,i,16540415504840008357,3679919954908434296,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1541828 URL: https://viewer.grandtransfe... Startdate: 25/10/2024 Architecture: WINDOWS Score: 1 5 chrome.exe 1 2->5         started        8 chrome.exe 2->8         started        dnsIp3 13 192.168.2.23 unknown unknown 5->13 15 192.168.2.6 unknown unknown 5->15 17 239.255.255.250 unknown Reserved 5->17 10 chrome.exe 5->10         started        process4 dnsIp5 19 142.250.184.195 GOOGLEUS United States 10->19 21 142.250.184.196 GOOGLEUS United States 10->21 23 32 other IPs or domains 10->23
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.26.8.44
 unknown United States
13335 CLOUDFLARENETUS false
142.250.185.228
 unknown United States
15169 GOOGLEUS false
142.250.186.170
 unknown United States
15169 GOOGLEUS false
216.58.206.74
 unknown United States
15169 GOOGLEUS false
216.58.206.72
 unknown United States
15169 GOOGLEUS false
172.217.18.14
 unknown United States
15169 GOOGLEUS false
142.250.186.130
 unknown United States
15169 GOOGLEUS false
216.58.206.78
 unknown United States
15169 GOOGLEUS false
142.250.185.100
 unknown United States
15169 GOOGLEUS false
142.251.168.84
 unknown United States
15169 GOOGLEUS false
104.17.245.203
 unknown United States
13335 CLOUDFLARENETUS false
104.26.1.36
 unknown United States
13335 CLOUDFLARENETUS false
172.217.23.98
 unknown United States
15169 GOOGLEUS false
151.101.66.137
 unknown United States
54113 FASTLYUS false
35.190.80.1
 unknown United States
15169 GOOGLEUS false
142.250.184.200
 unknown United States
15169 GOOGLEUS false
104.21.15.213
 unknown United States
13335 CLOUDFLARENETUS false
142.250.186.98
 unknown United States
15169 GOOGLEUS false
142.250.184.195
 unknown United States
15169 GOOGLEUS false
142.250.184.196
 unknown United States
15169 GOOGLEUS false
104.17.246.203
 unknown United States
13335 CLOUDFLARENETUS false
1.1.1.1
 unknown Australia
13335 CLOUDFLARENETUS false
34.104.35.123
 unknown United States
15169 GOOGLEUS false
216.58.206.67
 unknown United States
15169 GOOGLEUS false
142.250.185.234
 unknown United States
15169 GOOGLEUS false
216.58.206.68
 unknown United States
15169 GOOGLEUS false
13.32.121.13
 unknown United States
16509 AMAZON-02US false
151.101.2.137
 unknown United States
54113 FASTLYUS false
239.255.255.250
 unknown Reserved
unknown unknown false
172.67.73.18
 unknown United States
13335 CLOUDFLARENETUS false
142.250.185.131
 unknown United States
15169 GOOGLEUS false
104.26.0.36
 unknown United States
13335 CLOUDFLARENETUS false
142.250.186.168
 unknown United States
15169 GOOGLEUS false
104.17.25.14
 unknown United States
13335 CLOUDFLARENETUS false
104.18.26.50
 unknown United States
13335 CLOUDFLARENETUS false

Private

IP
192.168.2.6
192.168.2.23

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://www.grandtransfer.io/ false
    		unknown
    https://app.grandtransfer.io/?wqx=B5fG7hJ2kL8pZ9qR3sT6uY0vX4wE false
      		unknown
      https://viewer.grandtransfer.io/junita-naude/b0jnd84d false
        		unknown