Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

9463911040.svg

HTML document, ASCII text, with very long lines (3295), with CRLF line terminators

initial sample

Details

Filetype:	HTML document, ASCII text, with very long lines (3295), with CRLF line terminators
Entropy:	5.756044521247237
Filename:	9463911040.svg
Filesize:	4360
MD5:	f5e200711b012492c7100a9e18d314ee
SHA1:	1829409144f381ca64d1e37983e0025f424d2f2f
SHA256:	af137a84c3edd93774cfec84fe065d9e31bd4ab7539199f0c67c258b428a802c
SHA512:	8e8c0abc2f6bb296adb75ff026915cbd20f8d293652849a995ca523a5ff9435d12f1741e2527cc999fea6854422bcbf40a1bb5393b6e52b6d680ec20db07b14c
SSDEEP:	96:lH15IZZy5rEvEtcwkbTjVhEzAMpME2IzFxA+5n:xEZMwEuJOzvFP
Preview:	The explorer composed a beautiful painting in the desert. -->..<svg xmlns="https://urldefense.us/v3/__http://www.w3.org/2000/svg__;!!MW8ZGGZDB-o0W0B9qXHf!bALac4MUwkjiRpVbOvEG4fzq2qohrj8VpaZfevSDbnow-PY6VduYWDeYf9H88snPOj6aW5rjEmUPM1OE0A$ " width="1

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6660_1220190882\_metadata\verified_contents.json

JSON data

dropped

Details

File:	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6660_1220190882\_metadata\verified_contents.json
Category:	dropped
Dump:	verified_contents.json.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	JSON data
Entropy:	6.019348476983808
Encrypted:	false
Ssdeep:	48:p/hP+drAdRW37aktiyC2xCe69xqYGCRk7NOzPI4Ek:RSQw37anyC+CDGGccA4f
Size:	1792
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6660_1220190882\manifest.fingerprint

ASCII text, with no line terminators

dropped

Details

File:	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6660_1220190882\manifest.fingerprint
Category:	dropped
Dump:	manifest.fingerprint.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with no line terminators
Entropy:	3.9364303497856072
Encrypted:	false
Ssdeep:	3:SQ/SHHHWbcM8VH5DM/4+MlRddVGWSDn:SQ/+HNMEZR+MlPdVGWSD
Size:	66
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6660_1220190882\manifest.json

JSON data

dropped

Details

File:	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6660_1220190882\manifest.json
Category:	dropped
Dump:	manifest.json.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	JSON data
Entropy:	4.60145350054745
Encrypted:	false
Ssdeep:	3:rR6TAulhFphifF1mYTdFKS1oMUm:F6VlMXdTHKS1oVm
Size:	97
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6660_1220190882\privacy-sandbox-attestations.dat

data

dropped

Details

File:	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6660_1220190882\privacy-sandbox-attestations.dat
Category:	dropped
Dump:	privacy-sandbox-attestations.dat.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	data
Entropy:	5.070572988249595
Encrypted:	false
Ssdeep:	192:I+0f6TueVE9GihNKybjrbgfJsSCiJig+pBWh3zJmOlwy1T:R0f6TudccKybbghsSCeig+vW31m7YT
Size:	7422
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	6660
Target ID:	0
Parent PID:	3960
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3388000
MD5:	E81F54E6C1129887AEA47E7D092680BF
Time:	12:32:49
Date:	17/03/2025
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff778810000
Modulesize:	3469312
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2008,i,7492967644631357018,6530129153233175342,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2028 /prefetch:3

Details

Is windows:	true
Is dropped:	false
PID:	7072
Target ID:	1
Parent PID:	6660
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2008,i,7492967644631357018,6530129153233175342,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2028 /prefetch:3
Size:	3388000
MD5:	E81F54E6C1129887AEA47E7D092680BF
Time:	12:32:50
Date:	17/03/2025
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff778810000
Modulesize:	3469312
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\9463911040.svg"

Details

Is windows:	true
Is dropped:	false
PID:	7568
Target ID:	4
Parent PID:	3960
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\9463911040.svg"
Size:	3388000
MD5:	E81F54E6C1129887AEA47E7D092680BF
Time:	12:32:56
Date:	17/03/2025
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff778810000
Modulesize:	3469312
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://mediavine.com

unknown

https://connatix.com

unknown

https://yelp.com

unknown

https://nodals.io

unknown

https://getyourguide.com

unknown

https://mediaintelligence.de

unknown

https://privacy-sandcastle-dev-dsp.web.app

unknown

https://privacy-sandbox-demos-dsp-a.dev

unknown

https://permutive.app

unknown

https://privacy-sandbox-demos-dsp.dev

unknown

https://adthrive.com

unknown

https://ad.gt

unknown

https://gumgum.com

unknown

https://trkkn.com

unknown

https://logly.co.jp

unknown

https://media6degrees.com

unknown

https://privacy-sandcastle-dev-ssp.web.app

unknown

https://inmobi.com

unknown

https://33across.com

unknown

https://dreammail.jp

unknown

https://jkforum.net

unknown

https://iobeya.com

unknown

https://a-mo.net

unknown

https://ebis.ne.jp

unknown

https://privacy-sandbox-demos-ssp-y.dev

unknown

https://aphub.ai

unknown

https://gama.globo

unknown

https://audienceproject.com

unknown

https://adsrvr.org

unknown

https://finn.no

unknown

https://lucead.com

unknown

https://verve.com

unknown

https://r2b2.io

unknown

https://bluems.com

unknown

https://edkt.io

unknown

https://atomex.net

unknown

https://crcldu.com

unknown

https://rubiconproject.com

unknown

https://sitescout.com

unknown

https://apex-football.com

unknown

https://dotomi.com

unknown

https://ctnsnet.com

unknown

https://toponad.com

unknown

https://shinobi.jp

unknown

https://superfine.org

unknown

https://360yield.com

unknown

https://usemax.de

unknown

https://display.io

unknown

https://adform.net

unknown

https://eloan.co.jp

unknown

https://postrelease.com

unknown

https://aqfer.com

unknown

https://docomo.ne.jp

unknown

https://shared-storage-demo-publisher-a.web.app

unknown

https://weborama-tech.ru

unknown

https://innovid.com

unknown

https://demand.supply

unknown

https://nexxen.tech

unknown

https://2k.com

unknown

https://advividnetwork.com

unknown

https://undertone.com

unknown

https://creative-serving.com

unknown

https://unrulymedia.com

unknown

https://tailtarget.com

unknown

https://paa-reporting-advertising.amazon

unknown

https://privacy-sandbox-demos-ssp-b.dev

unknown

https://bypass.jp

unknown

https://dotdashmeredith.com

unknown

https://atirun.com

unknown

https://adingo.jp

unknown

https://impact-ad.jp

unknown

https://admatrix.jp

unknown

https://openx.net

unknown

https://taboola.com

unknown

https://ayads.io

unknown

https://i-mobile.co.jp

unknown

https://uinterbox.com

unknown

https://mail.ru

unknown

https://simeola.com

unknown

https://gmossp-sp.jp

unknown

https://primecaster.net

unknown

https://privacy-sandcastle-dev-ssp-a.web.app

unknown

https://worldhistory.org

unknown

https://adnxs.com

unknown

https://dabbs.net

unknown

https://seedtag.com

unknown

https://casalemedia.com

unknown

https://privacy-sandcastle-dev-dsp-x.web.app

unknown

https://authorizedvault.com

unknown

https://privacy-sandcastle-dev-ssp-y.web.app

unknown

https://sportradarserving.com

unknown

https://semafor.com

unknown

https://lwadm.com

unknown

https://appconsent.io

unknown

https://vg.no

unknown

https://fout.jp

unknown

https://elle.com

unknown

https://privacy-sandcastle-dev-dsp-a1.web.app

unknown

https://flashtalking.com

unknown

https://pinterest.com

unknown

There are 90 hidden URLs, click here to show them.

Domains

Name

Malicious

www.google.com

172.217.16.196

Details

Name:	www.google.com
IP:	172.217.16.196
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Uses secure TLS version for HTTPS connections	Compliance, Networking

IPs

Domain

Country

Malicious

192.168.2.7

unknown

172.217.16.196

www.google.com

United States

Details

IP:	172.217.16.196
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Country:	United States
Countrycode:	USA
ASN number:	15169
ASN name:	GOOGLEUS
Private:	false
Domain:	www.google.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

192.168.2.4

unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
9463911040.svg

Files

Processes

URLs

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report9463911040.svg

Files

Processes

URLs

Domains

IPs

IOC Report
9463911040.svg