Analysis Report https://mincast.us-south.cf.appdomain.cloud/redirect/?email=prampon@soteb.fr

Overview

General Information

Sample URL: https://mincast.us-south.cf.appdomain.cloud/redirect/?email=prampon@soteb.fr
Analysis ID: 323643

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 68
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Yara detected HtmlPhish_10
Phishing site detected (based on logo template match)
HTML body contains low number of good links
HTML title does not match URL
Suspicious form URL found
URL contains potential PII (phishing indication)

Classification

AV Detection:

barindex
Antivirus / Scanner detection for submitted sample
Source: https://mincast.us-south.cf.appdomain.cloud/redirect/?email=prampon@soteb.fr UrlScan: detection malicious, Label: phishing brand: sharepoint Perma Link
Antivirus detection for URL or domain
Source: https://www.premierpawn.com/rrt/xxtb/sharepoints/sharepoints.php?wa=wsignin1.0&rpsnv=13&ct=1539585327&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d715d44a2-2f11-4282-f625-a066679e96e2&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&email=dXpvaGlmZWFueWlAb3V0bG9vay5jb20=#news SlashNext: Label: Fake Login Page type: Phishing & Social Engineering
Source: https://www.premierpawn.com/rrt/xxtb/sharepoints/sharepoints.php?wa=wsignin1.0&rpsnv=13&ct=1539585327&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d715d44a2-2f11-4282-f625-a066679e96e2&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&email=dXpvaGlmZWFueWlAb3V0bG9vay5jb20=#home SlashNext: Label: Fake Login Page type: Phishing & Social Engineering
Source: https://j123.eu-gb.cf.appdomain.cloud/smain/?op=cHJhbXBvbkBzb3RlYi5mcg==&/yanief4OLVfRFm.php?83_aJjkvU053dh2qESwbhSn93984jjd8pksh_048jdkkd9n488#:h88933aJjkvU053dh2qESwbhSn=aJjkvU053dh2qESwbh39377 UrlScan: Label: phishing brand: sharepoint Perma Link
Source: https://j123.eu-gb.cf.appdomain.cloud/smain/?op=cHJhbXBvbkBzb3RlYi5mcg==&/yanief4OLVfRFm.php?83_aJjk Avira URL Cloud: Label: phishing

Phishing:

barindex
Yara detected HtmlPhish_10
Source: Yara match File source: 609290.pages.csv, type: HTML
Phishing site detected (based on logo template match)
Source: https://j123.eu-gb.cf.appdomain.cloud/smain/?op=cHJhbXBvbkBzb3RlYi5mcg==&/yanief4OLVfRFm.php?83_aJjkvU053dh2qESwbhSn93984jjd8pksh_048jdkkd9n488#:h88933aJjkvU053dh2qESwbhSn=aJjkvU053dh2qESwbh39377 Matcher: Template: sharepoint matched
HTML body contains low number of good links
Source: https://j123.eu-gb.cf.appdomain.cloud/smain/?op=cHJhbXBvbkBzb3RlYi5mcg==&/yanief4OLVfRFm.php?83_aJjkvU053dh2qESwbhSn93984jjd8pksh_048jdkkd9n488#:h88933aJjkvU053dh2qESwbhSn=aJjkvU053dh2qESwbh39377 HTTP Parser: Number of links: 0
Source: https://j123.eu-gb.cf.appdomain.cloud/smain/?op=cHJhbXBvbkBzb3RlYi5mcg==&/yanief4OLVfRFm.php?83_aJjkvU053dh2qESwbhSn93984jjd8pksh_048jdkkd9n488#:h88933aJjkvU053dh2qESwbhSn=aJjkvU053dh2qESwbh39377 HTTP Parser: Number of links: 0
HTML title does not match URL
Source: https://j123.eu-gb.cf.appdomain.cloud/smain/?op=cHJhbXBvbkBzb3RlYi5mcg==&/yanief4OLVfRFm.php?83_aJjkvU053dh2qESwbhSn93984jjd8pksh_048jdkkd9n488#:h88933aJjkvU053dh2qESwbhSn=aJjkvU053dh2qESwbh39377 HTTP Parser: Title: Sign | SharePoint does not match URL
Source: https://j123.eu-gb.cf.appdomain.cloud/smain/?op=cHJhbXBvbkBzb3RlYi5mcg==&/yanief4OLVfRFm.php?83_aJjkvU053dh2qESwbhSn93984jjd8pksh_048jdkkd9n488#:h88933aJjkvU053dh2qESwbhSn=aJjkvU053dh2qESwbh39377 HTTP Parser: Title: Sign | SharePoint does not match URL
Suspicious form URL found
Source: https://j123.eu-gb.cf.appdomain.cloud/smain/?op=cHJhbXBvbkBzb3RlYi5mcg==&/yanief4OLVfRFm.php?83_aJjkvU053dh2qESwbhSn93984jjd8pksh_048jdkkd9n488#:h88933aJjkvU053dh2qESwbhSn=aJjkvU053dh2qESwbh39377 HTTP Parser: Form action: send.php
Source: https://j123.eu-gb.cf.appdomain.cloud/smain/?op=cHJhbXBvbkBzb3RlYi5mcg==&/yanief4OLVfRFm.php?83_aJjkvU053dh2qESwbhSn93984jjd8pksh_048jdkkd9n488#:h88933aJjkvU053dh2qESwbhSn=aJjkvU053dh2qESwbh39377 HTTP Parser: Form action: send.php
URL contains potential PII (phishing indication)
Source: https://mincast.us-south.cf.appdomain.cloud/redirect/?email=prampon@soteb.fr Sample URL: PII: prampon@soteb.fr
Source: https://j123.eu-gb.cf.appdomain.cloud/smain/?op=cHJhbXBvbkBzb3RlYi5mcg==&/yanief4OLVfRFm.php?83_aJjkvU053dh2qESwbhSn93984jjd8pksh_048jdkkd9n488#:h88933aJjkvU053dh2qESwbhSn=aJjkvU053dh2qESwbh39377 HTTP Parser: No <meta name="author".. found
Source: https://j123.eu-gb.cf.appdomain.cloud/smain/?op=cHJhbXBvbkBzb3RlYi5mcg==&/yanief4OLVfRFm.php?83_aJjkvU053dh2qESwbhSn93984jjd8pksh_048jdkkd9n488#:h88933aJjkvU053dh2qESwbhSn=aJjkvU053dh2qESwbh39377 HTTP Parser: No <meta name="author".. found
Source: https://j123.eu-gb.cf.appdomain.cloud/smain/?op=cHJhbXBvbkBzb3RlYi5mcg==&/yanief4OLVfRFm.php?83_aJjkvU053dh2qESwbhSn93984jjd8pksh_048jdkkd9n488#:h88933aJjkvU053dh2qESwbhSn=aJjkvU053dh2qESwbh39377 HTTP Parser: No <meta name="copyright".. found
Source: https://j123.eu-gb.cf.appdomain.cloud/smain/?op=cHJhbXBvbkBzb3RlYi5mcg==&/yanief4OLVfRFm.php?83_aJjkvU053dh2qESwbhSn93984jjd8pksh_048jdkkd9n488#:h88933aJjkvU053dh2qESwbhSn=aJjkvU053dh2qESwbh39377 HTTP Parser: No <meta name="copyright".. found
Source: global traffic HTTP traffic detected: GET /icons/dakirby309/simply-styled/256/Microsoft-SharePoint-2013-icon.png HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: icons.iconarchive.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /icons/dakirby309/simply-styled/256/Microsoft-SharePoint-2013-icon.png HTTP/1.1User-Agent: AutoItHost: icons.iconarchive.comIf-Modified-Since: Sat, 27 Jun 2020 10:27:29 GMTIf-None-Match: "5ef71f11-23c7"Cookie: __cfduid=d7eb16b95148e3cf626e501729a40ba461606466109
Source: gtm[1].js.2.dr String found in binary or memory: "vtp_html":"\n\u003Cscript type=\"text\/gtmscript\"\u003E!function(b,e,f,g,a,c,d){b.fbq||(a=b.fbq=function(){a.callMethod?a.callMethod.apply(a,arguments):a.queue.push(arguments)},b._fbq||(b._fbq=a),a.push=a,a.loaded=!0,a.version=\"2.0\",a.queue=[],c=e.createElement(f),c.async=!0,c.src=g,d=e.getElementsByTagName(f)[0],d.parentNode.insertBefore(c,d))}(window,document,\"script\",\"https:\/\/connect.facebook.net\/en_US\/fbevents.js\");fbq(\"init\",\"1103530543356374\");fbq(\"track\",\"PageView\");\u003C\/script\u003E\n\u003Cnoscript\u003E\n \u003Cimg height=\"1\" width=\"1\" src=\"https:\/\/www.facebook.com\/tr?id=1103530543356374\u0026amp;ev=PageView\n\u0026amp;noscript=1\"\u003E\n\u003C\/noscript\u003E\n", equals www.facebook.com (Facebook)
Source: fbevents[1].js.2.dr String found in binary or memory: (function(a,b,c,d){var e={exports:{}};e.exports;(function(){var f=a.fbq;f.execStart=a.performance&&a.performance.now&&a.performance.now();if(!function(){var b=a.postMessage||function(){};if(!f){b({action:"FB_LOG",logType:"Facebook Pixel Error",logMessage:"Pixel code is not installed correctly on this page"},"*");"error"in console&&console.error("Facebook Pixel Error: Pixel code is not installed correctly on this page");return!1}return!0}())return;f.__fbeventsModules||(f.__fbeventsModules={},f.__fbeventsResolvedModules={},f.getFbeventsModules=function(a){f.__fbeventsResolvedModules[a]||(f.__fbeventsResolvedModules[a]=f.__fbeventsModules[a]());return f.__fbeventsResolvedModules[a]},f.fbIsModuleLoaded=function(a){return!!f.__fbeventsModules[a]},f.ensureModuleRegistered=function(b,a){f.fbIsModuleLoaded(b)||(f.__fbeventsModules[b]=a)});f.ensureModuleRegistered("signalsFBEventsGetIwlUrl",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=f.getFbeventsModules("signalsFBEventsGetTier");e.exports=function(b,c){c=a(c);c=c==null?"www.facebook.com":"www."+c+".facebook.com";return"https://"+c+"/signals/iwl.js?pixel_id="+b}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("signalsFBEventsGetTier",function(){return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEvents.plugins.iwlbootstrapper",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var c=f.getFbeventsModules("SignalsFBEventsIWLBootStrapEvent"),d=f.getFbeventsModules("SignalsFBEventsLogging"),g=f.getFbeventsModules("SignalsFBEventsNetworkConfig"),h=f.getFbeventsModules("SignalsFBEventsPlugin"),i=f.getFbeventsModules("signalsFBEventsGetIwlUrl"),j=f.getFbeventsModules("signalsFBEventsGetTier"),k=d.logUserError,l=/^https:\/\/.*\.facebook\.com$/i,m="FACEBOOK_IWL_CONFIG_STORAGE_KEY",n=a.sessionStorage?a.sessionStorage:{getItem:function(a){return null},removeItem:function(a){},setItem:function(a,b){}};e.exports=new h(function(d,e){function h(c,d){var e=b.createElement("script");e.async=!0;e.onload=function(){if(!a.FacebookIWL||!a.FacebookIWL.init)return;var b=j(g.ENDPOINT);b!=null&&a.FacebookIWL.set&&a.FacebookIWL.set("tier",b);d()};a.FacebookIWLSessionEnd=function(){n.removeItem(m),a.close()};e.src=i(c,g.ENDPOINT);b.body&&b.body.appendChild(e)}var o=!1,p=function(a){return!!(e&&e.pixelsByID&&Object.prototype.hasOwnProperty.call(e.pixelsByID,a))};function q(){if(o)return;var b=n.getItem(m);if(!b)return;b=JSON.parse(b);var c=b.pixelID,d=b.graphToken,e=b.sessionStartTime;o=!0;h(c,function(){var b=p(c)?c:null;a.FacebookIWL.init(b,d,e)})}function r(b){if(o)return;h(b,func
Source: unknown DNS traffic detected: queries for: mincast.us-south.cf.appdomain.cloud
Source: fontawesome-webfont[1].eot.2.dr, font-awesome.min[1].css.2.dr String found in binary or memory: http://fontawesome.io
Source: font-awesome.min[1].css.2.dr String found in binary or memory: http://fontawesome.io/license
Source: fontawesome-webfont[1].eot.2.dr String found in binary or memory: http://fontawesome.io/license/
Source: fontawesome-webfont[1].eot.2.dr String found in binary or memory: http://fontawesome.iohttp://fontawesome.iohttp://fontawesome.io/license/http://fontawesome.io/licens
Source: bootstrap.min[1].js.2.dr String found in binary or memory: http://getbootstrap.com)
Source: imagestore.dat.2.dr String found in binary or memory: http://icons.iconarchive.com/icons/dakirby309/simply-styled/256/Microsoft-SharePoint-2013-icon.png
Source: jquery-ui.min[1].js.2.dr String found in binary or memory: http://jqueryui.com
Source: jquery-ui[1].css.2.dr String found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1
Source: popper.js[1].js.2.dr String found in binary or memory: http://opensource.org/licenses/MIT).
Source: scripts[1].js.2.dr String found in binary or memory: http://stackoverflow.com/a/2866613
Source: style[1].css0.2.dr String found in binary or memory: http://stackoverflow.com/questions/10387740/five-equal-columns-in-twitter-bootstrap/22799354#2279935
Source: scripts[1].js.2.dr String found in binary or memory: http://stackoverflow.com/questions/411352/how-best-to-determine-if-an-argument-is-not-sent-to-the-ja
Source: KFOlCnqEu92Fr1MmYUtfBBc9[1].ttf.2.dr, KFOmCnqEu92Fr1Mu4mxP[1].ttf.2.dr, KFOlCnqEu92Fr1MmEU9fBBc9[1].ttf.2.dr String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: style[1].css.2.dr String found in binary or memory: http://www.gnu.org/licenses/gpl-2.0.html
Source: magiczoom[1].js.2.dr String found in binary or memory: http://www.magictoolbox.com/license/
Source: style[1].css.2.dr String found in binary or memory: http://www.navigatormm.com
Source: style[1].css.2.dr String found in binary or memory: http://www.navigatormm.com/chimera
Source: gtm[1].js.2.dr String found in binary or memory: https://adservice.google.com/ddm/regclk
Source: analytics[1].js.2.dr String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: scripts[1].js0.2.dr String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/CustomEvent/CustomEvent
Source: recaptcha__en[1].js.2.dr String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: recaptcha__en[1].js.2.dr String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: recaptcha__en[1].js.2.dr String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: css[1].css.2.dr String found in binary or memory: https://fonts.gstatic.com/s/ubuntu/v15/4iCv6KVjbNBYlgoCjC3jsGyL.woff)
Source: bootstrap_002.js[1].js.2.dr String found in binary or memory: https://getbootstrap.com)
Source: bootstrap.js[1].js.2.dr String found in binary or memory: https://getbootstrap.com/)
Source: gtm[1].js.2.dr String found in binary or memory: https://github.com/krux/postscribe/blob/master/LICENSE.
Source: bootstrap_002.js[1].js.2.dr, bootstrap.min[1].css.2.dr String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: bootstrap_002.js[1].js.2.dr String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: {E1A2634F-30D6-11EB-90E4-ECF4BB862DED}.dat.1.dr String found in binary or memory: https://j123.eu-gb.Root
Source: {E1A2634F-30D6-11EB-90E4-ECF4BB862DED}.dat.1.dr String found in binary or memory: https://j123.eu-gb.cf.appdomain.cloud/smain/?op=cHJhbXBvbkBzb3RlYi5mcg==&/yanief4OLVfRFm.php?83_aJjk
Source: gtm[1].js.2.dr String found in binary or memory: https://pagead2.googlesyndication.com
Source: recaptcha__en[1].js.2.dr String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: analytics[1].js.2.dr String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: recaptcha__en[1].js.2.dr String found in binary or memory: https://support.google.com/recaptcha
Source: recaptcha__en[1].js.2.dr String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: recaptcha__en[1].js.2.dr String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: recaptcha__en[1].js.2.dr String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: analytics[1].js.2.dr String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: analytics[1].js.2.dr String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: gtm[1].js.2.dr String found in binary or memory: https://www.google.com
Source: recaptcha__en[1].js.2.dr String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: recaptcha__en[1].js.2.dr, anchor[1].htm.2.dr, api[1].js.2.dr String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: ~DFF335FDC517C7DD21.TMP.1.dr String found in binary or memory: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfWmtcUAAAAAOJYBUg1otF0emmfkBJXOL8F-Tsa&co=aHR0
Source: gtm[1].js.2.dr String found in binary or memory: https://www.googletagmanager.com/debug/bootstrap
Source: analytics[1].js.2.dr String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: webworker[1].js.2.dr, anchor[1].htm.2.dr, api[1].js.2.dr String found in binary or memory: https://www.gstatic.com/recaptcha/releases/UFwvoDBMjc8LiYc1DKXiAomK/recaptcha__en.js
Source: anchor[1].htm.2.dr String found in binary or memory: https://www.gstatic.com/recaptcha/releases/UFwvoDBMjc8LiYc1DKXiAomK/styles__ltr.css
Source: {E1A2634F-30D6-11EB-90E4-ECF4BB862DED}.dat.1.dr String found in binary or memory: https://www.premierpawappdomain.cloud/smain/?op=cHJhbXBvbkBzb3RlYi5mcg==&/yanief4OLVfRFm.php?83_aJjk
Source: {E1A2634F-30D6-11EB-90E4-ECF4BB862DED}.dat.1.dr String found in binary or memory: https://www.premierpawn.com/rrt/xxtb/sharepoints/sharepoints.php?wa=wsignin1.0&rpRoot
Source: ~DFF335FDC517C7DD21.TMP.1.dr String found in binary or memory: https://www.premierpawn.com/rrt/xxtb/sharepoints/sharepoints.php?wa=wsignin1.0&rpsnv=13&ct=153958532
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: classification engine Classification label: mal68.phis.win@3/60@8/6
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DFE3365AA569982C87.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3096 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3096 CREDAT:17410 /prefetch:2 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 323643 URL: https://mincast.us-south.cf... Startdate: 27/11/2020 Architecture: WINDOWS Score: 68 12 icons.iconarchive.com 2->12 20 Antivirus detection for URL or domain 2->20 22 Antivirus / Scanner detection for submitted sample 2->22 24 Yara detected HtmlPhish_10 2->24 26 Phishing site detected (based on logo template match) 2->26 7 iexplore.exe 2 62 2->7         started        signatures3 process4 process5 9 iexplore.exe 6 90 7->9         started        dnsIp6 14 j123.eu-gb.cf.appdomain.cloud 158.175.115.200, 443, 49711, 49712 SOFTLAYERUS United States 9->14 16 mincast.us-south.cf.appdomain.cloud 169.46.89.154, 443, 49709, 49710 SOFTLAYERUS United States 9->16 18 8 other IPs or domains 9->18
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
31.13.92.14
 unknown Ireland
32934 FACEBOOKUS false
149.56.20.211
 unknown Canada
16276 OVHFR false
169.46.89.154
 unknown United States
36351 SOFTLAYERUS false
74.125.128.155
 unknown United States
15169 GOOGLEUS false
172.67.212.166
 unknown United States
13335 CLOUDFLARENETUS false
158.175.115.200
 unknown United States
36351 SOFTLAYERUS false

Contacted Domains

Name IP Active
scontent.xx.fbcdn.net 31.13.92.14 true
icons.iconarchive.com 172.67.212.166 true
stats.l.doubleclick.net 74.125.128.155 true
j123.eu-gb.cf.appdomain.cloud 158.175.115.200 true
www.google.co.uk 216.58.215.227 true
premierpawn.com 149.56.20.211 true
mincast.us-south.cf.appdomain.cloud 169.46.89.154 true
www.premierpawn.com unknown unknown
connect.facebook.net unknown unknown
stats.g.doubleclick.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://j123.eu-gb.cf.appdomain.cloud/smain/?op=cHJhbXBvbkBzb3RlYi5mcg==&/yanief4OLVfRFm.php?83_aJjkvU053dh2qESwbhSn93984jjd8pksh_048jdkkd9n488#:h88933aJjkvU053dh2qESwbhSn=aJjkvU053dh2qESwbh39377 true unknown
http://icons.iconarchive.com/icons/dakirby309/simply-styled/256/Microsoft-SharePoint-2013-icon.png false
    		high