Windows Analysis Report
https://www.highcpmgate.com/vdvpyk3j?key=f2b21af2cea51f467a32bdc200d0bff7

Overview

General Information

Sample URL: https://www.highcpmgate.com/vdvpyk3j?key=f2b21af2cea51f467a32bdc200d0bff7
Analysis ID: 1431592
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: https://www.highcpmgate.com/vdvpyk3j?key=f2b21af2cea51f467a32bdc200d0bff7 Avira URL Cloud: detection malicious, Label: malware
Antivirus detection for URL or domain
Source: https://www.highcpmgate.com/favicon.ico Avira URL Cloud: Label: malware
Source: https://www.highcpmgate.com/vdvpyk3j?key=f2b21af2cea51f467a32bdc200d0bff7 HTTP Parser: No favicon
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\GoogleUpdater Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\chrome_BITS_2092_540932119 Jump to behavior
Source: global traffic HTTP traffic detected: GET /vdvpyk3j?key=f2b21af2cea51f467a32bdc200d0bff7 HTTP/1.1Host: www.highcpmgate.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.highcpmgate.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-full-version: "109.0.5414.120"sec-ch-ua-platform-version: "0.1.0"sec-ch-ua-full-version-list: "Not_A Brand";v="99.0.0.0", "Google Chrome";v="109.0.5414.120", "Chromium";v="109.0.5414.120"sec-ch-ua-model: sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.highcpmgate.com/vdvpyk3j?key=f2b21af2cea51f467a32bdc200d0bff7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: u_pl=18313235
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.highcpmgate.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: u_pl=18313235
Source: global traffic HTTP traffic detected: GET /anonymous/ HTTP/1.1Host: effectiveperformanceformat.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic DNS traffic detected: DNS query: www.highcpmgate.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: effectiveperformanceformat.com
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.21.6Date: Thu, 25 Apr 2024 11:56:19 GMTContent-Type: text/htmlContent-Length: 0Connection: keep-aliveP3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Source: chromecache_72.1.dr String found in binary or memory: http://effectiveperformanceformat.com/anonymous/
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49166 -> 443
Source: classification engine Classification label: mal56.win@20/2@8/5
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe File created: C:\Program Files\Google Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1424 --field-trial-handle=1216,i,8365298028594610967,12273193156580556368,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "https://www.highcpmgate.com/vdvpyk3j?key=f2b21af2cea51f467a32bdc200d0bff7"
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1424 --field-trial-handle=1216,i,8365298028594610967,12273193156580556368,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\GoogleUpdater Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\chrome_BITS_2092_540932119 Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1431592 URL: https://www.highcpmgate.com... Startdate: 25/04/2024 Architecture: WINDOWS Score: 56 22 Antivirus detection for URL or domain 2->22 24 Antivirus / Scanner detection for submitted sample 2->24 6 chrome.exe 4 2->6         started        9 chrome.exe 2->9         started        process3 dnsIp4 14 239.255.255.250 unknown Reserved 6->14 11 chrome.exe 6->11         started        process5 dnsIp6 16 www.highcpmgate.com 172.240.108.68, 443, 49165, 49166 SERVERS-COMUS United States 11->16 18 www.google.com 173.194.77.106, 443, 49168, 49172 GOOGLEUS United States 11->18 20 2 other IPs or domains 11->20
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
192.243.61.225
 effectiveperformanceformat.com Dominica
39572 ADVANCEDHOSTERS-ASNL false
239.255.255.250
 unknown Reserved
unknown unknown false
192.243.59.13
 unknown Dominica
39572 ADVANCEDHOSTERS-ASNL false
173.194.77.106
 www.google.com United States
15169 GOOGLEUS false
172.240.108.68
 www.highcpmgate.com United States
7979 SERVERS-COMUS false

Contacted Domains

Name IP Active
www.highcpmgate.com 172.240.108.68 true
effectiveperformanceformat.com 192.243.61.225 true
www.google.com 173.194.77.106 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://effectiveperformanceformat.com/anonymous/ false
  • 2%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
https://www.highcpmgate.com/vdvpyk3j?key=f2b21af2cea51f467a32bdc200d0bff7 true
    		unknown
    https://www.highcpmgate.com/favicon.ico false
    • Avira URL Cloud: malware
    		 unknown