Windows Analysis Report
https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/

Overview

General Information

Sample URL:	https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/
Analysis ID:	1592313
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

HTML body contains low number of good links

HTML body with high number of embedded images detected

HTML title does not match URL

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/

Avira URL Cloud: detection malicious, Label: phishing

Phishing

AI detected phishing page

Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/	Joe Sandbox AI: Score: 8 Reasons: The brand 'FTX' is a well-known cryptocurrency exchange platform., The URL 'restructuring.rh-kroll.com' does not match the legitimate domain 'ftx.com'., The domain 'rh-kroll.com' does not appear to be directly associated with FTX., The presence of a subdomain 'restructuring' could indicate a specific service or department, but it is not a known subdomain of FTX., The use of a different domain name suggests potential phishing, especially when combined with a well-known brand like FTX. DOM: 1.0.pages.csv
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php	Joe Sandbox AI: Score: 8 Reasons: The brand 'FTX' is a well-known cryptocurrency exchange platform., The URL 'restructuring.rh-kroll.com' does not match the legitimate domain 'ftx.com'., The domain 'rh-kroll.com' does not appear to be directly associated with FTX., The presence of a subdomain 'restructuring' could indicate a specific service or department, but it is not a known subdomain of FTX., The URL structure suggests a potential phishing attempt as it does not align with the known domain of the brand. DOM: 2.1.pages.csv
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php	Joe Sandbox AI: Score: 8 Reasons: The brand 'FTX' is a well-known cryptocurrency exchange platform., The URL 'restructuring.rh-kroll.com' does not match the legitimate domain 'ftx.com'., The domain 'rh-kroll.com' does not appear to be directly associated with FTX., The presence of a subdomain 'restructuring' could indicate a specific service or department, but it is not a known subdomain of FTX., The URL structure includes multiple segments and does not directly reflect the brand name, which is a common phishing tactic. DOM: 2.2.pages.csv
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php	Joe Sandbox AI: Score: 8 Reasons: The brand 'FTX' is a well-known cryptocurrency exchange platform., The URL 'restructuring.rh-kroll.com' does not match the legitimate domain 'ftx.com'., The domain 'rh-kroll.com' does not appear to be directly associated with FTX., The presence of a subdomain 'restructuring' could indicate a specific service or department, but it is not a known subdomain of FTX., The URL structure includes multiple segments and does not clearly indicate a direct association with FTX., The use of a different domain name could be an attempt to impersonate or mislead users into thinking it is associated with FTX. DOM: 2.3.pages.csv
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php	Joe Sandbox AI: Score: 8 Reasons: The brand 'FTX' is a well-known cryptocurrency exchange platform., The legitimate domain for FTX is 'ftx.com'., The provided URL 'restructuring.rh-kroll.com' does not match the legitimate domain for FTX., The URL contains multiple subdomains and does not directly relate to FTX, which is suspicious., The domain 'rh-kroll.com' does not have any known association with FTX., The presence of an email input field could be used to harvest credentials, which is a common phishing tactic. DOM: 2.4.pages.csv

HTML body contains low number of good links

Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/	HTTP Parser: Number of links: 0
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php	HTTP Parser: Number of links: 0

HTML body with high number of embedded images detected

Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/	HTTP Parser: Total embedded image size: 40172
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php	HTTP Parser: Total embedded image size: 40172

HTML title does not match URL

Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/	HTTP Parser: Title: Recovery User Login \| FTX does not match URL
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php	HTTP Parser: Title: Recovery User Login \| FTX does not match URL

Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/	HTTP Parser: No <meta name="author".. found
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php	HTTP Parser: No <meta name="author".. found
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php	HTTP Parser: No <meta name="author".. found
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php	HTTP Parser: No <meta name="author".. found
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php	HTTP Parser: No <meta name="author".. found
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php	HTTP Parser: No <meta name="author".. found

Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/	HTTP Parser: No <meta name="copyright".. found
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php	HTTP Parser: No <meta name="copyright".. found
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php	HTTP Parser: No <meta name="copyright".. found
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php	HTTP Parser: No <meta name="copyright".. found
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php	HTTP Parser: No <meta name="copyright".. found
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php	HTTP Parser: No <meta name="copyright".. found

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /scheduled-claims/login-desktop.php/ HTTP/1.1Host: restructuring.rh-kroll.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.7.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://restructuring.rh-kroll.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.7.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scheduled-claims/login-desktop.php/code-desktop.php HTTP/1.1Host: restructuring.rh-kroll.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scheduled-claims/login-desktop.php/code-desktop.php HTTP/1.1Host: restructuring.rh-kroll.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scheduled-claims/login-desktop.php/code-desktop.php HTTP/1.1Host: restructuring.rh-kroll.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scheduled-claims/login-desktop.php/code-desktop.php HTTP/1.1Host: restructuring.rh-kroll.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scheduled-claims/login-desktop.php/code-desktop.php HTTP/1.1Host: restructuring.rh-kroll.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scheduled-claims/login-desktop.php/code-desktop.php HTTP/1.1Host: restructuring.rh-kroll.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: restructuring.rh-kroll.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com

Source: unknown

HTTP traffic detected: POST /scheduled-claims/login-desktop.php/ HTTP/1.1Host: restructuring.rh-kroll.comConnection: keep-aliveContent-Length: 26Cache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1Origin: https://restructuring.rh-kroll.comContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_57.2.dr

String found in binary or memory: https://code.jquery.com/jquery-3.7.1.min.js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: classification engine

Classification label: mal56.phis.win@16/7@10/7

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1832 --field-trial-handle=1956,i,15969681716738809597,4299525528950541004,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1832 --field-trial-handle=1956,i,15969681716738809597,4299525528950541004,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
172.234.229.72	restructuring.rh-kroll.com	United States	20940	AKAMAI-ASN1EU	true
151.101.130.137	code.jquery.com	United States	54113	FASTLYUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.194.137	unknown	United States	54113	FASTLYUS	false

Private

IP
192.168.2.4
192.168.2.6

Contacted Domains

Name	IP	Active
code.jquery.com	151.101.130.137	true
www.google.com	142.250.185.132	true
restructuring.rh-kroll.com	172.234.229.72	true

Contacted URLs

Name	Malicious	Reputation
https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php	true	unknown
https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/	true	unknown
https://code.jquery.com/jquery-3.7.1.min.js	false	high

ID:	1592313
Product:	CloudBasic
Start time:	00:57:40
Start date:	16.01.2025
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
Chrome Cache Entry: 56	ASCII text, with very long lines (65447)	2C872DBE60F4BA70FB85356113D8B35E	EE48592D1FFF952FCF06CE0B666ED4785493AFDC	FC9A93DD241F6B045CBFF0481CF4E1901BECD0E12FB45166A8F17F95823F0B1A
Chrome Cache Entry: 57	HTML document, ASCII text, with very long lines (20419), with CRLF line terminators	421607EF6D5DC399D1FB4349419E688A	E2FE17D648D8F6419B22BF4DEC50DF9CD79CF3BF	A9E2511092C57234AB4394D1A958109FBD0A154B0C681161E47A7874E70F5E05
Chrome Cache Entry: 58	ASCII text, with no line terminators	903747EA4323C522742842A52CE710C9	9F806EA4288867A31A4AD53AC171AA4029DF182B	4BD8B60F91849C936AE45615145A7B7BE2CF803322A30BABBAE7267A142CA5BB
Chrome Cache Entry: 59	ASCII text, with very long lines (65447)	2C872DBE60F4BA70FB85356113D8B35E	EE48592D1FFF952FCF06CE0B666ED4785493AFDC	FC9A93DD241F6B045CBFF0481CF4E1901BECD0E12FB45166A8F17F95823F0B1A

Windows Analysis Report
https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/