Analysis Report http://213.217.0.184

Overview

General Information

Sample URL: http://213.217.0.184
Analysis ID: 324356

Most interesting Screenshot:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file

Classification

AV Detection:

barindex
Multi AV Scanner detection for domain / URL
Source: http://213.217.0.184/ Virustotal: Detection: 8% Perma Link
Multi AV Scanner detection for submitted file
Source: http://213.217.0.184 Virustotal: Detection: 8% Perma Link
Source: unknown TCP traffic detected without corresponding DNS query: 213.217.0.184
Source: unknown TCP traffic detected without corresponding DNS query: 213.217.0.184
Source: unknown TCP traffic detected without corresponding DNS query: 213.217.0.184
Source: unknown TCP traffic detected without corresponding DNS query: 213.217.0.184
Source: unknown TCP traffic detected without corresponding DNS query: 213.217.0.184
Source: unknown TCP traffic detected without corresponding DNS query: 213.217.0.184
Source: unknown TCP traffic detected without corresponding DNS query: 213.217.0.184
Source: unknown TCP traffic detected without corresponding DNS query: 213.217.0.184
Source: unknown TCP traffic detected without corresponding DNS query: 213.217.0.184
Source: unknown TCP traffic detected without corresponding DNS query: 213.217.0.184
Source: unknown TCP traffic detected without corresponding DNS query: 213.217.0.184
Source: unknown TCP traffic detected without corresponding DNS query: 213.217.0.184
Source: unknown TCP traffic detected without corresponding DNS query: 213.217.0.184
Source: unknown TCP traffic detected without corresponding DNS query: 213.217.0.184
Source: unknown TCP traffic detected without corresponding DNS query: 213.217.0.184
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: 213.217.0.184Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 213.217.0.184Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1User-Agent: AutoItHost: 213.217.0.184
Source: msapplication.xml0.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xe6745b85,0x01d6c6a5</date><accdate>0xe6745b85,0x01d6c6a5</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xe6745b85,0x01d6c6a5</date><accdate>0xe6745b85,0x01d6c6a5</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xe676bdfc,0x01d6c6a5</date><accdate>0xe676bdfc,0x01d6c6a5</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xe676bdfc,0x01d6c6a5</date><accdate>0xe676bdfc,0x01d6c6a5</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xe6792040,0x01d6c6a5</date><accdate>0xe6792040,0x01d6c6a5</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xe6792040,0x01d6c6a5</date><accdate>0xe6792040,0x01d6c6a5</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Nov 2020 14:17:39 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 275Keep-Alive: timeout=5, max=99Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 32 31 33 2e 32 31 37 2e 30 2e 31 38 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 213.217.0.184 Port 80</address></body></html>
Source: ~DF5116F9D0FFB55263.TMP.1.dr String found in binary or memory: http://213.217.0.184/
Source: {113904BF-3299-11EB-90E4-ECF4BB862DED}.dat.1.dr String found in binary or memory: http://213.217.0.184/Root
Source: msapplication.xml.1.dr String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.1.dr String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.1.dr String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.1.dr String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.1.dr String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.1.dr String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.1.dr String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.1.dr String found in binary or memory: http://www.youtube.com/
Source: classification engine Classification label: mal56.win@3/16@0/1
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DF6BB103AE132F7921.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:852 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:852 CREDAT:17410 /prefetch:2 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 324356 URL: http://213.217.0.184 Startdate: 29/11/2020 Architecture: WINDOWS Score: 56 13 Multi AV Scanner detection for domain / URL 2->13 15 Multi AV Scanner detection for submitted file 2->15 6 iexplore.exe 2 84 2->6         started        process3 process4 8 iexplore.exe 2 31 6->8         started        dnsIp5 11 213.217.0.184, 49724, 49725, 49726 SELECTEL-MSKRU Russian Federation 8->11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
213.217.0.184
 unknown Russian Federation
50340 SELECTEL-MSKRU false

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://213.217.0.184/favicon.ico true
  • Avira URL Cloud: safe
 unknown
http://213.217.0.184/ true unknown
http://213.217.0.184/ true unknown