Analysis Report https://tenderdocsrfp.typeform.com/to/RVzhstxV

Overview

General Information

Sample URL:	https://tenderdocsrfp.typeform.com/to/RVzhstxV
Analysis ID:	322824
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish_10

Allocates a big amount of memory (probably used for heap spraying)

HTML body contains low number of good links

HTML title does not match URL

Invalid 'forgot password' link found

Classification

Signatures

Phishing:

Yara detected HtmlPhish_10

Source: Yara match	File source: 496536.0.links.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\submission[1].htm, type: DROPPED

HTML body contains low number of good links

Source: https://getrfpsubs.com/submission/	HTTP Parser: Number of links: 0
Source: https://getrfpsubs.com/submission/	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://getrfpsubs.com/submission/	HTTP Parser: Title: Sign in to Outlook does not match URL
Source: https://getrfpsubs.com/submission/	HTTP Parser: Title: Sign in to Outlook does not match URL

Invalid 'forgot password' link found

Source: https://getrfpsubs.com/submission/	HTTP Parser: Invalid link: Forgot my password
Source: https://getrfpsubs.com/submission/	HTTP Parser: Invalid link: Forgot my password

Source: https://getrfpsubs.com/submission/	HTTP Parser: No <meta name="author".. found
Source: https://getrfpsubs.com/submission/	HTTP Parser: No <meta name="author".. found

Source: https://getrfpsubs.com/submission/	HTTP Parser: No <meta name="copyright".. found
Source: https://getrfpsubs.com/submission/	HTTP Parser: No <meta name="copyright".. found

Software Vulnerabilities:

Allocates a big amount of memory (probably used for heap spraying)

Source: iexplore.exe

Memory has grown: Private usage: 0MB later: 106MB

Source: unknown

DNS traffic detected: queries for: tenderdocsrfp.typeform.com

Source: font-awesome[1].css.2.dr	String found in binary or memory: http://fontawesome.io
Source: font-awesome[1].css.2.dr	String found in binary or memory: http://fontawesome.io/license
Source: vendors~form.a91c37aea0cc98f30227[1].js.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: vendors~form.a91c37aea0cc98f30227[1].js.2.dr	String found in binary or memory: http://www.jacklmoore.com/autosize
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.s
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_635a63d500a92a0b8497cdc58d0f66b1.svg
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_96f69d0cefd8a8ba623a182c351ccc64.png
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.s
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_grey_5bc252567ef56db648207d9c36a9d004.p
Source: imagestore.dat.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Source: imagestore.dat.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~
Source: imagestore.dat.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~(
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/picker_account_aad_9de70d1c5191d1852a0d5aac28b44
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/picker_account_add_56e73414003cdb676008ff7857343
Source: submission[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/picker_more_7568a43cf440757c55d2e7f51557ae1f.svg
Source: submission[1].htm0.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Source: submission[1].htm0.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: imagestore.dat.2.dr	String found in binary or memory: https://form.typeform.com/favicon.ico
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://form.typeform.com/oembed?url=https%3A%2F%2Fform.typeform.com%2Fto%2FRVzhstxV
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://form.typeform.com/to/RVzhstxV
Source: {EAB6AA29-2FB4-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://form.typeform.com/to/RVzhstxVRoot
Source: {EAB6AA29-2FB4-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://form.typeform.com/to/RVzhstxVl
Source: {EAB6AA29-2FB4-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://getrfpsubs.com
Source: submission[1].htm.2.dr	String found in binary or memory: https://getrfpsubs.com/submission/
Source: ~DF332E8F0BA382E52E.TMP.1.dr	String found in binary or memory: https://getrfpsubs.com/submission/V
Source: {EAB6AA29-2FB4-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://getrfpsubs.comcom/to/RVzhstxVl
Source: renderer.3874ba4ac90514aa7200[1].js.2.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: vendors~form.a91c37aea0cc98f30227[1].js.2.dr	String found in binary or memory: https://github.com/kof/animationFrame
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://images.typeform.com/images/FYUps4mFKPYK/image/default
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://images.typeform.com/images/inKuSYPfhLGZ/background/large
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://images.typeform.com/images/inKuSYPfhLGZ/background/large);background-position:top
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://renderer-assets.typeform.com/
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://renderer-assets.typeform.com/blocks-matrix.a0638b15db7116da2f6d.js
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://renderer-assets.typeform.com/form.4f0b76be4a593ee62771.js
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://renderer-assets.typeform.com/modern-renderer.b5d8910ad502e48055f9.js
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://renderer-assets.typeform.com/phonenumber.37c19ce10e1b02882b22.js
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://renderer-assets.typeform.com/renderer.3874ba4ac90514aa7200.js
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://renderer-assets.typeform.com/vendors~attachment.ce631fd384ee79179761.js
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://renderer-assets.typeform.com/vendors~blocks-ranking.51d997857d845fa77423.js
Source: RVzhstxV[1].htm.2.dr	String found in binary or memory: https://renderer-assets.typeform.com/vendors~form.a91c37aea0cc98f30227.js

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: classification engine

Classification label: mal48.phis.win@3/32@14/9

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFE12BD7E786555811.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4888 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4888 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.224.100.80	unknown	United States	16509	AMAZON-02US	false
54.206.89.250	unknown	United States	16509	AMAZON-02US	false
162.247.242.19	unknown	United States	23467	NEWRELIC-AS-1US	false
13.224.93.102	unknown	United States	16509	AMAZON-02US	false
13.224.93.60	unknown	United States	16509	AMAZON-02US	false
52.33.248.165	unknown	United States	16509	AMAZON-02US	false
152.199.23.37	unknown	United States	15133	EDGECASTUS	false
104.16.18.94	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

Contacted Domains

Name	IP	Active
getrfpsubs.com	54.206.89.250	true
d296je7bbdd650.cloudfront.net	13.224.100.80	true
cs1100.wpc.omegacdn.net	152.199.23.37	true
cdnjs.cloudflare.com	104.16.18.94	true
api.segment.io	52.33.248.165	true
d2citsn5wf4j9j.cloudfront.net	13.224.93.60	true
d2nvsmtq2poimt.cloudfront.net	13.224.93.102	true
bam.nr-data.net	162.247.242.19	true
js-agent.newrelic.com	unknown	unknown
aadcdn.msftauth.net	unknown	unknown
images.typeform.com	unknown	unknown
tenderdocsrfp.typeform.com	unknown	unknown
cdn.segment.com	unknown	unknown
try.typeform.com	unknown	unknown
code.jquery.com	unknown	unknown
renderer-assets.typeform.com	unknown	unknown
form.typeform.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://getrfpsubs.com/submission/	true		unknown
https://form.typeform.com/to/RVzhstxV	false		high

ID:	322824
Product:	CloudBasic
Start time:	22:58:36
Start date:	25.11.2020
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\F8BGPKB1\form.typeform[1].xml	ASCII text, with very long lines, with no line terminators	6E609A3DF230ECB9BEB9CADF789A57FC	B1D8CFBE3068B00D233F3BBD8DFD41DEBD875700	FAB60F303AB835789EC14E902437358E56AEF125822A62165460EB48DEBB57C6
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EAB6AA27-2FB4-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	BE05126D3F66D73A013C2C9CBCC97F4D	CA54C2ED73B2A02EF3837D918EAD0F103F46BBCB	72E2396740CC1557C00598B2682B4768C43CF5D81C12E15337475E488FA05043
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{EAB6AA29-2FB4-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	788B02BD76365BE5744A11C7B6387E73	D562F34E75C6583D1C3F56D33513699197D9E5C7	E0C142061E8F26D3D55BB17CEEE77BC4D02609D88CA9F5EC11D390BA47FE6259
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{EAB6AA2A-2FB4-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	E757012ACB3D2A3107B29096973E0684	25E8D7BCA078B77701BAA195C184E45310A868B5	1F876FF54D8477A2864925FEE7885316CC4A15C17FA1704A1C57269301270143
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat	data	D8C6F22598C903780778000654665956	E278BD96698BAF9178EEED2ADFD7A52706573A22	6AE3031721002D5B1DB6A43DAF7E4C2F7AD985397D1A2C84764891AFFBCD62A8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\analytics.min[1].js	ASCII text, with very long lines	07A8487352DD7DCAF6052A94171E3A70	77CCABB5EDFFA72F9CA5084859A41BDDA79F450A	4A989A4958CD294C1586815026B5972F5E22CA4AB7192B5AB00B0FDFC36E9435
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410[1].svg	SVG Scalable Vector Graphics image	A9CC2824EF3517B6C4160DCF8FF7D410	8DB9AEBAD84CA6E4225BFDD2458FF3821CC4F064	34F9DB946E89F031A80DFCA7B16B2B686469C9886441261AE70A44DA1DFA2D58
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\font-awesome[1].css	troff or preprocessor input, ASCII text, with very long lines	C495654869785BC3DF60216616814AD1	0140952C64E3F2B74EF64E050F2FE86EAB6624C8	36E0A7E08BEE65774168528938072C536437669C1B7458AC77976EC788E4439C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\picker_account_aad_9de70d1c5191d1852a0d5aac28b44a6c[1].svg	SVG Scalable Vector Graphics image	9DE70D1C5191D1852A0D5AAC28B44A6C	F4F64F5CBDBE6D1115C10A7F9CCB8828E6B67CAE	5D3357BD875B7335ACE42E8EE3A64578E4253BED1A4E279109DE403EEDAE3A69
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\vendors~form.a91c37aea0cc98f30227[1].js	data	208F224D5E5175D7B9251ACDE758C070	EBF63D33FD6F768039ACAE3647C06D9C9251B760	ED45D24659835AD636FC074DEB0DDE5FD14CD2D281F0C7BF179A47B1451FC7ED
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\aa6e0ec721[1].gif	GIF image data, version 89a, 1 x 1	BC32ED98D624ACB4008F986349A20D26	2D3DF8C11D2168CE2C27E0937421D11D85016361	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\favicon[1].ico	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel	21FA426135560F2A424680343FAE7E13	CB69BD05400CBA23CDA0BBC8498792D5D35966BE	EBD418438064DDB9CC5AA42C356DE2D76C0F9C27AF97740F0952912272D28108
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\favicon_a_eupayfgghqiai7k9sol6lg2[1].ico	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\jquery-3.1.1.min[1].js	ASCII text, with very long lines	E071ABDA8FE61194711CFC2AB99FE104	F647A6D37DC4CA055CED3CF64BBC1F490070ACBA	85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\nr-1123.min[1].js	ASCII text, with very long lines, with no line terminators	7FFB242072196E9DB5F4F1BFBFA2ED7D	6CFD443F06C2D4E96E14765E045277B67DA0EEC5	94CDF5B7F868883DE0E1248CD80B42DD84E3F38685F2B234747550C02190DC82
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\submission[1].htm	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators	3752C84E2D4118729A264E7629A62E88	22C6C7C155B63E6F566BF554406A5F0780C3F800	94860511EBE34294BA25E9D70248BA9855B1743CF7CB88796605494C130582D5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\2_bc3d32a696895f78c19df6c717586a5d[1].svg	SVG Scalable Vector Graphics image	BC3D32A696895F78C19DF6C717586A5D	9191CB156A30A3ED79C44C0A16C95159E8FF689D	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\53_8b36337037cff88c3df203bb73d58e41[1].png	PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced	8B36337037CFF88C3DF203BB73D58E41	1ADA36FA207B8B96B2A5F55078BFE2A97ACEAD0E	E4E1E65871749D18AEA150643C07E0AAB2057DA057C6C57EC1C3C43580E1C898
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\aa6e0ec721[1].js	ASCII text, with no line terminators	06DD80AEB628C60DC680BC7A4BEE6651	8C86EB7DDFF5E1E5D527BD7A41C9D3F6767E23E0	5E864C2E3F674C60970513411EAEEEAFD2D615D842E65EC01D09CCFCB4A7B38D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\form.4f0b76be4a593ee62771[1].js	ASCII text, with very long lines, with no line terminators	1EE0F825CD7FBE03F5D127497563339B	9518F55710BF0EC4BCE81E6F8F70D99933EB80D0	12824B612AF916B150F542682DC86577DA4F9B0F34F2E75C60BBEE47F64AADA0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\picker_account_add_56e73414003cdb676008ff7857343074[1].svg	SVG Scalable Vector Graphics image	56E73414003CDB676008FF7857343074	9ED7A58CD0E81E9689AC8C6D548A47D0185E0FDC	749F85621D92A5B31B2A377A8C385A36D48A83327DAD9A8A8DA93CD831B8C9A2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\RVzhstxV[1].htm	HTML document, UTF-8 Unicode text, with very long lines	C909ED7A2F5EF94B06B89FC214C7405C	973E913CBA1B734A4A45207AC84A9DF686AD2832	239528724D1F16C164368B486CBE4A0BB59B042E800309E395C05C0EFEA0CDD5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\ellipsis_635a63d500a92a0b8497cdc58d0f66b1[1].svg	SVG Scalable Vector Graphics image	635A63D500A92A0B8497CDC58D0F66B1	A32EBA4B4D139E8DA52C5801A13C1EE222B2B882	61D7CCC5D2C41BF86BE6CEFB0063405067849BA64E9F219F60596EF09A54A942
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c[1].svg	SVG Scalable Vector Graphics image	2B5D393DB04A5E6E1F739CB266E65B4C	6A435DF5CAC3D58CCAD655FE022CCF3DD4B9B721	16C3F6531D0FA5B4D16E82ABF066233B2A9F284C068C663699313C09F5E8D6E6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\large[1].png	PNG image data, 300 x 168, 8-bit/color RGB, non-interlaced	D29608F4E4F3A787108D376CE78708E4	58093F71DA6EBA370859936757E625F66DE00F70	92F8C87A1FE370402BF6623ED40A4F5389AEB4F226F593695F7A8A2E9B11C1A8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd[1].svg	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\picker_more_7568a43cf440757c55d2e7f51557ae1f[1].svg	SVG Scalable Vector Graphics image	7568A43CF440757C55D2E7F51557AE1F	55C22CA98B5CDCED134F6E24205C288845312A2D	B7FCD37EAAFE3F08647ED072D5289EADFFF6C660A26CDEF31532B3FCFB4A0BB2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\renderer.3874ba4ac90514aa7200[1].js	UTF-8 Unicode text, with very long lines	EBA01E9D00A24AF43A6F072C2429A894	2EE4989C5A23E5AC29AEA7E92649373C16893B58	62325823E63ACDA4A0E9DA911F1C10F2662B8AD928EBCC70E5B4581506C824E0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\submission[1].htm	HTML document, ASCII text	EAF60CB3550718475C0FF50217AD0CBE	A52669E34CF6990EA42372BD965F63BD15FA4F62	3E3D3F9F7F8218397F422E5D803AEBA6A6C512B0C6736D1BE1DDE4A4F45A0340
C:\Users\user\AppData\Local\Temp\~DF332E8F0BA382E52E.TMP	data	864C9A2C87FC6E23C8D89E2F79F52F59	BE3D97CACC96C82AA4CE12BEC36FAC1C0FD98AAD	559E1BD98F4760D3427B8FDE4E8561E948A5CAFB6FE0B270C2B00B52C681BD0A
C:\Users\user\AppData\Local\Temp\~DF5181903B4D6B00F5.TMP	data	AB889A32AB9ACD33E816C2422337C69A	1190C6B34DED2D295827C2A88310D10A8B90B59B	4D6EC54B8D244E63B0F04FBE2B97402A3DF722560AD12F218665BA440F4CEFDA
C:\Users\user\AppData\Local\Temp\~DFE12BD7E786555811.TMP	data	CB192CD1FD6C55717BE8E68495D70378	810D458DBB9E1972D7FB522419F065978AC71513	3F8EC4512FF32DE7F43DACB0D4819754867333B7AAD8987C63F880053FE3069C

Analysis Report https://tenderdocsrfp.typeform.com/to/RVzhstxV

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing:

Software Vulnerabilities:

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs