Analysis Report Fennec Pharma .docx

Overview

General Information

Sample Name: Fennec Pharma .docx
Analysis ID: 321374
MD5: e935876bc1daf073b5730cfef5ee1b6f
SHA1: 2f0444a05ac3eca81313712825fec001efceb3ac
SHA256: 494148b0b3b41783ae059b3344248b7ea1d5ce4a99f00c55f7631f9493d44483

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 64
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Yara detected HtmlPhish_10
Phishing site detected (based on image similarity)
Phishing site detected (based on logo template match)
Allocates a big amount of memory (probably used for heap spraying)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTML body contains low number of good links
HTML title does not match URL
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Sample execution stops while process was sleeping (likely an evasion)

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html SlashNext: Label: Fake Login Page type: Phishing & Social Engineering
Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html UrlScan: Label: phishing brand: generic microsoft Perma Link

Phishing:

barindex
Yara detected HtmlPhish_10
Source: Yara match File source: 445817.3.links.csv, type: HTML
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\dfce06801e1a85d6d06f1fdd4475dacd[1].htm, type: DROPPED
Phishing site detected (based on image similarity)
Source: https://s3.amazonaws.com/simbla-static-2/2020/11/5faba665321d68001d4fc0e4/5faba6db73aef50019af7085/rC56cpX1uS2qJKOxJ-5Sb8u-.svg Matcher: Found strong image similarity, brand: Microsoft Jump to dropped file
Phishing site detected (based on logo template match)
Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html Matcher: Template: microsoft matched
HTML body contains low number of good links
Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html HTTP Parser: Number of links: 0
Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html HTTP Parser: Number of links: 0
HTML title does not match URL
Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html HTTP Parser: Title: Log-In does not match URL
Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html HTTP Parser: Title: Log-In does not match URL
Source: https://workflowy.com/login/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI HTTP Parser: No <meta name="author".. found
Source: https://workflowy.com/login/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI HTTP Parser: No <meta name="author".. found
Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html HTTP Parser: No <meta name="author".. found
Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html HTTP Parser: No <meta name="author".. found
Source: https://workflowy.com/signup/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI HTTP Parser: No <meta name="author".. found
Source: https://workflowy.com/signup/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI HTTP Parser: No <meta name="author".. found
Source: https://workflowy.com/login/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI HTTP Parser: No <meta name="copyright".. found
Source: https://workflowy.com/login/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI HTTP Parser: No <meta name="copyright".. found
Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html HTTP Parser: No <meta name="copyright".. found
Source: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html HTTP Parser: No <meta name="copyright".. found
Source: https://workflowy.com/signup/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI HTTP Parser: No <meta name="copyright".. found
Source: https://workflowy.com/signup/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI HTTP Parser: No <meta name="copyright".. found

Software Vulnerabilities:

barindex
Allocates a big amount of memory (probably used for heap spraying)
Source: winword.exe Memory has grown: Private usage: 0MB later: 71MB

Networking:

barindex
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 74.125.140.157 74.125.140.157
Source: Joe Sandbox View IP Address: 104.16.19.94 104.16.19.94
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c
Source: Joe Sandbox View JA3 fingerprint: 3faf2df7ab96c36419c31725cb1fa7d6
Source: msapplication.xml0.6.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x25f7e74b,0x01d6bfef</date><accdate>0x25f7e74b,0x01d6bfef</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.6.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x25f7e74b,0x01d6bfef</date><accdate>0x25f7e74b,0x01d6bfef</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.6.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x25fcabf8,0x01d6bfef</date><accdate>0x25fcabf8,0x01d6bfef</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.6.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x25fcabf8,0x01d6bfef</date><accdate>0x25fcabf8,0x01d6bfef</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.6.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x25ff0e5d,0x01d6bfef</date><accdate>0x25ff0e5d,0x01d6bfef</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.6.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x25ff0e5d,0x01d6bfef</date><accdate>0x25ff0e5d,0x01d6bfef</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: js[1].js.7.dr String found in binary or memory: F=V("YT"),M=function(){f(D)};I(v.vtp_gtmOnSuccess);if(F)F.ready&&F.ready(M);else{var P=V("onYouTubeIframeAPIReady");nm("onYouTubeIframeAPIReady",function(){P&&P();M()});I(function(){for(var W=V("document"),Z=W.getElementsByTagName("script"),na=Z.length,J=0;J<na;J++){var K=Z[J].getAttribute("src");if(b(K,"iframe_api")||b(K,"player_api"))return}for(var S=W.getElementsByTagName("iframe"),R=S.length,Q=0;Q<R;Q++)if(!u&&d(S[Q],D.af)){N("https://www.youtube.com/iframe_api");u=!0;break}})}}else I(v.vtp_gtmOnSuccess)} equals www.youtube.com (Youtube)
Source: document_view.min[1].js.7.dr String found in binary or memory: re glad you like WorkFlowy. Please share it with your friends!"),!c.d()&&o.createElement(o.Fragment,null,o.createElement("div",{className:Object(l.e)({marginBottom:"24px",lineHeight:"20px",fontSize:"13px"})},o.createElement("strong",null,"When a friend signs up through your Facebook post, we'll give you"," ",s===d?"both "+s+" more monthly items.":s+" more monthly items."+(d?" They'll get "+d+" more items too.":""))," ","You currently have ",i," WorkFlowy items per month.")),o.createElement(a.b,{buttonStyle:a.a.Primary,onClick:function(){var e=f+"&utm_campaign=friend_recommendation_prompt_10_days&utm_medium=facebook&utm_source=wf";window.open("https://www.facebook.com/sharer/sharer.php?u="+e,"Share WorkFlowy","height=640,width=558,left=50,top=50"),_gaq.push(["_trackPageview","/virtual/friend_recommendation_prompt/10_days/facebook_share_button_clicked"])}},"Share WorkFlowy on Facebook")))}},t}return d(t,e),t.prototype.componentWillUnount=function(){_gaq.push(["_trackPageview","/virtual/friend_recommendation_prompt/10_days/rating_dialog_closed/"])},t.prototype.render=function(){return o.createElement(o.Fragment,null,o.createElement(u.b,null,"What do you think of WorkFlowy?"),o.createElement("div",{className:Object(l.e)({marginTop:"24px",marginBottom:"24px"})},"Please click a star to rate WorkFlowy."),o.createElement(p,{onChange:this.onRatingChange}),o.createElement("div",{className:Object(l.e)({marginTop:"24px",marginBottom:"12px",fontSize:"13px",lineHeight:"20px"})},"You equals www.facebook.com (Facebook)
Source: js[1].js.7.dr String found in binary or memory: var p=["www.youtube.com","www.youtube-nocookie.com"],t={UNSTARTED:-1,ENDED:0,PLAYING:1,PAUSED:2,BUFFERING:3,CUED:5},n,u=!1;(function(v){Y.__ytl=v;Y.__ytl.b="ytl";Y.__ytl.g=!0;Y.__ytl.priorityOverride=0})(function(v){v.vtp_triggerStartOption?r(v):bh(function(){r(v)})})}(); equals www.youtube.com (Youtube)
Source: unknown DNS traffic detected: queries for: workflowy.com
Source: document_view.min[1].js.7.dr String found in binary or memory: http://getfirefox.com
Source: document_view.min[1].js.7.dr String found in binary or memory: http://google.com/chrome
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: http://jquery.org/license
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: popper.min[1].js.7.dr String found in binary or memory: http://opensource.org/licenses/MIT).
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: msapplication.xml.6.dr String found in binary or memory: http://www.amazon.com/
Source: ga[1].js.7.dr String found in binary or memory: http://www.google-analytics.com
Source: msapplication.xml1.6.dr String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.6.dr String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.6.dr String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.6.dr String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.6.dr String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.6.dr String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.6.dr String found in binary or memory: http://www.youtube.com/
Source: js[2].js.7.dr String found in binary or memory: https://ade.googlesyndication.com/ddm/activity
Source: js[2].js.7.dr String found in binary or memory: https://adservice.google.com/ddm/regclk
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.7.dr String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: analytics[1].js.7.dr String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: js[1].js.7.dr String found in binary or memory: https://analytics.google.com/g/collect
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://api.aadrm.com/
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://api.diagnostics.office.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://api.diagnosticssdf.office.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://api.microsoftstream.com/api/
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://api.office.net
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://api.onedrive.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://apis.live.net/v5.0/
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://augloop.office.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://augloop.office.com/v2
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://autodiscover-s.outlook.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=378607
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=449857
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=470258
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=589347
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://bugs.jquery.com/ticket/12359
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://bugs.jquery.com/ticket/13378
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=136851
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=137337
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=687787
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://cdn.entity.
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.7.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://clients.config.office.net/
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.7.dr String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.7.dr String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.7.dr String found in binary or memory: https://code.jquery.com/jquery-3.3.1.js
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://config.edge.skype.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://cortana.ai
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://cr.office.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://dataservice.o365filtering.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://dataservice.o365filtering.com/
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://devnull.onenote.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://directory.services.
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://drafts.csswg.org/cssom/#common-serializing-idioms
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://drafts.csswg.org/cssom/#resolved-values
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://entitlement.diagnostics.office.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: free-v4-shims.min[1].css.7.dr, free-fa-solid-900[1].eot.7.dr String found in binary or memory: https://fontawesome.com
Source: free-v4-shims.min[1].css.7.dr String found in binary or memory: https://fontawesome.com/license/free
Source: free-fa-solid-900[1].eot.7.dr, free-fa-regular-400[1].eot.7.dr String found in binary or memory: https://fontawesome.comhttps://fontawesome.comFont
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.7.dr String found in binary or memory: https://fonts.googleapis.com/css?family=Archivo
Source: css[2].css.7.dr String found in binary or memory: https://fonts.gstatic.com/s/archivonarrow/v12/tss0ApVBdCYD5Q7hcxTE1ArZ0bbwiXo.woff)
Source: css[1].css.7.dr String found in binary or memory: https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN7rgOUuhv.woff)
Source: css[1].css.7.dr String found in binary or memory: https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN8rsOUuhv.woff)
Source: css[1].css.7.dr String found in binary or memory: https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN_r8OUuhv.woff)
Source: css[1].css.7.dr String found in binary or memory: https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0d.woff)
Source: bootstrap.min[1].css.7.dr, bootstrap.min[1].js.7.dr String found in binary or memory: https://getbootstrap.com)
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://github.com/eslint/eslint/issues/3229
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://github.com/eslint/eslint/issues/6125
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://github.com/jquery/jquery/pull/557)
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://github.com/jquery/sizzle/pull/225
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
Source: js[2].js.7.dr String found in binary or memory: https://github.com/krux/postscribe/blob/master/LICENSE.
Source: bootstrap.min[1].css.7.dr, bootstrap.min[1].js.7.dr String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: bootstrap.min[1].js.7.dr String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://graph.ppe.windows.net
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://graph.ppe.windows.net/
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://graph.windows.net
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://graph.windows.net/
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://html.spec.whatwg.org/#strip-and-collapse-whitespace
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#category-listed
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#attributes-2
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&amp;premium=1
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&amp;premium=1
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&amp;premium=1
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://incidents.diagnostics.office.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&amp;adlt=strict&amp;hostType=Immersive
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: {4F0DC65E-2BE2-11EB-90E4-ECF4BB862DED}.dat.6.dr String found in binary or memory: https://jamif-cdn3d.us
Source: {4F0DC65E-2BE2-11EB-90E4-ECF4BB862DED}.dat.6.dr, ~DF36F3C25722F1499C.TMP.6.dr String found in binary or memory: https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://jquery.com/
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://jquery.org/license
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://jsperf.com/getall-vs-sizzle/2
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://jsperf.com/thor-indexof-vs-for/5
Source: 585b051251[1].js.7.dr String found in binary or memory: https://ka-f.fontawesome.com
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.7.dr String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://lifecycle.office.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://login.microsoftonline.com/
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://login.windows.local
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://management.azure.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://management.azure.com/
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.7.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.7.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://messaging.office.com/
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://ncus-000.contentsync.
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://ncus-000.pagecontentsync.
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://officeapps.live.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://onedrive.live.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://onedrive.live.com/embed?
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://outlook.office.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://outlook.office365.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: js[2].js.7.dr String found in binary or memory: https://pagead2.googlesyndication.com
Source: js[2].js.7.dr String found in binary or memory: https://pagead2.googlesyndication.com/
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://powerlift.acompli.net
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://promisesaplus.com/#point-48
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://promisesaplus.com/#point-54
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://promisesaplus.com/#point-57
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://promisesaplus.com/#point-59
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://promisesaplus.com/#point-61
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://promisesaplus.com/#point-64
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://promisesaplus.com/#point-75
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.7.dr String found in binary or memory: https://s3.amazonaws.com/simbla-static-2/2020/11/5faba665321d68001d4fc0e4/5faba6db73aef50019af7085/Z
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.7.dr String found in binary or memory: https://s3.amazonaws.com/simbla-static-2/2020/11/5faba665321d68001d4fc0e4/5faba6db73aef50019af7085/r
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://settings.outlook.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://shell.suite.office.com:1443
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://sizzlejs.com/
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://skyapi.live.net/Activity/
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: ga[1].js.7.dr String found in binary or memory: https://ssl.google-analytics.com
Source: Tdcv9KOl0AuohEPI[1].htm0.7.dr String found in binary or memory: https://ssl.google-analytics.com/ga.js
Source: ga[1].js.7.dr String found in binary or memory: https://ssl.google-analytics.com/j/__utm.gif
Source: js[1].js.7.dr String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: js[1].js.7.dr String found in binary or memory: https://stats.g.doubleclick.net/g/collect?v=2&
Source: analytics[1].js.7.dr String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: ga[1].js.7.dr String found in binary or memory: https://stats.g.doubleclick.net/j/collect?
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://store.office.cn/addinstemplate
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://store.office.com/?productgroup=Outlook
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://store.office.com/addinstemplate
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://store.office.de/addinstemplate
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://store.officeppe.com/addinstemplate
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://tasks.office.com
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://templatelogging.office.com/client/log
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: dfce06801e1a85d6d06f1fdd4475dacd[1].htm.7.dr String found in binary or memory: https://ukrainianpolicy.ru/Dee23ope11nov/next.php
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/
Source: jquery-3.3.1[1].js.7.dr String found in binary or memory: https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-a
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://web.microsoftstream.com/video/
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: {4F0DC65E-2BE2-11EB-90E4-ECF4BB862DED}.dat.6.dr String found in binary or memory: https://workflowy-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.htmlRoot
Source: {4F0DC65E-2BE2-11EB-90E4-ECF4BB862DED}.dat.6.dr String found in binary or memory: https://workflowy.com/
Source: login[1].htm0.7.dr, signup[1].htm0.7.dr String found in binary or memory: https://workflowy.com/accounts/password_reset/
Source: {4F0DC65E-2BE2-11EB-90E4-ECF4BB862DED}.dat.6.dr, ~DF36F3C25722F1499C.TMP.6.dr String found in binary or memory: https://workflowy.com/login/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI
Source: {4F0DC65E-2BE2-11EB-90E4-ECF4BB862DED}.dat.6.dr String found in binary or memory: https://workflowy.com/login/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI&Log
Source: imagestore.dat.7.dr String found in binary or memory: https://workflowy.com/media/i/favicon.ico
Source: imagestore.dat.7.dr String found in binary or memory: https://workflowy.com/media/i/favicon.ico~
Source: document_view.min[1].js.7.dr String found in binary or memory: https://workflowy.com/referrals/
Source: {4F0DC65E-2BE2-11EB-90E4-ECF4BB862DED}.dat.6.dr String found in binary or memory: https://workflowy.com/s/this-doRoot
Source: {4F0DC65E-2BE2-11EB-90E4-ECF4BB862DED}.dat.6.dr, ~WRS{FABF639E-4792-4112-BF52-2B5E333F7251}.tmp.0.dr String found in binary or memory: https://workflowy.com/s/this-document-is-too/Tdcv9KOl0AuohEPI
Source: {4F0DC65E-2BE2-11EB-90E4-ECF4BB862DED}.dat.6.dr, ~DF36F3C25722F1499C.TMP.6.dr String found in binary or memory: https://workflowy.com/s/this-document-is-too/Tdcv9KOl0AuohEPI#/7686a5f8c6e6
Source: ~DF36F3C25722F1499C.TMP.6.dr String found in binary or memory: https://workflowy.com/s/this-document-is-too/Tdcv9KOl0AuohEPI#/7686a5f8c6e6y.com/media/i/favicon.ico
Source: {4F0DC65E-2BE2-11EB-90E4-ECF4BB862DED}.dat.6.dr String found in binary or memory: https://workflowy.com/s/this-document-is-too/Tdcv9KOl0AuohEPIRoot
Source: {4F0DC65E-2BE2-11EB-90E4-ECF4BB862DED}.dat.6.dr String found in binary or memory: https://workflowy.com/s/this-document-is-too/Tdcv9KOl0AuohEPInThis
Source: {4F0DC65E-2BE2-11EB-90E4-ECF4BB862DED}.dat.6.dr, ~DF36F3C25722F1499C.TMP.6.dr String found in binary or memory: https://workflowy.com/signup/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://wus2-000.contentsync.
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://wus2-000.pagecontentsync.
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: js[2].js.7.dr String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: js[1].js.7.dr String found in binary or memory: https://www.google-analytics.com/g/collect
Source: analytics[1].js.7.dr String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: analytics[1].js.7.dr String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: ga[1].js.7.dr String found in binary or memory: https://www.google.%/ads/ga-audiences?
Source: js[2].js.7.dr String found in binary or memory: https://www.google.com
Source: ga[1].js.7.dr String found in binary or memory: https://www.google.com/analytics/web/inpage/pub/inpage.js?
Source: js[2].js.7.dr String found in binary or memory: https://www.google.com/travel/flights/click/conversion/
Source: js[2].js.7.dr String found in binary or memory: https://www.googletagmanager.com/debug/bootstrap
Source: analytics[1].js.7.dr String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: js[2].js.7.dr String found in binary or memory: https://www.googletraveladservices.com/travel/clk/pagead/conversion/
Source: CAFA8CBC-8827-49EF-9BA3-5B2EB2C2B7DA.0.dr String found in binary or memory: https://www.odwebp.svc.ms
Source: js[1].js.7.dr String found in binary or memory: https://www.youtube.com/iframe_api
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: classification engine Classification label: mal64.phis.winDOCX@6/77@12/6
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\{A47002BD-9435-4C5A-BFF9-34311B4BD7CA} - OProcSessId.dat Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE' /Automation -Embedding
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6300 CREDAT:17410 /prefetch:2
Source: unknown Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6300 CREDAT:17410 /prefetch:2 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Fennec Pharma .docx Initial sample: OLE zip file path = word/_rels/header1.xml.rels
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\splwow64.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\splwow64.exe Window / User API: threadDelayed 1006 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\splwow64.exe Last function: Thread delayed
Source: C:\Windows\splwow64.exe Last function: Thread delayed
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 321374 Sample: Fennec Pharma .docx Startdate: 21/11/2020 Architecture: WINDOWS Score: 64 19 workflowy.com 2->19 27 Antivirus detection for URL or domain 2->27 29 Yara detected HtmlPhish_10 2->29 31 Phishing site detected (based on image similarity) 2->31 33 Phishing site detected (based on logo template match) 2->33 7 iexplore.exe 2 86 2->7         started        9 WINWORD.EXE 43 43 2->9         started        signatures3 process4 process5 11 iexplore.exe 6 88 7->11         started        15 splwow64.exe 9->15         started        dnsIp6 21 us-east-1.linodeobjects.com 97.107.137.245, 443, 49765, 49766 LINODE-APLinodeLLCUS United States 11->21 23 stats.l.doubleclick.net 74.125.140.157, 443, 49733, 49734 GOOGLEUS United States 11->23 25 12 other IPs or domains 11->25 17 dfce06801e1a85d6d06f1fdd4475dacd[1].htm, HTML 11->17 dropped file7
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
54.84.56.113
 unknown United States
14618 AMAZON-AESUS false
97.107.137.245
 unknown United States
63949 LINODE-APLinodeLLCUS false
74.125.140.157
 unknown United States
15169 GOOGLEUS false
52.217.4.102
 unknown United States
16509 AMAZON-02US false
104.16.19.94
 unknown United States
13335 CLOUDFLARENETUS false

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
workflowy.com 54.84.56.113 true
us-east-1.linodeobjects.com 97.107.137.245 true
s3.amazonaws.com 52.217.4.102 true
stats.l.doubleclick.net 74.125.140.157 true
cdnjs.cloudflare.com 104.16.19.94 true
ka-f.fontawesome.com unknown unknown
code.jquery.com unknown unknown
kit.fontawesome.com unknown unknown
js-agent.newrelic.com unknown unknown
maxcdn.bootstrapcdn.com unknown unknown
jamif-cdn3d.us-east-1.linodeobjects.com unknown unknown
bam-cell.nr-data.net unknown unknown
stats.g.doubleclick.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://jamif-cdn3d.us-east-1.linodeobjects.com/dfce06801e1a85d6d06f1fdd4475dacd.html true
  • 100%, UrlScan, Browse
  • SlashNext: Fake Login Page type: Phishing & Social Engineering
 unknown
https://workflowy.com/signup/?next=/s/this-document-is-too/Tdcv9KOl0AuohEPI false
    		high
    https://workflowy.com/s/this-document-is-too/Tdcv9KOl0AuohEPI#/7686a5f8c6e6 false
      		high
      https://workflowy.com/s/this-document-is-too/Tdcv9KOl0AuohEPI false
        		high