Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Encrypted_PaymentAdvice_Reference.html
|
HTML document, ASCII text, with very long lines (1625), with no line terminators
|
initial sample
|
 |
|
|
Chrome Cache Entry: 100
|
PNG image data, 240 x 59, 8-bit/color RGBA, non-interlaced
|
downloaded
|
||
|
Chrome Cache Entry: 101
|
PNG image data, 16 x 25, 8-bit/color RGBA, non-interlaced
|
downloaded
|
||
|
Chrome Cache Entry: 102
|
MS Windows icon resource - 4 icons, 64x64, 32 bits/pixel, 32x32, 32 bits/pixel
|
dropped
|
||
|
Chrome Cache Entry: 103
|
ASCII text, with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 104
|
ASCII text, with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 105
|
ASCII text, with very long lines (39257), with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 106
|
PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
|
downloaded
|
||
|
Chrome Cache Entry: 107
|
PNG image data, 16 x 25, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
|
Chrome Cache Entry: 108
|
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=16, height=4000, bps=206, PhotometricIntepretation=RGB,
manufacturer=NIKON CORPORATION, model=NIKON D7100, orientation=upper-left, width=6000], baseline, precision 8, 1920x1080,
components 3
|
downloaded
|
||
|
Chrome Cache Entry: 109
|
PNG image data, 89 x 18, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
|
Chrome Cache Entry: 110
|
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 111
|
ASCII text, with very long lines (65447)
|
downloaded
|
||
|
Chrome Cache Entry: 112
|
ASCII text, with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 113
|
ASCII text, with very long lines (65536), with no line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 114
|
ASCII text, with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 115
|
GIF image data, version 89a, 22 x 22
|
downloaded
|
||
|
Chrome Cache Entry: 116
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 110554
|
downloaded
|
||
|
Chrome Cache Entry: 117
|
PNG image data, 89 x 18, 8-bit/color RGBA, non-interlaced
|
downloaded
|
||
|
Chrome Cache Entry: 118
|
GIF image data, version 89a, 22 x 22
|
dropped
|
||
|
Chrome Cache Entry: 119
|
PNG image data, 240 x 59, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
|
Chrome Cache Entry: 120
|
GIF image data, version 89a, 24 x 24
|
downloaded
|
||
|
Chrome Cache Entry: 121
|
ASCII text, with very long lines (65447)
|
downloaded
|
||
|
Chrome Cache Entry: 122
|
ASCII text, with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 123
|
GIF image data, version 89a, 24 x 24
|
dropped
|
||
|
Chrome Cache Entry: 124
|
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=16, height=4000, bps=206, PhotometricIntepretation=RGB,
manufacturer=NIKON CORPORATION, model=NIKON D7100, orientation=upper-left, width=6000], baseline, precision 8, 1920x1080,
components 3
|
dropped
|
||
|
Chrome Cache Entry: 125
|
PNG image data, 338 x 72, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
|
Chrome Cache Entry: 126
|
JSON data
|
dropped
|
||
|
Chrome Cache Entry: 84
|
ASCII text, with very long lines (61177)
|
downloaded
|
||
|
Chrome Cache Entry: 85
|
ASCII text, with very long lines (65329), with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 86
|
HTML document, Unicode text, UTF-8 text, with very long lines (941), with CRLF line terminators
|
dropped
|
||
|
Chrome Cache Entry: 87
|
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 88
|
PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
|
Chrome Cache Entry: 89
|
MS Windows icon resource - 4 icons, 64x64, 32 bits/pixel, 32x32, 32 bits/pixel
|
downloaded
|
||
|
Chrome Cache Entry: 90
|
PNG image data, 17 x 25, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
|
Chrome Cache Entry: 91
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
|
downloaded
|
||
|
Chrome Cache Entry: 92
|
PNG image data, 89 x 18, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
|
Chrome Cache Entry: 93
|
HTML document, Unicode text, UTF-8 text, with very long lines (1237), with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 94
|
PNG image data, 89 x 18, 8-bit/color RGBA, non-interlaced
|
downloaded
|
||
|
Chrome Cache Entry: 95
|
ASCII text, with CRLF line terminators
|
downloaded
|
||
|
Chrome Cache Entry: 96
|
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
|
dropped
|
||
|
Chrome Cache Entry: 97
|
PNG image data, 338 x 72, 8-bit/color RGBA, non-interlaced
|
downloaded
|
||
|
Chrome Cache Entry: 98
|
PNG image data, 17 x 25, 8-bit/color RGBA, non-interlaced
|
downloaded
|
||
|
Chrome Cache Entry: 99
|
ASCII text, with CRLF line terminators
|
downloaded
|
There are 34 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Encrypted_PaymentAdvice_Reference.html"
|
||
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US
--service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2152,i,4203618253092181966,8330422003287132863,262144
/prefetch:8
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
file:///C:/Users/user/Desktop/Encrypted_PaymentAdvice_Reference.html
|
|
||
|
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
|
104.17.24.14
|
||
|
https://account.live.com/resetpassword.aspx
|
unknown
|
||
|
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_8owwt4u-33ps0wawi7tmow2.css
|
152.199.4.44
|
||
|
https://aadcdn.msftauthimages.net/dbd5a2dd-m8dyygmh3oeovo2dixhqqyboaqeae6piveon-rl-2di/logintenantbranding/0/illustration?ts=637885838649916089
|
13.107.213.38
|
||
|
https://aadcdn.msftauthimages.net/dbd5a2dd-m8dyygmh3oeovo2dixhqqyboaqeae6piveon-rl-2di/logintenantbranding/0/bannerlogo?ts=637885838665437121
|
13.107.213.38
|
||
|
https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEGsu0-aLYEGmeoesM0oZ-JoCnVyLvV_7L8OnVG8mkb7Ytp9uxtOn6P5Y_XoucrR59-fDs1d7R98of0&mkt=en-US&hosted=0&device_platform=Windows+10
|
|||
|
https://bc1qr4pajz0dg0s3dd3gc9mx0s0.com/lnk/web.js
|
185.216.70.216
|
||
|
https://bc1q3jc6cu9q5t35vc9jt7h47pw.com/api/v3/auth
|
193.222.96.119
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
part-0013.t-0009.t-msedge.net
|
13.107.246.41
|
||
|
cs1100.wpc.omegacdn.net
|
152.199.4.44
|
||
|
bc1q3jc6cu9q5t35vc9jt7h47pw.com
|
193.222.96.119
|
||
|
cdnjs.cloudflare.com
|
104.17.24.14
|
||
|
bc1qr4pajz0dg0s3dd3gc9mx0s0.com
|
185.216.70.216
|
||
|
www.google.com
|
108.177.122.99
|
||
|
part-0012.t-0009.t-msedge.net
|
13.107.213.40
|
||
|
part-0010.t-0009.t-msedge.net
|
13.107.213.38
|
||
|
passwordreset.microsoftonline.com
|
unknown
|
||
|
aadcdn.msftauth.net
|
unknown
|
||
|
ajax.aspnetcdn.com
|
unknown
|
||
|
aadcdn.msftauthimages.net
|
unknown
|
There are 2 hidden domains, click here to show them.
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
104.17.24.14
|
cdnjs.cloudflare.com
|
United States
|
||
|
13.107.246.41
|
part-0013.t-0009.t-msedge.net
|
United States
|
||
|
13.107.246.40
|
unknown
|
United States
|
||
|
152.199.4.44
|
cs1100.wpc.omegacdn.net
|
United States
|
||
|
192.168.2.4
|
unknown
|
unknown
|
||
|
13.107.213.38
|
part-0010.t-0009.t-msedge.net
|
United States
|
||
|
239.255.255.250
|
unknown
|
Reserved
|
||
|
13.107.213.40
|
part-0012.t-0009.t-msedge.net
|
United States
|
||
|
185.216.70.216
|
bc1qr4pajz0dg0s3dd3gc9mx0s0.com
|
Germany
|
||
|
193.222.96.119
|
bc1q3jc6cu9q5t35vc9jt7h47pw.com
|
Germany
|
||
|
108.177.122.99
|
www.google.com
|
United States
|
There are 1 hidden IPs, click here to show them.
DOM / HTML
|
URL
|
Malicious
|
|
|---|---|---|
|
file:///C:/Users/user/Desktop/Encrypted_PaymentAdvice_Reference.html
|
|
|
|
file:///C:/Users/user/Desktop/Encrypted_PaymentAdvice_Reference.html
|
||
|
https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEGsu0-aLYEGmeo
|
||
|
https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQQIARAAhZLNa9MAAMWbdq1b0dlNET0IEzzIJG2-0xR2SJt-pFuStU0amoOlaZM0bZqkbdK0uYseB8LAgRcPojt6Ei8Kehi7uPP8DwRFPMiObnoeXh7v8d7t_ZLLRBom0lAa2owhaSh3HyMJHMNwFUSRLgFilAqBWVQjQLhHoecVQhLdzmQ9mXr8xL-3_yNTePN8bbO59fnFIbDR9zx3mstkgiBIO7pudrV01xllrI7dM21jhrwDgBMAOIjGNRuUGofRKYFmYZTCYQInYRQlYRhJt0QabslsqAw4TyizGG9CkCJagx25OuTCoseLUtgKhwuuXMQUWYK4cAgrMhcI4tDjRmzIFy72tcWO2B8JIudxTG3BDaSAZySEZ2r4afS6QPteH7kQZ2KG2q_oiu5MRm3XmXoHsf0oa2_LVLkyq3f8Rcjy42q1gpCmQMlwFxs7xZaUX_TC1rRdsn18Z9uFFFrtg9VCXfLl4XAATjhyx9iFbFKCkOliYbCo2K-apqzkLV0k59uUU1B5vcD2XAItBc1i1RBMexdCbdjrBzZfLpXzou808Www5STOmtfAkS_DeAlSF0h7e9jlVa_RbWBzmOk4vR4KVXlZ1gJK1gdsVt015tREwAl80pg3CmatrxqjsSVW8CZV4uyybMrZPO-5TYyzS2irgyjCjDXyltFG9VCv0_zApcJsvUkTSjB383gFZECD7jShRnAYu3PJvTPkbSxxbkaOfRwjHVezzd6GO3F009IuQ2KGZIS_qeKMtDRtWSdLwLelW8uJVOp2ZCPy4CYUyy0vJ1ORi3S2BLyMnxMXxlcTj-4q9OuVr59-j6nIcTzTLNgMjVMGKs_6XmgV8g8JXrJ0oYQTZTxDDOcNX-34vfmYcbbgHLyXAPYSiePEGsu0-aLYEGmeo
|