Windows Analysis Report
https://ipfs.io/ipfs/bafybeicttreim53za5h4fhzjol5yvx7jo4wmlwyjlg72tiyxji2vwktw6q/?r=n5wgenlzfvxwyyrwgb6gi2lmmf4w4zk7ovzq

Overview

General Information

Sample URL:	https://ipfs.io/ipfs/bafybeicttreim53za5h4fhzjol5yvx7jo4wmlwyjlg72tiyxji2vwktw6q/?r=n5wgenlzfvxwyyrwgb6gi2lmmf4w4zk7ovzq
Analysis ID:	1432130

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML page contains hidden URLs or javascript code

HTML page contains obfuscate script src

Stores files to the Windows start menu directory

Classification

Signatures

HTML page contains hidden URLs or javascript code

Source: https://ipfs.io/ipfs/bafybeicttreim53za5h4fhzjol5yvx7jo4wmlwyjlg72tiyxji2vwktw6q/?r=n5wgenlzfvxwyyrwgb6gi2lmmf4w4zk7ovzq

HTTP Parser: Base64 decoded: s://','413htcVAC','string','address','replace','215QIJoCu','bool','42AShRaX','toString','getElementById','604YcsuPu','add','error','#postForm','action','src','Contract','toFixed','function','7526926DdEANg','.challenge-verifying','87280pSoeKG','querySelect...

HTML page contains obfuscate script src

Source: https://ipfs.io/ipfs/bafybeicttreim53za5h4fhzjol5yvx7jo4wmlwyjlg72tiyxji2vwktw6q/?r=n5wgenlzfvxwyyrwgb6gi2lmmf4w4zk7ovzq

HTTP Parser: Script src: data:text/javascript;base64,Y29uc3QgXzB4ZWRlNjE1PV8weDQzZDU7KGZ1bmN0aW9uKF8weGRiZjdlYyxfMHg0NGM5NTkpe2NvbnN0IF8weDU1MTYwOT1fMHg0M2Q1LF8weDFiZmMzOD1fMHhkYmY3ZWMoKTt3aGlsZSghIVtdKXt0cnl7Y29uc3QgXzB4MTFhMTY9LXBhcnNlSW50KF8weDU1MTYwOSgweDFmZSkpLzB4MSooLX

Source: https://ipfs.io/ipfs/bafybeicttreim53za5h4fhzjol5yvx7jo4wmlwyjlg72tiyxji2vwktw6q/?r=n5wgenlzfvxwyyrwgb6gi2lmmf4w4zk7ovzq

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49718 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.50.112.61
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50

Source: global traffic	DNS traffic detected: DNS query: ipfs.io
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: summer-chaotic-surf.matic.quiknode.pro
Source: global traffic	DNS traffic detected: DNS query: ipfs.tech
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49718 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@13/11@12/129

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ipfs.io/ipfs/bafybeicttreim53za5h4fhzjol5yvx7jo4wmlwyjlg72tiyxji2vwktw6q/?r=n5wgenlzfvxwyyrwgb6gi2lmmf4w4zk7ovzq
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1952,i,17353619413404027585,16502954035070766706,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1952,i,17353619413404027585,16502954035070766706,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.189.131	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
192.178.50.46	unknown	United States	15169	GOOGLEUS	false
151.101.193.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
142.250.217.238	unknown	United States	15169	GOOGLEUS	false
142.250.64.138	unknown	United States	15169	GOOGLEUS	false
173.194.216.84	unknown	United States	15169	GOOGLEUS	false
37.19.207.34	ipfs.tech	Ukraine	31343	INTERTELECOMUA	false
142.250.217.196	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
158.101.117.180	summer-chaotic-surf.matic.quiknode.pro	United States	31898	ORACLE-BMC-31898US	false
172.217.3.67	unknown	United States	15169	GOOGLEUS	false
209.94.90.1	ipfs.io	United States	40680	PROTOCOLUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
jsdelivr.map.fastly.net	151.101.193.229	true
summer-chaotic-surf.matic.quiknode.pro	158.101.117.180	true
www.google.com	142.250.217.196	true
ipfs.tech	37.19.207.34	true
ipfs.io	209.94.90.1	true
cdn.jsdelivr.net	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ipfs.io/ipfs/bafybeicttreim53za5h4fhzjol5yvx7jo4wmlwyjlg72tiyxji2vwktw6q/?r=n5wgenlzfvxwyyrwgb6gi2lmmf4w4zk7ovzq	false		high

ID:	1432130
Product:	CloudBasic
Start time:	14:59:33
Start date:	26.04.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 12:00:01 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	9C8F9FB542CC684EDA7449BD2B47F0F9	7F3B49B622A07216A637242E63F47EF1A3080C40	9BEF53CE22ADACF80B941A3007943EE635AEB908696DDF745DBBD015177E657E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 12:00:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	14BB3A0E7D7C74B58FAB48B7B12DBAEC	DC6AD91B467665D864F3968CA4003F5AF1064595	D700E6C6F192072218D740AC9A93A788981767C792C48ACE228EBC6B9DBCB2AC
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	5C7A4D0F82FE80764957B733138AC059	16B8A9E585E272AF08B0A432EBC91C4FF4F4F3BD	C439C92AC35DDAD0A2BCEC92716CCBCFAF9333F0F998CEE8AC94074ECF49033E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 12:00:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6A4D024DAE35DC07D3BA433754A2DDBF	3F4A94D2B955EF0C0734F85E24D8ECDEF6FC2D50	E7C933C5E5EEB8BC296E303F113CA2913A52452EB6EB57679851A65F0BFE8723
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 12:00:01 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	8CA1B07009B6D71ED789CEDC81831B42	B97FB5E38BDA390EC7E8C1A0F9502E69B3816BA5	A777CED5B2B74D07E03E3BA7B510BE8459CDA210577E4F1429BB6D7C3C6A6121
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 12:00:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	F9C46945ECAE59F6E735477AE1E643AE	B1FBB8D813A7C9E62F6A8D0337A83CC27050F4A5	4D446586C846F8DA38D9BD738D96E6378A0E1DFF3569A54B592F092DB72C6280
Chrome Cache Entry: 61	ASCII text, with very long lines (10208)	26AB32573828DCFA4579694CDC85502D	6C906CC598527B322107569684858873214EC155	F972CFDA1A5CCFE154344673BC30A3F56AE86F1C5BA8FE4E2242C715D85F773C
Chrome Cache Entry: 62	HTML document, ASCII text, with very long lines (7749)	62E932D7343D18B4FD257970E00BD2CA	AD60FE8E37377460D7292C85AADDDC36B8C907E1	DDF041EA2D15857A4D52644BE8CF5EF82473E66937D77FA8D19299B54DAE065C
Chrome Cache Entry: 63	ASCII text, with very long lines (43607)	447AF7EC4273A32EC4369A36A7EDBA2B	F6E4245A676028BBDF718BC0F83CFA8E003D18D5	FD0B9BF43459DAFDD75C9058DAE8274A96EB1BBF3B97CFB1C77243C063C9C103
Chrome Cache Entry: 64	ASCII text, with no line terminators	9DB5598F64653B78EF9DA667F9E5E265	365C8462AEFCAF96C1990B40344D38954CC90515	0F3A8A16B6281092FBB7B50D77336BA35CE5417674468237830984604FC0EB51
Chrome Cache Entry: 65	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel	EA7D143EFE3C01DE298F9F1130E8BCE5	4672164FAB3870DD901034ABCF3D35998AC94DBE	94A9FEFBBE42310C03FF1E52C1F753C21038805F632867EA78930A52C445A456

Windows Analysis Report
https://ipfs.io/ipfs/bafybeicttreim53za5h4fhzjol5yvx7jo4wmlwyjlg72tiyxji2vwktw6q/?r=n5wgenlzfvxwyyrwgb6gi2lmmf4w4zk7ovzq

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://ipfs.io/ipfs/bafybeicttreim53za5h4fhzjol5yvx7jo4wmlwyjlg72tiyxji2vwktw6q/?r=n5wgenlzfvxwyyrwgb6gi2lmmf4w4zk7ovzq

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://ipfs.io/ipfs/bafybeicttreim53za5h4fhzjol5yvx7jo4wmlwyjlg72tiyxji2vwktw6q/?r=n5wgenlzfvxwyyrwgb6gi2lmmf4w4zk7ovzq