Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
http://gaer.pages.dev/

Overview

General Information

Sample URL:http://gaer.pages.dev/
Analysis ID:1615612
Infos:

Detection

HTMLPhisher
Score:60
Range:0 - 100
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected HtmlPhish64
HTML page contains obfuscated javascript
Program does not show much activity (idle)

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 6688 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
    • chrome.exe (PID: 4776 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1964,i,13201100797479817930,9148215558595319706,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
    • chrome.exe (PID: 4784 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4348 --field-trial-handle=1964,i,13201100797479817930,9148215558595319706,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
  • chrome.exe (PID: 6048 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://gaer.pages.dev/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

HTML

SourceRuleDescriptionAuthorStrings
0.1.pages.csvJoeSecurity_HtmlPhish_64Yara detected HtmlPhish_64Joe Security
    0.0.pages.csvJoeSecurity_HtmlPhish_64Yara detected HtmlPhish_64Joe Security

      Sigma Signatures

      ⊘No Sigma rule has matched

      Suricata Signatures

      ⊘No Suricata rule has matched

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Antivirus / Scanner detection for submitted sample
      Source: http://gaer.pages.dev/Avira URL Cloud: detection malicious, Label: phishing

      Phishing

      barindex
      Yara detected HtmlPhish64
      Source: Yara matchFile source: 0.1.pages.csv, type: HTML
      Source: Yara matchFile source: 0.0.pages.csv, type: HTML
      HTML page contains obfuscated javascript
      Source: https://js.player.cntv.cn/creator/vodplayer.jsHTTP Parser: var a0_0x51f3=['7G179E7AA7A17G179P7A9','ui_webFullScreen','iPhone','zIndex','hasBarrage','barrageApp
      Source: https://gaer.pages.dev/HTTP Parser: No favicon
      Source: https://gaer.pages.dev/HTTP Parser: No favicon
      Source: https://global.cctv.com/2025/02/11/VIDEXn5JISu31MjktLhjJmo1250211.shtmlHTTP Parser: No favicon
      Source: https://global.cctv.com/2025/02/11/VIDEXn5JISu31MjktLhjJmo1250211.shtmlHTTP Parser: No favicon
      Source: https://global.cctv.com/2025/02/11/VIDEXn5JISu31MjktLhjJmo1250211.shtmlHTTP Parser: No favicon
      Source: https://global.cctv.com/2025/02/11/VIDEXn5JISu31MjktLhjJmo1250211.shtmlHTTP Parser: No favicon
      Source: https://global.cctv.com/2025/02/11/VIDEXn5JISu31MjktLhjJmo1250211.shtmlHTTP Parser: No favicon
      Source: https://global.cctv.com/2025/02/11/VIDEXn5JISu31MjktLhjJmo1250211.shtmlHTTP Parser: No favicon
      Source: https://global.cctv.com/2025/02/11/VIDEXn5JISu31MjktLhjJmo1250211.shtmlHTTP Parser: No favicon
      Source: https://global.cctv.com/2025/02/11/VIDEXn5JISu31MjktLhjJmo1250211.shtmlHTTP Parser: No favicon
      Source: chromecache_370.3.drString found in binary or memory: http://jsfiddle.net/NDYV8/16/
      Source: chromecache_370.3.drString found in binary or memory: http://jsfiddle.net/NDYV8/19/
      Source: chromecache_484.3.drString found in binary or memory: http://ns.attribution.com/ads/1.0/
      Source: chromecache_552.3.drString found in binary or memory: http://videojs.com/
      Source: chromecache_370.3.drString found in binary or memory: http://www.lalit.org/lab/javascript-css-font-detect/
      Source: chromecache_370.3.drString found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
      Source: chromecache_370.3.drString found in binary or memory: http://www.stucox.com/blog/you-cant-detect-a-touchscreen/
      Source: chromecache_370.3.drString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=781447
      Source: chromecache_346.3.drString found in binary or memory: https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=9
      Source: chromecache_370.3.drString found in binary or memory: https://github.com/Modernizr/Modernizr/blob/master/feature-detects/canvas/winding.js
      Source: chromecache_370.3.drString found in binary or memory: https://github.com/Modernizr/Modernizr/issues/548
      Source: chromecache_370.3.drString found in binary or memory: https://github.com/Valve/fingerprintjs2
      Source: chromecache_370.3.drString found in binary or memory: https://github.com/Valve/fingerprintjs2/issues/66
      Source: chromecache_552.3.drString found in binary or memory: https://github.com/kesla/parse-headers/
      Source: chromecache_552.3.drString found in binary or memory: https://github.com/kesla/parse-headers/blob/master/LICENCE
      Source: chromecache_552.3.drString found in binary or memory: https://github.com/mozilla/vtt.js
      Source: chromecache_552.3.drString found in binary or memory: https://github.com/mozilla/vtt.js/blob/main/LICENSE
      Source: chromecache_552.3.drString found in binary or memory: https://github.com/videojs/video.js/blob/main/LICENSE
      Source: chromecache_504.3.drString found in binary or memory: https://global.cctv.com/2024/11/03/VIDE00WMMkTMawWEVvRjeFZU241103.shtml
      Source: chromecache_504.3.drString found in binary or memory: https://global.cctv.com/2024/11/03/VIDE57d1ZMADGjMY4qWDGIyO241103.shtml
      Source: chromecache_504.3.drString found in binary or memory: https://global.cctv.com/2024/11/03/VIDE7cTPs5HjXhNm6gsZC2uP241103.shtml
      Source: chromecache_504.3.drString found in binary or memory: https://global.cctv.com/2024/11/03/VIDEWKeerOcVwNSv1EbdTjfo241103.shtml
      Source: chromecache_504.3.drString found in binary or memory: https://global.cctv.com/2024/11/07/VIDE69ABse1ynS8TqypFrVJ4241107.shtml
      Source: chromecache_504.3.drString found in binary or memory: https://global.cctv.com/2024/11/12/VIDEX2hrwzAbfCEBmt41fZCP241112.shtml
      Source: chromecache_504.3.drString found in binary or memory: https://global.cctv.com/2024/11/22/VIDEWSB4KwKIPeminssHFtKB241122.shtml
      Source: chromecache_504.3.drString found in binary or memory: https://global.cctv.com/2024/11/27/VIDE6R8sdOnaoJD4liCwbbAV241127.shtml
      Source: chromecache_504.3.drString found in binary or memory: https://global.cctv.com/2024/12/03/VIDE3VlPHb0GJ5BFmH6B8wid241203.shtml
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://global.cctv.com/2024/12/04/VIDE3SuMJLq97GA7XRe3ztIl241204.shtml
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://global.cctv.com/2024/12/06/VIDE43PMmdH3ky44ODjXy0k5241206.shtml
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://global.cctv.com/2024/12/06/VIDEQL44pOaZa5DwRnaWJZWK241206.shtml
      Source: chromecache_504.3.drString found in binary or memory: https://global.cctv.com/2024/12/10/VIDEnlrIFgWWq1iIcIafDYTj241210.shtml
      Source: chromecache_504.3.drString found in binary or memory: https://global.cctv.com/2024/12/17/VIDEipwD6cDS7BKqqfLsDlLi241217.shtml
      Source: chromecache_504.3.drString found in binary or memory: https://global.cctv.com/2024/12/27/VIDEY2rRHuTmjW2AbJdqXaXa241227.shtml
      Source: chromecache_504.3.drString found in binary or memory: https://global.cctv.com/2024/12/31/VIDESd7oTQcka90G4VTWZgsB241231.shtml
      Source: chromecache_504.3.drString found in binary or memory: https://global.cctv.com/2025/01/07/VIDEkEw5xA8clKYmw6eON0OG250107.shtml
      Source: chromecache_504.3.drString found in binary or memory: https://global.cctv.com/2025/01/14/VIDEQHPeuQn9iGmZk4ZLpfch250114.shtml
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://global.cctv.com/2025/01/17/VIDE2ZAnd1zluFZdshrPRUU6250117.shtml
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://global.cctv.com/2025/01/17/VIDE6KRxOqFYk1XvD6xgMA4D250117.shtml
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://global.cctv.com/2025/01/21/VIDEYsMj0ldiQrXFAaKvoWCU250121.shtml
      Source: chromecache_504.3.drString found in binary or memory: https://global.cctv.com/2025/01/22/VIDE44vchVcs64COSXEqPRjJ250122.shtml
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://global.cctv.com/2025/01/22/VIDEY4XtZi4s0p0ujqLLa3L3250122.shtml
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://global.cctv.com/2025/01/23/VIDEwR8xMpFcDYIe5NLTDeer250123.shtml
      Source: chromecache_504.3.drString found in binary or memory: https://global.cctv.com/2025/01/27/VIDEY6pbLQGPgjOK6F0I3bdb250127.shtml
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://global.cctv.com/2025/01/27/VIDEhzTVgmmoo3xnpeosudRs250127.shtml
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_504.3.dr, chromecache_410.3.drString found in binary or memory: https://global.cctv.com/2025/02/04/VIDEybiYWadtnrWnvvCyjGsI250204.shtml
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_504.3.dr, chromecache_410.3.drString found in binary or memory: https://global.cctv.com/2025/02/06/VIDE4NnTbvNJwk77JqSWZTlH250206.shtml
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://global.cctv.com/2025/02/06/VIDEcwBmypCij1CMeKMqchVu250206.shtml
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_504.3.dr, chromecache_410.3.drString found in binary or memory: https://global.cctv.com/2025/02/11/VIDEXn5JISu31MjktLhjJmo1250211.shtml
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://global.cctv.com/2025/02/14/VIDEEMqX1U5wnMJvyJvJUuAf250214.shtml
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://global.cctv.com/2025/02/14/VIDEfCNAzfKcddIqVczF7RNn250214.shtml
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://global.cctv.com/2025/02/14/VIDEx8OokRKCu7SFbjqc9cqV250214.shtml
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p1.img.cctvpic.com/fmspic/2023/01/17/2a6d1ccc3852408392ff08706460e48e-41287973-2.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p1.img.cctvpic.com/fmspic/2024/11/03/76b7a926be8147cb8ca6022366979a18-300.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p1.img.cctvpic.com/fmspic/2024/11/12/35bf524c7a0c4a5dbae59fbe22f3653c-1.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p1.img.cctvpic.com/fmspic/2024/11/27/5543c06b05bb4596b9bb8f411aeaa82f-1.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p1.img.cctvpic.com/fmspic/2024/12/04/3974a1337c0844e9b691520072659264-300.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p1.img.cctvpic.com/fmspic/2025/01/07/f4d4981c63ad47ad9b0b436df933de91-300.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p1.img.cctvpic.com/fmspic/2025/01/14/1bba66b961e246d3b9baeaf3a166164f-1.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p1.img.cctvpic.com/fmspic/2025/01/27/203ce7c7867d4ac1814bbec34e92d849-300.jpg
      Source: chromecache_410.3.drString found in binary or memory: https://p1.img.cctvpic.com/fmspic/2025/02/04/f39f74da3ba14825b75a6431b3c79bc4-1.jpg
      Source: chromecache_410.3.drString found in binary or memory: https://p1.img.cctvpic.com/fmspic/2025/02/14/b91263527f194c2f986de8e82e8dd3f0-1.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p1.img.cctvpic.com/photoworkspace/2024/11/22/2024112210150936333.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p1.img.cctvpic.com/photoworkspace/2025/01/27/2025012717220529870.png
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p1.img.cctvpic.com/photoworkspace/2025/02/06/2025020615143717202.png
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p2.img.cctvpic.com/fmspic/2023/01/18/c95f263f972f4096835195f788aa0eeb-41300977-2.jpg
      Source: chromecache_410.3.drString found in binary or memory: https://p2.img.cctvpic.com/fmspic/2024/12/06/a70f6aa0f7ff44f996febb1b4a7bd85f-1.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p2.img.cctvpic.com/fmspic/2024/12/17/2cafba71f31a4a30b209d04472fc4b4f-300.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p2.img.cctvpic.com/fmspic/2025/01/22/be19a3ef37a04c8d86b2b4a3c1273578-1.jpg
      Source: chromecache_410.3.drString found in binary or memory: https://p2.img.cctvpic.com/fmspic/2025/02/14/22fe4e2d2f1b4c4fb58b03025e8ac43d-1.jpg
      Source: chromecache_615.3.drString found in binary or memory: https://p2.img.cctvpic.com/photoAlbum/templet/common/TPTERE93VfAfo34uSEe8veca211216/headerDown.png?a
      Source: chromecache_615.3.drString found in binary or memory: https://p2.img.cctvpic.com/photoAlbum/templet/common/TPTERE93VfAfo34uSEe8veca211216/headerUp.png?a
      Source: chromecache_504.3.drString found in binary or memory: https://p2.img.cctvpic.com/photoworkspace/2024/12/03/2024120314061337900.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p2.img.cctvpic.com/photoworkspace/2024/12/27/2024122714504016973.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p2.img.cctvpic.com/photoworkspace/2025/01/17/2025011716100791275.png
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p2.img.cctvpic.com/photoworkspace/2025/01/22/2025012217494281075.png
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_504.3.dr, chromecache_410.3.drString found in binary or memory: https://p2.img.cctvpic.com/photoworkspace/2025/02/11/2025021111202087715.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p3.img.cctvpic.com/fmspic/2023/01/18/c95f263f972f4096835195f788aa0eeb-41300977-0.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/11/03/1cb1af9252224be98bd243af4592d594-1.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/11/03/1cb1af9252224be98bd243af4592d594-300.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/11/03/22f4a69a46e840fc812ac3cc98871ca4-1.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/11/07/6c7c887889ce4740bfed02a125f9d37d-300.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/11/12/35bf524c7a0c4a5dbae59fbe22f3653c-300.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/12/03/9aa26225e7f746ecb26783a5535f4d4f-1.jpg
      Source: chromecache_410.3.drString found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/12/04/3974a1337c0844e9b691520072659264-1.jpg
      Source: chromecache_410.3.drString found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/12/06/a5bf28aeeacb4a03840f7ec928314db2-1.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/12/17/2cafba71f31a4a30b209d04472fc4b4f-1.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/12/27/4d7c20ef7ed7402087b9dc56fcb5d59e-1.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/12/27/4d7c20ef7ed7402087b9dc56fcb5d59e-300.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/12/31/66b031436eb54a248a76dd64408cc6ea-300.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p3.img.cctvpic.com/fmspic/2025/01/22/be19a3ef37a04c8d86b2b4a3c1273578-300.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p3.img.cctvpic.com/fmspic/2025/01/27/203ce7c7867d4ac1814bbec34e92d849-1.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p3.img.cctvpic.com/fmspic/2025/01/27/81b6d8a1bcb544b7a503630e8acebf42-1.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p3.img.cctvpic.com/fmspic/2025/01/27/81b6d8a1bcb544b7a503630e8acebf42-300.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_504.3.dr, chromecache_410.3.drString found in binary or memory: https://p3.img.cctvpic.com/fmspic/2025/02/04/f39f74da3ba14825b75a6431b3c79bc4-300.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p3.img.cctvpic.com/fmspic/2025/02/06/5cd761ce0e1d4cbcbf9e0c0df80f4625-1.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p3.img.cctvpic.com/fmspic/2025/02/14/22fe4e2d2f1b4c4fb58b03025e8ac43d-300.jpg
      Source: chromecache_410.3.drString found in binary or memory: https://p3.img.cctvpic.com/fmspic/2025/02/14/8ce8e0234bae4060b5d1a86e9caf6323-1.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p3.img.cctvpic.com/photoworkspace/2025/01/21/2025012117463081616.png
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p3.img.cctvpic.com/photoworkspace/2025/01/23/2025012317535344640.png
      Source: chromecache_504.3.drString found in binary or memory: https://p3.img.cctvpic.com/photoworkspace/2025/01/27/2025012714583875799.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_504.3.dr, chromecache_410.3.drString found in binary or memory: https://p3.img.cctvpic.com/photoworkspace/2025/02/06/2025020613581254371.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p4.img.cctvpic.com/fmspic/2023/01/17/2a6d1ccc3852408392ff08706460e48e-41287973-0.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p4.img.cctvpic.com/fmspic/2023/01/19/8403096164fd4b3eb1b6591cddfa8e71-41312559-0.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p4.img.cctvpic.com/fmspic/2023/01/19/8403096164fd4b3eb1b6591cddfa8e71-41312559-2.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p4.img.cctvpic.com/fmspic/2024/11/03/22f4a69a46e840fc812ac3cc98871ca4-300.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p4.img.cctvpic.com/fmspic/2024/11/03/76b7a926be8147cb8ca6022366979a18-1.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p4.img.cctvpic.com/fmspic/2024/11/27/5543c06b05bb4596b9bb8f411aeaa82f-300.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p4.img.cctvpic.com/fmspic/2024/12/06/a70f6aa0f7ff44f996febb1b4a7bd85f-300.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p4.img.cctvpic.com/fmspic/2024/12/10/b96e596d1a46421585833f943386f1b4-1.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p4.img.cctvpic.com/fmspic/2024/12/10/b96e596d1a46421585833f943386f1b4-300.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p4.img.cctvpic.com/fmspic/2025/01/14/1bba66b961e246d3b9baeaf3a166164f-300.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p4.img.cctvpic.com/fmspic/2025/01/17/82edbd2f9ee048f2b4e3e582302c630c-300.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_504.3.dr, chromecache_410.3.drString found in binary or memory: https://p4.img.cctvpic.com/fmspic/2025/02/06/5d60cdb5cdcd40af8c46095a5ffcac29-1.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p4.img.cctvpic.com/fmspic/2025/02/14/8ce8e0234bae4060b5d1a86e9caf6323-300.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p4.img.cctvpic.com/fmspic/2025/02/14/b91263527f194c2f986de8e82e8dd3f0-300.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p4.img.cctvpic.com/photoworkspace/2025/01/22/2025012211055516232.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p5.img.cctvpic.com/fmspic/2024/11/03/0324a65ff83e470ab93d76c97b1b6108-1.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p5.img.cctvpic.com/fmspic/2024/11/03/0324a65ff83e470ab93d76c97b1b6108-300.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p5.img.cctvpic.com/fmspic/2024/11/07/6c7c887889ce4740bfed02a125f9d37d-1.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p5.img.cctvpic.com/fmspic/2024/12/03/9aa26225e7f746ecb26783a5535f4d4f-300.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p5.img.cctvpic.com/fmspic/2024/12/06/a5bf28aeeacb4a03840f7ec928314db2-300.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p5.img.cctvpic.com/fmspic/2024/12/31/66b031436eb54a248a76dd64408cc6ea-1.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p5.img.cctvpic.com/fmspic/2025/01/07/f4d4981c63ad47ad9b0b436df933de91-1.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p5.img.cctvpic.com/fmspic/2025/01/17/0692dae40c5240cdb45cab03a78bb4b5-1.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p5.img.cctvpic.com/fmspic/2025/01/17/0692dae40c5240cdb45cab03a78bb4b5-300.jpg
      Source: chromecache_410.3.drString found in binary or memory: https://p5.img.cctvpic.com/fmspic/2025/01/17/82edbd2f9ee048f2b4e3e582302c630c-1.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_410.3.drString found in binary or memory: https://p5.img.cctvpic.com/fmspic/2025/02/06/5cd761ce0e1d4cbcbf9e0c0df80f4625-300.jpg
      Source: chromecache_270.3.dr, chromecache_462.3.dr, chromecache_504.3.dr, chromecache_410.3.drString found in binary or memory: https://p5.img.cctvpic.com/fmspic/2025/02/06/5d60cdb5cdcd40af8c46095a5ffcac29-300.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p5.img.cctvpic.com/photoworkspace/2024/11/07/2024110711142612707.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p5.img.cctvpic.com/photoworkspace/2024/11/13/2024111311252714720.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p5.img.cctvpic.com/photoworkspace/2024/11/27/2024112715090749784.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p5.img.cctvpic.com/photoworkspace/2025/01/03/2025010316300876860.jpg
      Source: chromecache_504.3.drString found in binary or memory: https://p5.img.cctvpic.com/photoworkspace/2025/01/14/2025011415411893350.jpg
      Source: chromecache_552.3.drString found in binary or memory: https://www.brightcove.com/
      Source: chromecache_370.3.drString found in binary or memory: https://www.browserleaks.com/canvas#how-does-it-work
      Source: classification engineClassification label: mal60.phis.win@20/551@0/32
      Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1964,i,13201100797479817930,9148215558595319706,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
      Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://gaer.pages.dev/"
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4348 --field-trial-handle=1964,i,13201100797479817930,9148215558595319706,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1964,i,13201100797479817930,9148215558595319706,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4348 --field-trial-handle=1964,i,13201100797479817930,9148215558595319706,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
      Source: Window RecorderWindow detected: More than 3 window changes detected
      Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
      Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath Interception1
      Process Injection      		1
      Process Injection      		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.