Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 21:40:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Category:	dropped
Dump:	Docs.lnk.0.dr
ID:	dr_5
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 21:40:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	3.9915257996327567
Encrypted:	false
Size:	2673
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Category:	dropped
Dump:	Gmail.lnk.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 21:40:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	4.0093787514119095
Encrypted:	false
Size:	2675
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Category:	dropped
Dump:	Google Drive.lnk.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	4.01729008540662
Encrypted:	false
Size:	2689
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Category:	dropped
Dump:	Sheets.lnk.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 21:40:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	4.0070087065162765
Encrypted:	false
Size:	2677
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Category:	dropped
Dump:	Slides.lnk.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 21:40:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	3.995970200264172
Encrypted:	false
Size:	2677
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Category:	dropped
Dump:	YouTube.lnk.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 21:40:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	4.0042599387346485
Encrypted:	false
Size:	2679
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

URLs

Name

Malicious

http://freepdfplus.com/

https://scone-pa.clients6.google.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.gapi.en.SCWmpDDGjPk.O%2Fam%3DAAAC%2Fd%3D1%2Frs%3DAHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA%2Fm%3D__features__#parent=https%3A%2F%2Fchromewebstore.google.com&rpctoken=891475698

https://ogs.google.com/widget/app/so?awwd=1&gm3=1&origin=https%3A%2F%2Fchromewebstore.google.com&cn=app&pid=269&spid=421&hl=en

https://freepdfplus.com/

https://www.google.com/recaptcha/api2/bframe?hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b

https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=13799984;type=invmedia;cat=remar0;ord=6648767554178;npa=0;auiddc=1036410757.1713912050;ps=1;pcor=254300733;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44m0z89138920945za201;gcs=G111;gcd=13t3t3t3t5;dma=0;epver=2;~oref=https%3A%2F%2Ffreepdfplus.com%2F?

about:blank

https://13799984.fls.doubleclick.net/activityi;dc_pre=CKLR6Pmz2YUDFUpaCAQdNUUDdQ;src=13799984;type=invmedia;cat=remar0;ord=6648767554178;npa=0;auiddc=1036410757.1713912050;ps=1;pcor=254300733;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44m0z89138920945za201;gcs=G111;gcd=13t3t3t3t5;dma=0;epver=2;~oref=https%3A%2F%2Ffreepdfplus.com%2F?

http://freepdfplus.com/

173.255.234.33

https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dfree%2Bpdf%2Bplus%26oq%3Dfree%2Bpdf%2Bplus%26gs_lcrp%3DEgZjaHJvbWUyBggAEEUYOTIGCAEQRRg80gEIMzUzN2owajSoAgCwAgA%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgSaEGkkGLbyoLEGIjCmgTYBGX--7RSzembbEKWbDMpYJwhYZscHeqElbA6nD-m2jyxm1N3XbKVxZ589HW8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=QoukH5jSO3sKFzVEA7Vc8VgC&size=normal&s=LRvIk7Oe_DyXuAUoKsUZdl8o9FUEAHlDIX6m1ppm5iR5wgnoOvjR4jey9830Mafuq8JA4FEuwSG8DKobTZPOJ4pqPk0fcbrkxnRZguU6-sYVmFjte_Nl8CVEbToWoLtKEw4UgXt_Wq_LABZLY6RL75hrqNyEE2C52bKAr-GEyZmMBNQAjYKMPuoR-lTAPkq2XglAZq3cjMHpA7eEEQ1fuakWeM83-B2Sll489PCHDzmkmlEzQOPxVCdwkmmvLd8VLWtw1mIbY9Em21mEKoQ8-kOftd7t4J8&cb=nntornc1aogs

Domains

Name

Malicious

scone-pa.clients6.google.com

142.251.2.95

dart.l.doubleclick.net

142.251.2.149

freepdfplus.com

173.255.234.33

chromewebstore.google.com

142.251.2.113

plus.l.google.com

142.250.141.102

ad.doubleclick.net

142.250.101.149

adservice.google.com

142.250.101.154

googleads.g.doubleclick.net

74.125.137.157

www3.l.google.com

142.250.101.138

play.google.com

142.250.101.139

www.google.com

142.250.101.105

td.doubleclick.net

142.250.101.156

googlehosted.l.googleusercontent.com

142.251.2.132

13799984.fls.doubleclick.net

unknown

ogs.google.com

unknown

lh3.googleusercontent.com

unknown

clients2.googleusercontent.com

unknown

chrome.google.com

unknown

apis.google.com

unknown

There are 9 hidden domains, click here to show them.

IPs

Domain

Country

Malicious

142.250.101.139

play.google.com

United States

142.250.101.138

www3.l.google.com

United States

192.168.2.16

unknown

74.125.137.157

googleads.g.doubleclick.net

United States

142.251.2.84

unknown

United States

142.250.101.156

td.doubleclick.net

United States

142.250.101.154

adservice.google.com

United States

142.251.2.113

chromewebstore.google.com

United States

142.250.141.147

unknown

United States

142.251.2.154

unknown

United States

142.251.2.132

googlehosted.l.googleusercontent.com

United States

142.250.141.102

plus.l.google.com

United States

142.250.101.105

www.google.com

United States

142.250.101.149

ad.doubleclick.net

United States

142.251.2.97

unknown

United States

1.1.1.1

unknown

Australia

142.250.101.147

unknown

United States

142.251.2.95

scone-pa.clients6.google.com

United States

142.251.2.94

unknown

United States

142.251.2.102

unknown

United States

142.251.2.149

dart.l.doubleclick.net

United States

239.255.255.250

unknown

Reserved

173.255.234.33

freepdfplus.com

United States

142.250.101.94

unknown

United States

142.250.141.95

unknown

United States

74.125.137.94

unknown

United States

142.251.2.101

unknown

United States

142.251.2.100

unknown

United States

There are 18 hidden IPs, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
http://freepdfplus.com/

Files

URLs

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttp://freepdfplus.com/

Files

URLs

Domains

IPs

IOC Report
http://freepdfplus.com/