Windows Analysis Report
https://amazonbirr.com/index/login/reg/invite_code/699365

Overview

General Information

Sample URL:	https://amazonbirr.com/index/login/reg/invite_code/699365
Analysis ID:	1592281
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

AI detected suspicious URL

HTML body contains low number of good links

HTML body contains password input but no form action

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://amazonbirr.com/index/login/reg/invite_code/699365

Avira URL Cloud: detection malicious, Label: phishing

Antivirus detection for URL or domain

Source: https://amazonbirr.com/static/index/css/main.css	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/static/index/fonts/Rubik-Medium.4dff84c2.ttf	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/static/jquery-3.5.0.min.js	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/static/index/fonts/Rubik-BlackItalic.77c7f123.ttf	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/static/layer/theme/default/loading-2.gif	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/static/jquery.cookie.js	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/static/index/css/common.css?v=1	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/static/layer/layer.js	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/static/index/fonts/Rubik-Regular.35af6dbe.ttf	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/static/layer/theme/default/layer.css?v=3.1.1	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/index/login/reg.html	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/favicon.ico	Avira URL Cloud: Label: phishing

Phishing

AI detected suspicious URL

Source: URL	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://amazonbirr.com
Source: URL	Joe Sandbox AI: AI detected Typosquatting in URL: https://amazonbirr.com

HTML body contains low number of good links

Source: https://amazonbirr.com/index/login/reg/invite_code/699365

HTTP Parser: Number of links: 1

HTML body contains password input but no form action

Source: https://amazonbirr.com/index/login/reg/invite_code/699365

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://amazonbirr.com/index/login/reg/invite_code/699365

HTTP Parser: <input type="password" .../> found

Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No favicon
Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No favicon
Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No favicon
Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No favicon

Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No <meta name="author".. found
Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No <meta name="author".. found
Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No <meta name="author".. found
Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No <meta name="author".. found

Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No <meta name="copyright".. found
Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No <meta name="copyright".. found
Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No <meta name="copyright".. found
Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No <meta name="copyright".. found

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /index/login/reg/invite_code/699365 HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/index/css/main.css HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://amazonbirr.com/index/login/reg/invite_code/699365Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/index/css/common.css?v=1 HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://amazonbirr.com/index/login/reg/invite_code/699365Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/jquery-3.5.0.min.js HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://amazonbirr.com/index/login/reg/invite_code/699365Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/layer/layer.js HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://amazonbirr.com/index/login/reg/invite_code/699365Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/jquery.cookie.js HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://amazonbirr.com/index/login/reg/invite_code/699365Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/layer/layer.js HTTP/1.1Host: amazonbirr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/layer/theme/default/layer.css?v=3.1.1 HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://amazonbirr.com/index/login/reg/invite_code/699365Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/jquery.cookie.js HTTP/1.1Host: amazonbirr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/jquery-3.5.0.min.js HTTP/1.1Host: amazonbirr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/index/fonts/Rubik-BlackItalic.77c7f123.ttf HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://amazonbirr.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://amazonbirr.com/static/index/css/common.css?v=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/index/fonts/Rubik-Regular.35af6dbe.ttf HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://amazonbirr.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://amazonbirr.com/static/index/css/common.css?v=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/index/fonts/Rubik-Medium.4dff84c2.ttf HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://amazonbirr.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://amazonbirr.com/static/index/css/common.css?v=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /img/shadow-grey.png HTTP/1.1Host: cdn.dcloud.net.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://amazonbirr.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/shadow-grey.png HTTP/1.1Host: cdn.dcloud.net.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __uni__uid=rBEQRWeISCtt8+A2A2cpAg==
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://amazonbirr.com/index/login/reg/invite_code/699365Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: amazonbirr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/layer/theme/default/loading-2.gif HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://amazonbirr.com/static/layer/theme/default/layer.css?v=3.1.1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/layer/theme/default/loading-2.gif HTTP/1.1Host: amazonbirr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /index/login/reg.html HTTP/1.1Host: amazonbirr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /index/login/reg.html HTTP/1.1Host: amazonbirr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: amazonbirr.com
Source: global traffic	DNS traffic detected: DNS query: cdn.dcloud.net.cn

Source: unknown

HTTP traffic detected: POST /index/login/reg.html HTTP/1.1Host: amazonbirr.comConnection: keep-aliveContent-Length: 87sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: */*Content-Type: application/x-www-form-urlencoded; charset=UTF-8X-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://amazonbirr.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://amazonbirr.com/index/login/reg/invite_code/699365Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5

Source: chromecache_67.2.dr, chromecache_57.2.dr	String found in binary or memory: http://layer.layui.com/
Source: chromecache_55.2.dr	String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFL
Source: chromecache_71.2.dr	String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLRubikBlack
Source: chromecache_66.2.dr	String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLRubikMedium
Source: chromecache_62.2.dr, chromecache_63.2.dr	String found in binary or memory: https://github.com/carhartl/jquery-cookie

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: classification engine

Classification label: mal60.win@16/32@11/7

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2016,i,9889025774585612304,2690344116646378192,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://amazonbirr.com/index/login/reg/invite_code/699365"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2016,i,9889025774585612304,2690344116646378192,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
115.92.19.38	amazonbirr.com	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
124.222.174.117	unknown	China	45361	JCN-AS-KRUlsanJung-AngBroadcastingNetworkKR	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
124.220.205.65	cdn.dcloud.net.cn	China	45361	JCN-AS-KRUlsanJung-AngBroadcastingNetworkKR	false

Private

IP
192.168.2.7
192.168.2.4

Contacted Domains

Name	IP	Active
amazonbirr.com	115.92.19.38	true
www.google.com	172.217.18.4	true
cdn.dcloud.net.cn	124.220.205.65	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://amazonbirr.com/static/index/fonts/Rubik-BlackItalic.77c7f123.ttf	false	Avira URL Cloud: phishing	unknown
https://amazonbirr.com/static/layer/layer.js	false	Avira URL Cloud: phishing	unknown
https://cdn.dcloud.net.cn/img/shadow-grey.png	false		high
https://amazonbirr.com/static/index/fonts/Rubik-Medium.4dff84c2.ttf	false	Avira URL Cloud: phishing	unknown
https://amazonbirr.com/index/login/reg/invite_code/699365	true		unknown
https://amazonbirr.com/static/index/css/main.css	false	Avira URL Cloud: phishing	unknown
https://amazonbirr.com/static/layer/theme/default/loading-2.gif	false	Avira URL Cloud: phishing	unknown
https://amazonbirr.com/static/jquery.cookie.js	false	Avira URL Cloud: phishing	unknown
https://amazonbirr.com/static/index/css/common.css?v=1	false	Avira URL Cloud: phishing	unknown
https://amazonbirr.com/static/jquery-3.5.0.min.js	false	Avira URL Cloud: phishing	unknown
https://amazonbirr.com/static/index/fonts/Rubik-Regular.35af6dbe.ttf	false	Avira URL Cloud: phishing	unknown
https://amazonbirr.com/index/login/reg.html	false	Avira URL Cloud: phishing	unknown
https://amazonbirr.com/static/layer/theme/default/layer.css?v=3.1.1	false	Avira URL Cloud: phishing	unknown
https://amazonbirr.com/favicon.ico	false	Avira URL Cloud: phishing	unknown

Name	Type	MD5	SHA1	SHA256
Chrome Cache Entry: 54	Unicode text, UTF-8 text, with very long lines (7033), with CRLF line terminators	6522520DC3022F65534A8802C6A0506D	70EB54659DD534607AA5849ED67185382DB635F9	6D1FC6E9A3FBFA69A2A7B70F9680FBEE5DED42A3C6FE09FE55582C458F19808B
Chrome Cache Entry: 55	TrueType Font data, 20 tables, 1st "GPOS", 13 names, Microsoft, language 0x409, Copyright (c) 2015 by Hubert & Fischer. All rights reserved.RubikRegularHubert&Fischer: Rubik Re	35AF6DBE749B9704F03282E5A5949253	F0711CDC35046A54D1B887FAFBD12DE0A5B82549	C17737EBA7FA3F4854F4CD50226E75A9E954B4FC460D805B22E5C31A04B0261D
Chrome Cache Entry: 56	ASCII text, with no line terminators	0977D7E37E59DBE8BA38BEFC56C858E1	19CFB9BD3630762ED66646832138D68D19E04525	CBCB49396495009AC366461DC34EA09BC3E2BB499CD3F3342AFE96D15D2521F8
Chrome Cache Entry: 57	Unicode text, UTF-8 text, with very long lines (22032)	6E80F0CFF749C82653B9CDDE9EEAB937	7034E797787919A6742525A69723BF9DFDA13790	1CE6649D82D2DB0F8E4823F701DDFCFD9C7F107CB446C907E46EC7E57171A2A3
Chrome Cache Entry: 58	GIF image data, version 89a, 32 x 32	50C5E3E79B276C92DF6CC52CAEB464F0	C641615E851254111E268DA42D72AE684B3CE967	16EA0CF66D51EFDBBC2A62B11AB0419FA72FB3320844F1D0D710480245AC9925
Chrome Cache Entry: 59	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel	EA344923D7E68380C811191E36E04020	F23F0EC8C29DF2A1B31B0E0CB46E54E22420BCA1	97A8AA4A501654A28F1FE60E1FCE3F9070C80D698790BEB60B2D714F78BD786F
Chrome Cache Entry: 60	ASCII text, with very long lines (14367), with no line terminators	3D2E0D91C5C0B96ABB8DBDC2234ABA77	9D55E153B30FD7414FADA5718E20918E9C7F65E7	E3144D018A6A24F733C6FC2A2EE603FB583F0030585E9D4B71BEC471B78E31FC
Chrome Cache Entry: 61	ASCII text, with very long lines (65451)	12108007906290015100837A6A61E9F4	1D6AE46F2FFA213DEDE37A521B011EC1CD8D1AD3	C4DCCDD9AE25B64078E0C73F273DE94F8894D5C99E4741645ECE29AEEFC9C5A4
Chrome Cache Entry: 62	ASCII text	D5528DDE0006C78BE04817327C2F9B6F	31E1BCC4CF805A2C2FEE21F48DED1E598F64A2A8	B84161C9FBF7520CD14E7019F92120BD87A928A074156E91A992EBA9FC9436E8
Chrome Cache Entry: 63	ASCII text	D5528DDE0006C78BE04817327C2F9B6F	31E1BCC4CF805A2C2FEE21F48DED1E598F64A2A8	B84161C9FBF7520CD14E7019F92120BD87A928A074156E91A992EBA9FC9436E8
Chrome Cache Entry: 64	ASCII text, with very long lines (65536), with no line terminators	62FF28C55F8159CC084F1C82F84C3B12	D0EB11A30CF87270F2D92401CF426EA3D805182A	CFE0E13115BF23DAE63F17031EA3102C4EFA5CEB7902F3DD7A4A5923F20FA05E
Chrome Cache Entry: 65	ASCII text, with very long lines (65451)	12108007906290015100837A6A61E9F4	1D6AE46F2FFA213DEDE37A521B011EC1CD8D1AD3	C4DCCDD9AE25B64078E0C73F273DE94F8894D5C99E4741645ECE29AEEFC9C5A4
Chrome Cache Entry: 66	TrueType Font data, 20 tables, 1st "GPOS", 15 names, Microsoft, language 0x409, Copyright (c) 2015 by Hubert & Fischer. All rights reserved.Rubik MediumRegularHubert&Fischer: R	4DFF84C26BC906823E344E1EB76FE7A7	5DA5F96C57060E54A922EA0DF12B4C29797593B9	82A8C818AAB7CA3157C49795B2FC47A08A1FA490DD5AA7ACB7A079615C3DDA51
Chrome Cache Entry: 67	Unicode text, UTF-8 text, with very long lines (22032)	6E80F0CFF749C82653B9CDDE9EEAB937	7034E797787919A6742525A69723BF9DFDA13790	1CE6649D82D2DB0F8E4823F701DDFCFD9C7F107CB446C907E46EC7E57171A2A3
Chrome Cache Entry: 68	PNG image data, 1 x 6, 4-bit colormap, non-interlaced	5A962ADF74D92AE702467B3F47976547	36F74049375584E3FA69B5EF87E9572336FF9E7A	AD4EBEA1C3496DD2924789EE009174A2C6289D1200E9811F458FD46F172D1D6F
Chrome Cache Entry: 69	PNG image data, 1 x 6, 4-bit colormap, non-interlaced	5A962ADF74D92AE702467B3F47976547	36F74049375584E3FA69B5EF87E9572336FF9E7A	AD4EBEA1C3496DD2924789EE009174A2C6289D1200E9811F458FD46F172D1D6F
Chrome Cache Entry: 70	GIF image data, version 89a, 32 x 32	50C5E3E79B276C92DF6CC52CAEB464F0	C641615E851254111E268DA42D72AE684B3CE967	16EA0CF66D51EFDBBC2A62B11AB0419FA72FB3320844F1D0D710480245AC9925
Chrome Cache Entry: 71	TrueType Font data, 18 tables, 1st "GPOS", 15 names, Microsoft, language 0x409, Copyright (c) 2015 by Hubert & Fischer. All rights reserved.Rubik BlackItalicHubert&Fischer: Rub	77C7F123391595707A1D0690DDDAA11E	3F77B9D3D8155511D94D72A410C80B3D18001CDE	CE0E6DE088497437824E571C7A0C38974F205A0BBB8B20AE5B309E419662F063
Chrome Cache Entry: 72	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel	EA344923D7E68380C811191E36E04020	F23F0EC8C29DF2A1B31B0E0CB46E54E22420BCA1	97A8AA4A501654A28F1FE60E1FCE3F9070C80D698790BEB60B2D714F78BD786F

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://amazonbirr.com/index/login/reg/invite_code/699365

Avira URL Cloud: detection malicious, Label: phishing

Antivirus detection for URL or domain

Source: https://amazonbirr.com/static/index/css/main.css	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/static/index/fonts/Rubik-Medium.4dff84c2.ttf	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/static/jquery-3.5.0.min.js	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/static/index/fonts/Rubik-BlackItalic.77c7f123.ttf	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/static/layer/theme/default/loading-2.gif	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/static/jquery.cookie.js	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/static/index/css/common.css?v=1	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/static/layer/layer.js	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/static/index/fonts/Rubik-Regular.35af6dbe.ttf	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/static/layer/theme/default/layer.css?v=3.1.1	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/index/login/reg.html	Avira URL Cloud: Label: phishing
Source: https://amazonbirr.com/favicon.ico	Avira URL Cloud: Label: phishing

Phishing

AI detected suspicious URL

Source: URL	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://amazonbirr.com
Source: URL	Joe Sandbox AI: AI detected Typosquatting in URL: https://amazonbirr.com

HTML body contains low number of good links

Source: https://amazonbirr.com/index/login/reg/invite_code/699365

HTTP Parser: Number of links: 1

HTML body contains password input but no form action

Source: https://amazonbirr.com/index/login/reg/invite_code/699365

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://amazonbirr.com/index/login/reg/invite_code/699365

HTTP Parser: <input type="password" .../> found

Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No favicon
Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No favicon
Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No favicon
Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No favicon

Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No <meta name="author".. found
Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No <meta name="author".. found
Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No <meta name="author".. found
Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No <meta name="author".. found

Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No <meta name="copyright".. found
Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No <meta name="copyright".. found
Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No <meta name="copyright".. found
Source: https://amazonbirr.com/index/login/reg/invite_code/699365	HTTP Parser: No <meta name="copyright".. found

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /index/login/reg/invite_code/699365 HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/index/css/main.css HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://amazonbirr.com/index/login/reg/invite_code/699365Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/index/css/common.css?v=1 HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://amazonbirr.com/index/login/reg/invite_code/699365Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/jquery-3.5.0.min.js HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://amazonbirr.com/index/login/reg/invite_code/699365Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/layer/layer.js HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://amazonbirr.com/index/login/reg/invite_code/699365Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/jquery.cookie.js HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://amazonbirr.com/index/login/reg/invite_code/699365Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/layer/layer.js HTTP/1.1Host: amazonbirr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/layer/theme/default/layer.css?v=3.1.1 HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://amazonbirr.com/index/login/reg/invite_code/699365Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/jquery.cookie.js HTTP/1.1Host: amazonbirr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/jquery-3.5.0.min.js HTTP/1.1Host: amazonbirr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/index/fonts/Rubik-BlackItalic.77c7f123.ttf HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://amazonbirr.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://amazonbirr.com/static/index/css/common.css?v=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/index/fonts/Rubik-Regular.35af6dbe.ttf HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://amazonbirr.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://amazonbirr.com/static/index/css/common.css?v=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/index/fonts/Rubik-Medium.4dff84c2.ttf HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://amazonbirr.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://amazonbirr.com/static/index/css/common.css?v=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /img/shadow-grey.png HTTP/1.1Host: cdn.dcloud.net.cnConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://amazonbirr.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/shadow-grey.png HTTP/1.1Host: cdn.dcloud.net.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __uni__uid=rBEQRWeISCtt8+A2A2cpAg==
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://amazonbirr.com/index/login/reg/invite_code/699365Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: amazonbirr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/layer/theme/default/loading-2.gif HTTP/1.1Host: amazonbirr.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://amazonbirr.com/static/layer/theme/default/layer.css?v=3.1.1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /static/layer/theme/default/loading-2.gif HTTP/1.1Host: amazonbirr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /index/login/reg.html HTTP/1.1Host: amazonbirr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5
Source: global traffic	HTTP traffic detected: GET /index/login/reg.html HTTP/1.1Host: amazonbirr.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s16f8b38a=nn5udgp9pu87ii6r0ovi8mu9l5

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: amazonbirr.com
Source: global traffic	DNS traffic detected: DNS query: cdn.dcloud.net.cn

Source: unknown

Source: chromecache_67.2.dr, chromecache_57.2.dr	String found in binary or memory: http://layer.layui.com/
Source: chromecache_55.2.dr	String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFL
Source: chromecache_71.2.dr	String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLRubikBlack
Source: chromecache_66.2.dr	String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLRubikMedium
Source: chromecache_62.2.dr, chromecache_63.2.dr	String found in binary or memory: https://github.com/carhartl/jquery-cookie

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: classification engine

Classification label: mal60.win@16/32@11/7

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2016,i,9889025774585612304,2690344116646378192,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://amazonbirr.com/index/login/reg/invite_code/699365"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2016,i,9889025774585612304,2690344116646378192,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

ID:	1592281
Product:	CloudBasic
Start time:	00:42:29
Start date:	16.01.2025
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://amazonbirr.com/index/login/reg/invite_code/699365

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://amazonbirr.com/index/login/reg/invite_code/699365

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://amazonbirr.com/index/login/reg/invite_code/699365