Windows Analysis Report
https://na2.docusign.net/Signing/EmailStart.aspx?a=411d2d60-71ee-4477-b645-ccd87151891a&etti=24&acct=b31151fe-1c65-4015-aade-ea249bb0ede6&er=8c8c89ec-97a5-4f5f-882c-1f8e280db0ce&ensd=OlmiHSbJ0eI9ZkG%2fXULDaodBOGI8IJu%2bHw6FQ6MJzij7aDyjpUTWeytYGpq%2fEBOjTDkWOuiaWcxRrawwnlYKXPH6Fk6EMtNu%2fTwdy7t%2bXYp

Overview

General Information

Sample URL: https://na2.docusign.net/Signing/EmailStart.aspx?a=411d2d60-71ee-4477-b645-ccd87151891a&etti=24&acct=b31151fe-1c65-4015-aade-ea249bb0ede6&er=8c8c89ec-97a5-4f5f-882c-1f8e280db0ce&ensd=OlmiHSbJ0eI9ZkG%2
Analysis ID: 1592121

Detection

Score: 0
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

Stores files to the Windows start menu directory

Classification

Source: unknown HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49862 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49865 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49869 version: TLS 1.2
Source: unknown HTTPS traffic detected: 2.21.65.154:443 -> 192.168.2.17:49872 version: TLS 1.2
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: na2.docusign.net
Source: global traffic DNS traffic detected: DNS query: docucdn-a.akamaihd.net
Source: global traffic DNS traffic detected: DNS query: a.docusign.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: api.mixpanel.com
Source: global traffic DNS traffic detected: DNS query: cdn.optimizely.com
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49862 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49865 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49869 version: TLS 1.2
Source: unknown HTTPS traffic detected: 2.21.65.154:443 -> 192.168.2.17:49872 version: TLS 1.2
Source: classification engine Classification label: clean0.win@17/6@26/231
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2040,i,5131827569293070027,12081103185802972364,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://na2.docusign.net/Signing/EmailStart.aspx?a=411d2d60-71ee-4477-b645-ccd87151891a&etti=24&acct=b31151fe-1c65-4015-aade-ea249bb0ede6&er=8c8c89ec-97a5-4f5f-882c-1f8e280db0ce&ensd=OlmiHSbJ0eI9ZkG%2fXULDaodBOGI8IJu%2bHw6FQ6MJzij7aDyjpUTWeytYGpq%2fEBOjTDkWOuiaWcxRrawwnlYKXPH6Fk6EMtNu%2fTwdy7t%2bXYptuLXzPRFx2bwYBDlgm%2fJsIgELi73m%2fMoWXuACiexoKFdy63uKkWu%2fC9YSun8cCbWrY5iSlNo5zrB766tKJkTq"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2040,i,5131827569293070027,12081103185802972364,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: Window Recorder Window detected: More than 3 window changes detected
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.186.68
 www.google.com United States
15169 GOOGLEUS false
142.250.185.78
 unknown United States
15169 GOOGLEUS false
104.18.66.57
 unknown United States
13335 CLOUDFLARENETUS false
162.248.185.182
 unknown United States
62856 DOCUS-6-PRODUS false
1.1.1.1
 unknown Australia
13335 CLOUDFLARENETUS false
108.177.15.84
 unknown United States
15169 GOOGLEUS false
162.248.185.183
 unknown United States
62856 DOCUS-6-PRODUS false
130.211.34.183
 unknown United States
15169 GOOGLEUS false
104.18.65.57
 cdn.optimizely.com United States
13335 CLOUDFLARENETUS false
216.58.212.131
 unknown United States
15169 GOOGLEUS false
142.250.185.202
 unknown United States
15169 GOOGLEUS false
52.33.142.237
 arya-1323461286.us-west-2.elb.amazonaws.com United States
16509 AMAZON-02US false
107.178.240.159
 api.mixpanel.com United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
142.250.185.131
 unknown United States
15169 GOOGLEUS false
88.221.110.137
 unknown European Union
20940 AKAMAI-ASN1EU false
142.250.184.238
 unknown United States
15169 GOOGLEUS false
35.82.118.181
 unknown United States
237 MERIT-AS-14US false
172.217.16.196
 unknown United States
15169 GOOGLEUS false
95.101.54.105
 unknown European Union
34164 AKAMAI-LONGB false

Private

IP
192.168.2.17
192.168.2.18

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.214.172 true
cdn.optimizely.com 104.18.65.57 true
www.google.com 142.250.186.68 true
api.mixpanel.com 107.178.240.159 true
arya-1323461286.us-west-2.elb.amazonaws.com 52.33.142.237 true
a.docusign.com unknown unknown
docucdn-a.akamaihd.net unknown unknown
na2.docusign.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://na2.docusign.net/Signing/?ti=0ad76c2732f84028a6a7c2f993b05b52 false
    		unknown