Windows Analysis Report
https://c.apple.com/r?v=2&a=8ps6Ok0qKWiF37xoxStPOmTNGs51zlivdjtcXTFjpLnVfNVUW3O2%2Fg0FsgBl8SdvTx20IK997Wb6cow2ElFVncZu43bN7nrrgIuAtZAsoEEuEXE5IZKNRcWG0WciZDVKlnTAtrXOQMsq1Ett%2FAPXgwG5f%2Fjj%2BIh23fSFNwIlMztXNSO62c68kxsRhE7NgI%2FZrAAhvZOQ6IlmIsZvIp9xFfCyw%2B59O7NZ6YudIWSbMpXnoJpNfC%2FW09flgDjQbQqvfN

Overview

General Information

Sample URL: https://c.apple.com/r?v=2&a=8ps6Ok0qKWiF37xoxStPOmTNGs51zlivdjtcXTFjpLnVfNVUW3O2%2Fg0FsgBl8SdvTx20IK997Wb6cow2ElFVncZu43bN7nrrgIuAtZAsoEEuEXE5IZKNRcWG0WciZDVKlnTAtrXOQMsq1Ett%2FAPXgwG5f%2Fjj%2BIh23fSF
Analysis ID: 1431738

Detection

Score: 1
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

HTML body with high number of embedded SVGs detected
Stores files to the Windows start menu directory

Classification

HTML body with high number of embedded SVGs detected
Source: https://appleid.apple.com/ HTTP Parser: Total embedded SVG size: 2204071
Source: https://mynews.apple.com/subscriptions?v=2&la=es_es&a=8w%2BvXLoOe%2FyPdV0vFeToEYkgg4C2pKtfyUevjbyEmww4VNahXFeGRy9n8gRCQ1gLr3cWk%2B%2BEMR6Njqvb%2FqQkLhfS7JPyP3ilsW8eUttdbRUsbb5D9ckJsPBpexZM1pDaTncLJImqtguskLgTwOlJLsOH1hMiMLXRAgYOW%2Fji6pRm9Dk8CL8VSRzwDOR5sSI%2BPZSTacDEKzR4OVp46grop66rJB8PQagK%2FplhKKcTNKUBXqX%2FiHz2kggEKn5uR4ITHPFucP1hJ5AzP5IAh3%2FMdg%3D%3D HTTP Parser: No favicon
Source: https://mynews.apple.com/subscriptions?locale= HTTP Parser: No favicon
Source: https://www.apple.com/es/ HTTP Parser: No favicon
Source: https://www.apple.com/es/ HTTP Parser: No favicon
Source: unknown HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49788 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49790 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49794 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49943 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49944 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49945 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.9.254:443 -> 192.168.2.16:49946 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.113.196.254:443 -> 192.168.2.16:49948 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.36.77.107:443 -> 192.168.2.16:49950 version: TLS 1.2
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: appleid.cdn-apple.com
Source: global traffic DNS traffic detected: DNS query: is1-ssl.mzstatic.com
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49788 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49790 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49794 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49943 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49944 version: TLS 1.2
Source: unknown HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49945 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.9.254:443 -> 192.168.2.16:49946 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.113.196.254:443 -> 192.168.2.16:49948 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.36.77.107:443 -> 192.168.2.16:49950 version: TLS 1.2
Source: classification engine Classification label: clean1.win@14/6@10/217
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://c.apple.com/r?v=2&a=8ps6Ok0qKWiF37xoxStPOmTNGs51zlivdjtcXTFjpLnVfNVUW3O2%2Fg0FsgBl8SdvTx20IK997Wb6cow2ElFVncZu43bN7nrrgIuAtZAsoEEuEXE5IZKNRcWG0WciZDVKlnTAtrXOQMsq1Ett%2FAPXgwG5f%2Fjj%2BIh23fSFNwIlMztXNSO62c68kxsRhE7NgI%2FZrAAhvZOQ6IlmIsZvIp9xFfCyw%2B59O7NZ6YudIWSbMpXnoJpNfC%2FW09flgDjQbQqvfNKqQfiGaBFWeim11bMNgqbjLFkH%2B6AwGcN5uUKxgN9x92JZVGst3b3spt376A7o%2FnzU9jxoXuqChJN%2F5FpaZetNeQMzWiqSA2PdWSoJmDQ5NTZpUM3OWalQBtPSv6t0z%2FdGt9p0DFQz0DmeA%2ByzgfhbRWlVS7GksE%2FdORXowRGNPdApFzVVhpY4qhlyR7DnC%2F2%2FcaANHrTDdFKpgjNv0KYynBZNrs6vJCiLANCAxUw0eICySQgCTYE219a%2FhrEYFaxKkxbJgusTiMUNHxmIKA%3D%3D
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1932,i,12109180015662798756,4558246471254216876,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1932,i,12109180015662798756,4558246471254216876,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: Window Recorder Window detected: More than 3 window changes detected
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
17.36.202.111
 unknown United States
714 APPLE-ENGINEERINGUS false
64.233.177.84
 unknown United States
15169 GOOGLEUS false
17.179.240.53
 unknown United States
714 APPLE-ENGINEERINGUS false
17.137.160.195
 unknown United States
714 APPLE-ENGINEERINGUS false
17.33.201.109
 unknown United States
714 APPLE-ENGINEERINGUS false
1.1.1.1
 unknown Australia
13335 CLOUDFLARENETUS false
104.67.210.76
 unknown United States
33662 CMCSUS false
17.32.194.37
 unknown United States
714 APPLE-ENGINEERINGUS false
17.36.202.9
 unknown United States
714 APPLE-ENGINEERINGUS false
23.216.72.196
 unknown United States
20940 AKAMAI-ASN1EU false
173.194.219.94
 unknown United States
15169 GOOGLEUS false
23.76.40.27
 unknown United States
19037 AMXArgentinaSAAR false
184.24.36.216
 unknown United States
5650 FRONTIER-FRTRUS false
23.75.123.144
 unknown United States
16625 AKAMAI-ASUS false
239.255.255.250
 unknown Reserved
unknown unknown false
23.203.244.213
 unknown United States
16625 AKAMAI-ASUS false
23.46.201.143
 unknown United States
16625 AKAMAI-ASUS false
142.250.9.102
 unknown United States
15169 GOOGLEUS false
108.177.122.95
 unknown United States
15169 GOOGLEUS false
142.250.9.99
 www.google.com United States
15169 GOOGLEUS false
23.46.248.19
 unknown United States
16625 AKAMAI-ASUS false
17.33.200.216
 unknown United States
714 APPLE-ENGINEERINGUS false

Private

IP
192.168.2.16

Contacted Domains

Name IP Active
www.google.com 142.250.9.99 true
is1-ssl.mzstatic.com unknown unknown
appleid.cdn-apple.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
about:blank false
  • Avira URL Cloud: safe
 low