Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

4G1n4pmjH3.html

HTML document, Unicode text, UTF-8 text

initial sample

Details

Filetype:	HTML document, Unicode text, UTF-8 text
Entropy:	4.303083025907945
Filename:	4G1n4pmjH3.html
Filesize:	13910
MD5:	707400fc80c4466466c1f05494ff652b
SHA1:	ff7496bb48687961d3e64c90abadb5681217027b
SHA256:	b56a47d08edf4a0f1b1956e86b7e2b78174022c3b301d520cf15cf612749cee7
SHA512:	a8374323e545d5dc01ae6142a1ecce8cd81a786f2bb5dba1f50a7b3458b66ef69ebc1f0408c646d827e6ae1351d4c7c66b168c811d0bbbf5894466b44c90c9ba
SSDEEP:	192:2dk+6ekLxGLBTUqRg7QpSFp0F0SZV4a4d4PEd5+JwdODinsU6iP:0EFiFsdB5mwdODinsU6iP
Preview:	<!DOCTYPE html>..<html lang="en">. <head>. <meta charset="utf-8">. .. <link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.0.0/css/all.css"> . <style>. html, body {. margin: 0;.

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Suspicious Javascript code found in HTML file	Phishing
HTML page is missing a favicon	Phishing
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking

Chrome Cache Entry: 60

PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced

dropped

Details

File:	Chrome Cache Entry: 60
Category:	dropped
Dump:	chromecache_60.2.dr
ID:	dr_0
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Entropy:	7.641166907974247
Encrypted:	false
Ssdeep:	192:nSoe9pi6lPTkYgUWuXcTpyTngV9oBEOQE+uo//5cDcoyy6/Wannbb1l:SlM/YgUWusFx9oBJHo/YcZy6LbZl
Size:	9038
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 61

Zstandard compressed data (v0.8+), Dictionary ID: None

downloaded

Details

File:	Chrome Cache Entry: 61
Category:	downloaded
Dump:	chromecache_61.2.dr
ID:	dr_4
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	Zstandard compressed data (v0.8+), Dictionary ID: None
Entropy:	7.9660556994590594
Encrypted:	false
Ssdeep:	192:0NhuFSBldcU/IGm/rY+EWPfzJFAawjj3HzK:khsPGmbPwaMzK
Size:	7797
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 62

PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced

downloaded

Details

File:	Chrome Cache Entry: 62
Category:	downloaded
Dump:	chromecache_62.2.dr
ID:	dr_5
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Entropy:	7.641166907974247
Encrypted:	false
Ssdeep:	192:nSoe9pi6lPTkYgUWuXcTpyTngV9oBEOQE+uo//5cDcoyy6/Wannbb1l:SlM/YgUWusFx9oBJHo/YcZy6LbZl
Size:	9038
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 63

Web Open Font Format (Version 2), TrueType, length 52648, version 1.0

downloaded

Details

File:	Chrome Cache Entry: 63
Category:	downloaded
Dump:	chromecache_63.2.dr
ID:	dr_6
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	Web Open Font Format (Version 2), TrueType, length 52648, version 1.0
Entropy:	7.996033428788516
Encrypted:	true
Ssdeep:	1536:9eBlxzWRUJTVGP5v267Q1Sk+S2/D8l+8O2:9maeeP5v267Q7w8z
Size:	52648
Whitelisted:	false
Reputation:	moderate

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	6220
Target ID:	0
Parent PID:	4388
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3388000
MD5:	E81F54E6C1129887AEA47E7D092680BF
Time:	01:52:20
Date:	01/06/2025
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7ee090000
Modulesize:	3469312
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1968,i,2488983959081157426,10894814468624279180,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2232 /prefetch:3

Details

Is windows:	true
Is dropped:	false
PID:	7028
Target ID:	2
Parent PID:	6220
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1968,i,2488983959081157426,10894814468624279180,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2232 /prefetch:3
Size:	3388000
MD5:	E81F54E6C1129887AEA47E7D092680BF
Time:	01:52:28
Date:	01/06/2025
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7ee090000
Modulesize:	3469312
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1968,i,2488983959081157426,10894814468624279180,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3852 /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	1800
Target ID:	3
Parent PID:	6220
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1968,i,2488983959081157426,10894814468624279180,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3852 /prefetch:8
Size:	3388000
MD5:	E81F54E6C1129887AEA47E7D092680BF
Time:	01:52:30
Date:	01/06/2025
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7ee090000
Modulesize:	3469312
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\4G1n4pmjH3.html"

Details

Is windows:	true
Is dropped:	false
PID:	3264
Target ID:	6
Parent PID:	4388
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\4G1n4pmjH3.html"
Size:	3388000
MD5:	E81F54E6C1129887AEA47E7D092680BF
Time:	01:52:36
Date:	01/06/2025
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7ee090000
Modulesize:	3469312
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

file:///C:/Users/user/Desktop/4G1n4pmjH3.html

Details

Name:	file:///C:/Users/user/Desktop/4G1n4pmjH3.html
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Suspicious Javascript code found in HTML file	Phishing
HTML page is missing a favicon	Phishing
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking

https://www.google.com/intl/en/policies/terms/

unknown

http://c.pki.goog/r/r4.crl

142.250.113.94

https://sdfwer234.com/13.vbs

unknown

https://tradingviewprime.com/lander/tradingview/recaptcha-verify.html

unknown

https://tradingviewprime.com/lander/tradingview/recaptcha-project-browser-transparent.png

unknown

https://use.fontawesome.com/releases/v5.0.0/css/all.css

unknown

Details

Name:	https://use.fontawesome.com/releases/v5.0.0/css/all.css
TargetID:	-1
From Memory:	true
Source:	4G1n4pmjH3.html
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

https://www.google.com/intl/en/policies/privacy/

unknown

Domains

Name

Malicious

bg.microsoft.map.fastly.net

199.232.210.172

tradingviewprime.com

104.21.48.1

Details

Name:	tradingviewprime.com
IP:	104.21.48.1
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

www.google.com

173.194.208.106

Details

Name:	www.google.com
IP:	173.194.208.106
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

use.fontawesome.com.cdn.cloudflare.net

104.21.27.152

pki-goog.l.google.com

142.250.113.94

use.fontawesome.com

unknown

Details

Name:	use.fontawesome.com
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

c.pki.goog

unknown

Details

Name:	c.pki.goog
TargetID:	-1
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

104.21.48.1

tradingviewprime.com

United States

173.194.208.106

www.google.com

United States

104.21.27.152

use.fontawesome.com.cdn.cloudflare.net

United States

104.21.96.1

unknown

United States

192.168.2.5

unknown

DOM / HTML

URL

Malicious

file:///C:/Users/user/Desktop/4G1n4pmjH3.html

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
4G1n4pmjH3.html

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report4G1n4pmjH3.html

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
4G1n4pmjH3.html