IOC Report
https://ddazcdn01.z8.web.core.windows.net/2024/09-SEP/IDIS/027/IDI-207%20More%20Pixels.pdf?utm_source=Security+Electronics+%26+Networks+Newsletter&utm_campaign=836c3fcc0c-EMAIL_CAMPAIGN_2024_11_25_02_59&utm_medium=email&utm_term=0_-836c3fcc0c-99727273

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 04:01:03 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 04:01:03 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 04:01:03 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 04:01:03 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 04:01:03 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\Downloads\11c4a42a-574f-4643-9166-1d2ca684add1.tmp
PDF document, version 1.4
dropped
C:\Users\user\Downloads\327b0f02-a84f-4033-91b7-97c0f91b68bd.tmp
PDF document, version 1.4, 1 pages
dropped
C:\Users\user\Downloads\downloaded.pdf (copy)
PDF document, version 1.4, 1 pages
dropped
C:\Users\user\Downloads\downloaded.pdf.crdownload
PDF document, version 1.4, 1 pages
dropped
Chrome Cache Entry: 132
assembler source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
downloaded
Chrome Cache Entry: 133
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
downloaded
Chrome Cache Entry: 134
ASCII text, with very long lines (5945)
downloaded
Chrome Cache Entry: 135
ASCII text, with very long lines (26548), with CRLF line terminators
downloaded
Chrome Cache Entry: 136
ASCII text, with very long lines (1941), with CRLF line terminators
dropped
Chrome Cache Entry: 137
ASCII text, with very long lines (46999), with CRLF line terminators
dropped
Chrome Cache Entry: 138
ASCII text, with very long lines (2363), with CRLF line terminators
downloaded
Chrome Cache Entry: 139
Unicode text, UTF-8 (with BOM) text, with very long lines (6579), with no line terminators
dropped
Chrome Cache Entry: 140
ASCII text, with very long lines (1941), with CRLF line terminators
downloaded
Chrome Cache Entry: 141
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
dropped
Chrome Cache Entry: 142
ASCII text
downloaded
Chrome Cache Entry: 143
ASCII text, with very long lines (44089), with no line terminators
downloaded
Chrome Cache Entry: 144
Unicode text, UTF-8 (with BOM) text, with very long lines (65533), with no line terminators
downloaded
Chrome Cache Entry: 145
Unicode text, UTF-8 (with BOM) text, with very long lines (1864), with CRLF line terminators
dropped
Chrome Cache Entry: 146
GIF image data, version 89a, 200 x 200
downloaded
Chrome Cache Entry: 147
ASCII text, with very long lines (19015), with CRLF line terminators
dropped
Chrome Cache Entry: 148
ASCII text, with very long lines (32074), with CRLF line terminators
downloaded
Chrome Cache Entry: 149
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
downloaded
Chrome Cache Entry: 150
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
downloaded
Chrome Cache Entry: 151
Unicode text, UTF-8 (with BOM) text, with very long lines (65533), with no line terminators
dropped
Chrome Cache Entry: 152
ASCII text, with very long lines (46999), with CRLF line terminators
downloaded
Chrome Cache Entry: 153
ASCII text, with very long lines (61524), with CRLF line terminators
downloaded
Chrome Cache Entry: 154
PNG image data, 594 x 231, 8-bit colormap, non-interlaced
downloaded
Chrome Cache Entry: 155
HTML document, ASCII text, with very long lines (65370), with CRLF line terminators
downloaded
Chrome Cache Entry: 156
ASCII text, with very long lines (34443), with no line terminators
downloaded
Chrome Cache Entry: 157
PNG image data, 1440 x 1024, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 158
ASCII text, with very long lines (34443), with no line terminators
dropped
Chrome Cache Entry: 159
Unicode text, UTF-8 (with BOM) text, with very long lines (36506), with CRLF line terminators
downloaded
Chrome Cache Entry: 160
HTML document, ASCII text, with very long lines (321), with no line terminators
downloaded
Chrome Cache Entry: 161
PNG image data, 594 x 231, 8-bit colormap, non-interlaced
dropped
Chrome Cache Entry: 162
ASCII text, with CRLF line terminators
downloaded
Chrome Cache Entry: 163
ASCII text, with very long lines (48664), with CRLF line terminators
downloaded
Chrome Cache Entry: 164
ASCII text, with very long lines (59158), with CRLF line terminators
downloaded
Chrome Cache Entry: 165
Unicode text, UTF-8 (with BOM) text, with very long lines (61332), with no line terminators
downloaded
Chrome Cache Entry: 166
ASCII text, with very long lines (2343)
dropped
Chrome Cache Entry: 167
ASCII text, with very long lines (16769)
dropped
Chrome Cache Entry: 168
ASCII text
downloaded
Chrome Cache Entry: 169
ASCII text, with very long lines (1340), with no line terminators
dropped
Chrome Cache Entry: 170
ASCII text, with very long lines (5945)
dropped
Chrome Cache Entry: 171
ASCII text, with very long lines (3184), with CRLF line terminators
downloaded
Chrome Cache Entry: 172
ASCII text, with very long lines (65320), with CRLF line terminators
downloaded
Chrome Cache Entry: 173
PNG image data, 1440 x 1024, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 174
ASCII text, with very long lines (7725), with CRLF line terminators
downloaded
Chrome Cache Entry: 175
MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
Chrome Cache Entry: 176
Unicode text, UTF-8 (with BOM) text, with very long lines (61332), with no line terminators
dropped
Chrome Cache Entry: 177
MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
downloaded
Chrome Cache Entry: 178
ASCII text, with very long lines (31995), with CRLF line terminators
downloaded
Chrome Cache Entry: 179
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 180
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 181
Unicode text, UTF-8 text, with very long lines (17027), with CRLF line terminators
downloaded
Chrome Cache Entry: 182
ASCII text, with very long lines (48664), with CRLF line terminators
dropped
Chrome Cache Entry: 183
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
dropped
Chrome Cache Entry: 184
Web Open Font Format (Version 2), TrueType, length 18596, version 1.0
downloaded
Chrome Cache Entry: 185
ASCII text, with very long lines (31997), with CRLF line terminators
downloaded
Chrome Cache Entry: 186
Unicode text, UTF-8 text, with very long lines (65508), with no line terminators
downloaded
Chrome Cache Entry: 187
Web Open Font Format (Version 2), TrueType, length 18536, version 1.0
downloaded
Chrome Cache Entry: 188
ASCII text, with CRLF line terminators
downloaded
Chrome Cache Entry: 189
Unicode text, UTF-8 text, with very long lines (65508), with no line terminators
dropped
Chrome Cache Entry: 190
ASCII text, with very long lines (65326)
downloaded
Chrome Cache Entry: 191
ASCII text, with CRLF line terminators
dropped
Chrome Cache Entry: 192
PDF document, version 1.4, 1 pages
downloaded
Chrome Cache Entry: 193
HTML document, ASCII text, with very long lines (65370), with CRLF line terminators
dropped
Chrome Cache Entry: 194
ASCII text, with very long lines (846), with CRLF line terminators
downloaded
Chrome Cache Entry: 195
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 196
ASCII text, with very long lines (31997), with CRLF line terminators
dropped
Chrome Cache Entry: 197
ASCII text, with CRLF line terminators
downloaded
Chrome Cache Entry: 198
ASCII text, with CRLF line terminators
downloaded
Chrome Cache Entry: 199
ASCII text, with very long lines (19015), with CRLF line terminators
downloaded
Chrome Cache Entry: 200
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
downloaded
Chrome Cache Entry: 201
ASCII text, with very long lines (2343)
downloaded
Chrome Cache Entry: 202
ASCII text, with very long lines (16769)
downloaded
Chrome Cache Entry: 203
ASCII text, with very long lines (31995), with CRLF line terminators
dropped
Chrome Cache Entry: 204
ASCII text, with very long lines (1340), with no line terminators
downloaded
Chrome Cache Entry: 205
ASCII text, with very long lines (32074), with CRLF line terminators
dropped
Chrome Cache Entry: 206
Unicode text, UTF-8 (with BOM) text, with very long lines (36506), with CRLF line terminators
dropped
Chrome Cache Entry: 207
ASCII text, with very long lines (2243), with CRLF line terminators
downloaded
Chrome Cache Entry: 208
Unicode text, UTF-8 (with BOM) text, with very long lines (1864), with CRLF line terminators
downloaded
Chrome Cache Entry: 209
Web Open Font Format (Version 2), TrueType, length 13276, version 331.-31261
downloaded
Chrome Cache Entry: 210
ASCII text, with very long lines (3839), with CRLF line terminators
downloaded
Chrome Cache Entry: 211
Unicode text, UTF-8 (with BOM) text, with very long lines (6579), with no line terminators
downloaded
Chrome Cache Entry: 212
ASCII text
downloaded
There are 82 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1868 --field-trial-handle=2012,i,3957339790789937191,2753234968618942319,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ddazcdn01.z8.web.core.windows.net/2024/09-SEP/IDIS/027/IDI-207%20More%20Pixels.pdf?utm_source=Security+Electronics+%26+Networks+Newsletter&utm_campaign=836c3fcc0c-EMAIL_CAMPAIGN_2024_11_25_02_59&utm_medium=email&utm_term=0_-836c3fcc0c-99727273"

URLs

Name
IP
Malicious
https://ddazcdn01.z8.web.core.windows.net/2024/09-SEP/IDIS/027/IDI-207%20More%20Pixels.pdf?utm_source=Security+Electronics+%26+Networks+Newsletter&utm_campaign=836c3fcc0c-EMAIL_CAMPAIGN_2024_11_25_02_59&utm_medium=email&utm_term=0_-836c3fcc0c-99727273
https://go.dasrewards.com.au/i6j
52.72.49.79
https://portal.dickerdata.com.au/libs/codemirror/5.3.0/mode/xml/xml.min.js
103.248.44.19
http://fontawesome.io
unknown
https://stats.g.doubleclick.net/g/collect
unknown
https://portal.dickerdata.com.au/libs/bootstrap/4.0.0/js/bootstrap.min.js
103.248.44.19
https://portal.dickerdata.com.au/libs/angular-calendar@0.24.1/css/angular-calendar.css
103.248.44.19
https://portal.dickerdata.com.au/libs/OwlCarousel2/2.3.4/assets/owl.carousel.min.css
103.248.44.19
http://jqueryui.com
unknown
https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/
unknown
https://portal.dickerdata.com.au/images/new_ui/login-background.png
103.248.44.19
https://portal.dickerdata.com.au/libs/moment.js/2.22.2/moment-with-locales.min.js
103.248.44.19
https://ampcid.google.com/v1/publisher:getClientId
unknown
http://dbushell.com/
unknown
https://promisesaplus.com/#point-75
unknown
https://www.froala.com/wysiwyg-editor)
unknown
https://www.shutterstock.com/license?utm_source=iptc&utm_medium=googleimages&utm_campaign=we
unknown
https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled
unknown
https://portal.dickerdata.com.au/libs/froala-editor/2.9.8/css/froala_editor.pkgd.min.css
103.248.44.19
https://bugs.webkit.org/show_bug.cgi?id=29084
unknown
https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace
unknown
http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1
unknown
https://fontawesome.com
unknown
https://github.com/eslint/eslint/issues/6125
unknown
https://www.google.com
unknown
https://www.youtube.com/iframe_api
unknown
https://portal.dickerdata.com.au/libs/froala-editor/2.9.8/js/plugins/image.min.js
103.248.44.19
https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled
unknown
https://github.com/twbs/bootstrap/graphs/contributors)
unknown
https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=687787
unknown
https://portal.dickerdata.com.au/libs/froala-editor/2.9.8/css/froala_style.min.css
103.248.44.19
https://portal.dickerdata.com.au/dist/polyfills.js
103.248.44.19
https://stats.g.doubleclick.net/j/collect
unknown
https://bugs.chromium.org/p/chromium/issues/detail?id=470258
unknown
http://opensource.org/licenses/MIT).
unknown
https://bugs.jquery.com/ticket/13378
unknown
https://promisesaplus.com/#point-64
unknown
https://portal.dickerdata.com.au/libs/codemirror/5.3.0/codemirror.min.js
103.248.44.19
https://portal.dickerdata.com.au/images/new_ui/dd-progress.gif
103.248.44.19
https://portal.dickerdata.com.au/libs/popper.js/1.12.9/umd/popper.min.js
103.248.44.19
https://promisesaplus.com/#point-61
unknown
https://portal.dickerdata.com.au/css/ng-drag-drop.css
103.248.44.19
https://portal.dickerdata.com.au/libs/handsontable/6.1.1/handsontable.full.min.css
103.248.44.19
http://ns.useplus.org/ldf/xmp/1.0/
unknown
https://portal.dickerdata.com.au/libs/OwlCarousel2/2.3.4/assets/owl.theme.default.min.css
103.248.44.19
https://portal.dickerdata.com.au/dist/main.js
103.248.44.19
https://portal.dickerdata.com.au/js/site.min.js?v=1uvfbOf5HsEAhXk2xc_BeYf-gU9cCm21XWYKMxdoF_g
103.248.44.19
https://go.dasrewards.com.au/zlg)
unknown
https://portal.dickerdata.com.au/libs/font-awesome/4.4.0/css/font-awesome.min.css
103.248.44.19
https://portal.dickerdata.com.au/libs/jqueryui/1.12.1/jquery-ui.min.js
103.248.44.19
https://jsperf.com/getall-vs-sizzle/2
unknown
https://cct.google/taggy/agent.js
unknown
https://developer.mozilla.org/en-US/docs/CSS/display
unknown
https://jquery.com/
unknown
https://portal.dickerdata.com.au/images/DickerData_Logo_White_Red.png
103.248.44.19
https://www.google.%/ads/ga-audiences
unknown
https://portal.dickerdata.com.au/libs/bootstrap/4.0.0/css/bootstrap.min.css
103.248.44.19
https://github.com/twbs/bootstrap/blob/master/LICENSE)
unknown
https://froala.com/wysiwyg-editor/terms/
unknown
https://portal.dickerdata.com.au/libs/fontawesome/css/all.min.css
103.248.44.19
https://github.com/jquery/sizzle/pull/225
unknown
https://sizzlejs.com/
unknown
https://bugs.chromium.org/p/chromium/issues/detail?id=449857
unknown
https://portal.dickerdata.com.au/libs/moment.js/2.22.2/moment.min.js
103.248.44.19
https://portal.dickerdata.com.au/catalogues/newsletter/248/IDIS%20SURVEILLANCE/product/DC-D4516WRX-2.8MM-
103.248.44.19
https://portal.dickerdata.com.au/dist/runtime.js
103.248.44.19
https://bugs.webkit.org/show_bug.cgi?id=136851
unknown
https://portal.dickerdata.com.au/dist/styles.css?v=psPSWTzfR82N5nsMbXltps66dqCAdtUFmGcXU7vj9Qs
103.248.44.19
https://cdn.jsdelivr.net/npm/bootstrap-icons@1.3.0/font/bootstrap-icons.css
151.101.65.229
http://jquery.org/license
unknown
https://portal.dickerdata.com.au/libs/froala-editor/2.9.8/js/plugins/paragraph_style.min.js
103.248.44.19
https://jsperf.com/thor-indexof-vs-for/5
unknown
https://bugs.jquery.com/ticket/12359
unknown
https://portal.dickerdata.com.au/libs/fontawesome/webfonts/fa-regular-400.woff2
103.248.44.19
https://portal.dickerdata.com.au/libs/jqueryui/1.12.1/themes/smoothness/jquery-ui.css
103.248.44.19
https://portal.dickerdata.com.au/dist/vendor.js
103.248.44.19
https://html.spec.whatwg.org/#strip-and-collapse-whitespace
unknown
https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-a
unknown
https://www.gstatic.cn/charts/%
unknown
https://drafts.csswg.org/cssom/#common-serializing-idioms
unknown
https://fontawesome.com/license/free
unknown
https://portal.dickerdata.com.au/libs/jquery-3.3.1.js
103.248.44.19
https://portal.dickerdata.com.au/libs/froala-editor/2.9.8/js/froala_editor.pkgd.min.js
103.248.44.19
https://github.com/jquery/jquery/pull/557)
unknown
https://portal.dickerdata.com.au/js/foundation.min.js
103.248.44.19
https://bugs.chromium.org/p/chromium/issues/detail?id=378607
unknown
https://portal.dickerdata.com.au/libs/froala-editor/2.9.8/css/plugins/image.min.css
103.248.44.19
https://portal.dickerdata.com.au/css/cms/froala-custom-theme.css
103.248.44.19
https://portal.dickerdata.com.au/css/prebuilt-themes/indigo-pink.css
103.248.44.19
https://www.shutterstock.com/image-photo/610631507?utm_source=iptc&utm_medium=googleimages&u
unknown
https://portal.dickerdata.com.au/libs/codemirror/5.3.0/codemirror.min.css
103.248.44.19
https://portal.dickerdata.com.au/libs/froala-editor/2.9.8/css/plugins/code_view.min.css
103.248.44.19
https://portal.dickerdata.com.au/Account/Login?ReturnUrl=%2Fcatalogues%2Fnewsletter%2F248%2FIDIS%2520SURVEILLANCE%2Fproduct%2FDC-D4516WRX-2.8MM-
https://portal.dickerdata.com.au/libs/OwlCarousel2/2.3.4/owl.carousel.min.js
103.248.44.19
file:///C:/Users/user/Downloads/downloaded.pdf
https://portal.dickerdata.com.au/images/dd-favicon.ico
103.248.44.19
https://drafts.csswg.org/cssom/#resolved-values
unknown
https://bugs.chromium.org/p/chromium/issues/detail?id=589347
unknown
https://maps-api-ssl.google.com/maps?jsapiRedirect=true&file=googleapi
unknown
https://github.com/twbs/bootstrap/blob/main/LICENSE)
unknown
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
jsdelivr.map.fastly.net
151.101.65.229
go.dasrewards.com.au
52.72.49.79
portal.dickerdata.com.au
103.248.44.19
www.google.com
142.250.181.68
api.payway.com.au
203.2.216.174
cdn.jsdelivr.net
unknown

IPs

IP
Domain
Country
Malicious
52.72.49.79
go.dasrewards.com.au
United States
192.168.2.16
unknown
unknown
151.101.65.229
jsdelivr.map.fastly.net
United States
239.255.255.250
unknown
Reserved
103.248.44.19
portal.dickerdata.com.au
Australia
142.250.181.68
www.google.com
United States
203.2.216.174
api.payway.com.au
Australia

DOM / HTML

URL
Malicious
https://ddazcdn01.z8.web.core.windows.net/2024/09-SEP/IDIS/027/IDI-207%20More%20Pixels.pdf?utm_source=Security+Electronics+%26+Networks+Newsletter&utm_campaign=836c3fcc0c-EMAIL_CAMPAIGN_2024_11_25_02_59&utm_medium=email&utm_term=0_-836c3fcc0c-99727273
file:///C:/Users/user/Downloads/downloaded.pdf
file:///C:/Users/user/Downloads/downloaded.pdf
https://portal.dickerdata.com.au/Account/Login?ReturnUrl=%2Fcatalogues%2Fnewsletter%2F248%2FIDIS%2520SURVEILLANCE%2Fproduct%2FDC-D4516WRX-2.8MM-
https://portal.dickerdata.com.au/Account/Login?ReturnUrl=%2Fcatalogues%2Fnewsletter%2F248%2FIDIS%2520SURVEILLANCE%2Fproduct%2FDC-D4516WRX-2.8MM-