Analysis Report http://unbouncepages.com/4659853439303724383934337fl/

Overview

General Information

Sample URL: http://unbouncepages.com/4659853439303724383934337fl/
Analysis ID: 339302

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected HtmlPhish_30

Classification

AV Detection:

barindex
Antivirus / Scanner detection for submitted sample
Source: http://unbouncepages.com/4659853439303724383934337fl/ SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social usering

Phishing:

barindex
Yara detected HtmlPhish_30
Source: Yara match File source: 585948.pages.csv, type: HTML
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\4659853439303724383934337fl[1].htm, type: DROPPED
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 13.225.80.63:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.225.80.63:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: global traffic HTTP traffic detected: GET /4659853439303724383934337fl/ HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: unbouncepages.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /published-js/main.bundle-5c6e41c.z.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: http://unbouncepages.com/4659853439303724383934337fl/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: builder-assets.unbounce.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /published-css/main-7b78720.z.css HTTP/1.1Accept: text/css, */*Referer: http://unbouncepages.com/4659853439303724383934337fl/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: builder-assets.unbounce.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /unbouncepages.com/4659853439303724383934337fl/e8fc0c77-micro_107z040000000000000028.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: http://unbouncepages.com/4659853439303724383934337fl/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: d9hhrg4mnvzow.cloudfront.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: unbouncepages.comConnection: Keep-AliveCookie: ubvs=84.17.52.741614371565357000; ubvt=84.17.52.741614371565357000
Source: global traffic HTTP traffic detected: GET /i?stm=1610599073847&e=pv&url=http%3A%2F%2Funbouncepages.com%2F4659853439303724383934337fl%2F&tv=js-2.14.0&tna=sp-ub&aid=landing_page&p=web&tz=America%2FLos_Angeles&lang=en-US&cs=utf-8&f_pdf=0&f_qt=0&f_realp=0&f_wma=0&f_dir=0&f_fla=1&f_java=1&f_gears=0&f_ag=0&res=1280x1024&cd=24&cookie=1&eid=2a64a8a9-e27f-48c4-a48a-7a2ffc5351b0&dtm=1610599073842&vp=784x554&ds=890x622&vid=1&sid=28f3e9e7-e98b-42c9-b3d2-0538bae3dee1&duid=2b34fd73-4516-40da-a1ed-d8d4fe0d734c&uid=84.17.52.741614371565357000&cx=eyJzY2hlbWEiOiJpZ2x1OmNvbS5zbm93cGxvd2FuYWx5dGljcy5zbm93cGxvdy9jb250ZXh0cy9qc29uc2NoZW1hLzEtMC0wIiwiZGF0YSI6W3sic2NoZW1hIjoianNfdHJhY2tlcl9jb250ZXh0X3YxLjEuanNvbiIsImRhdGEiOnsicGFnZUlkIjoiZWNiZDlkZGItNjBjNC00MmRhLThjMWItN2Q5NTVhMWM4Mjk1IiwidmFyaWFudElkIjoiYSIsImV2ZW50VHlwZSI6InZpc2l0IiwiZXZlbnRNZXRhZGF0YSI6W10sInJvdXRpbmdTdHJhdGVneSI6IndlaWdodGVkIn19XX0 HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: http://unbouncepages.com/4659853439303724383934337fl/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: events.ub-analytics.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /4659853439303724383934337fl/favicon.ico HTTP/1.1User-Agent: AutoItHost: unbouncepages.comCookie: ubpv=a%2Cecbd9ddb-60c4-42da-8c1b-7d955a1c8295; ubvt=84.17.52.741614371565357000; ubvs=84.17.52.741614371565357000
Source: global traffic HTTP traffic detected: GET /4659853439303724383934337fl/clkn/https/artsana.limpcome.ml/email@thisisforu.com HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: unbouncepages.comConnection: Keep-AliveCookie: ubpv=a%2Cecbd9ddb-60c4-42da-8c1b-7d955a1c8295; ubrs=weighted; ubvs=84.17.52.741614371565357000; ubvt=84.17.52.741614371565357000
Source: unknown DNS traffic detected: queries for: unbouncepages.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Founddate: Wed, 13 Jan 2021 19:37:54 GMTcontent-type: text/plain; charset=ISO-8859-1transfer-encoding: chunkedp3p: CP="This is not a privacy policy."content-encoding: gzipx-proxy-backend: page-serverconnection: closeData Raw: 34 39 0d 0a 1f 8b 08 00 00 00 00 00 00 00 0a c9 48 55 28 4a 2d 2c 4d 2d 2e 49 4d 51 08 0d f2 51 28 4f 2c 56 c8 cb 2f 51 48 cb 2f cd 4b 51 c8 cf 53 28 c9 c8 2c 56 28 4e 2d 2a 4b 2d d2 03 00 00 00 ff ff 03 00 d6 82 03 c0 2f 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 49HU(J-,M-.IMQQ(O,V/QH/KQS(,V(N-*K-/0
Source: {425D55D0-5622-11EB-90E5-ECF4BB2D2496}.dat.1.dr String found in binary or memory: http://unbouncepages.c
Source: 4659853439303724383934337fl[1].htm.2.dr String found in binary or memory: http://unbouncepages.com/4659853439303724383934337fl/
Source: {425D55D0-5622-11EB-90E5-ECF4BB2D2496}.dat.1.dr String found in binary or memory: http://unbouncepages.com/4659853439303724383934337fl/Root
Source: ~DF5B31512BA0419CB8.TMP.1.dr String found in binary or memory: http://unbouncepages.com/4659853439303724383934337fl/clkn/https/artsana.limpcome.ml/email
Source: ~DF5B31512BA0419CB8.TMP.1.dr String found in binary or memory: http://unbouncepages.com/4659853439303724383934337fl/jhttp://unbouncepages.com/465985343930372438393
Source: {425D55D0-5622-11EB-90E5-ECF4BB2D2496}.dat.1.dr String found in binary or memory: http://unbouncepages.com/465985343930372438393433Root
Source: {425D55D0-5622-11EB-90E5-ECF4BB2D2496}.dat.1.dr String found in binary or memory: http://unbouncepages.com/465985343930372438393433om/4659853439303724383934337fl/Root
Source: {425D55D0-5622-11EB-90E5-ECF4BB2D2496}.dat.1.dr String found in binary or memory: http://unbouncepages.com/465985343930372438393433om/4659853439303724383934337fl/c7fl/jhttp://unbounc
Source: ub[1].js.2.dr String found in binary or memory: https://d34qb8suadcc4g.cloudfront.net/sp-2.14.0.js
Source: 4659853439303724383934337fl[1].htm.2.dr String found in binary or memory: https://d34qb8suadcc4g.cloudfront.net/ub.js?1605293159
Source: sp-2.14.0[1].js.2.dr String found in binary or memory: https://github.com/snowplow/snowplow/wiki/javascript-tracker
Source: sp-2.14.0[1].js.2.dr String found in binary or memory: https://github.com/snowplow/snowplow/wiki/javascript-tracker-setup
Source: main.bundle-5c6e41c.z[1].js.2.dr String found in binary or memory: https://vimeo.com/api/oembed.json?url=
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown HTTPS traffic detected: 13.225.80.63:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.225.80.63:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: classification engine Classification label: mal56.phis.win@3/22@6/5
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{425D55CE-5622-11EB-90E5-ECF4BB2D2496}.dat Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DFA03ECB28CFFA1FC9.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5612 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5612 CREDAT:17410 /prefetch:2 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 339302 URL: http://unbouncepages.com/46... Startdate: 13/01/2021 Architecture: WINDOWS Score: 56 15 unbouncepages.com 2->15 23 Antivirus / Scanner detection for submitted sample 2->23 25 Yara detected HtmlPhish_30 2->25 7 iexplore.exe 1 51 2->7         started        signatures3 process4 process5 9 iexplore.exe 5 52 7->9         started        dnsIp6 17 events.ub-analytics.com 3.212.31.157, 49734, 49735, 80 AMAZON-AESUS United States 9->17 19 d2io4fc03gd4tk.cloudfront.net 13.224.194.26, 49728, 49729, 80 AMAZON-02US United States 9->19 21 4 other IPs or domains 9->21 13 C:\...\4659853439303724383934337fl[1].htm, HTML 9->13 dropped file7
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.225.80.63
 unknown United States
16509 AMAZON-02US false
13.225.84.146
 unknown United States
16509 AMAZON-02US false
13.224.194.26
 unknown United States
16509 AMAZON-02US false
54.93.101.66
 unknown United States
16509 AMAZON-02US false
3.212.31.157
 unknown United States
14618 AMAZON-AESUS false

Contacted Domains

Name IP Active
d34qb8suadcc4g.cloudfront.net 13.225.80.63 true
unbouncepages.com 54.93.101.66 true
events.ub-analytics.com 3.212.31.157 true
d9hhrg4mnvzow.cloudfront.net 13.225.84.146 true
d2io4fc03gd4tk.cloudfront.net 13.224.194.26 true
builder-assets.unbounce.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://builder-assets.unbounce.com/published-js/main.bundle-5c6e41c.z.js false
    		high
    http://d9hhrg4mnvzow.cloudfront.net/unbouncepages.com/4659853439303724383934337fl/e8fc0c77-micro_107z040000000000000028.png false
      		high
      http://unbouncepages.com/4659853439303724383934337fl/clkn/https/artsana.limpcome.ml/email@thisisforu.com false
        		high
        http://events.ub-analytics.com/i?stm=1610599073847&e=pv&url=http%3A%2F%2Funbouncepages.com%2F4659853439303724383934337fl%2F&tv=js-2.14.0&tna=sp-ub&aid=landing_page&p=web&tz=America%2FLos_Angeles&lang=en-US&cs=utf-8&f_pdf=0&f_qt=0&f_realp=0&f_wma=0&f_dir=0&f_fla=1&f_java=1&f_gears=0&f_ag=0&res=1280x1024&cd=24&cookie=1&eid=2a64a8a9-e27f-48c4-a48a-7a2ffc5351b0&dtm=1610599073842&vp=784x554&ds=890x622&vid=1&sid=28f3e9e7-e98b-42c9-b3d2-0538bae3dee1&duid=2b34fd73-4516-40da-a1ed-d8d4fe0d734c&uid=84.17.52.741614371565357000&cx=eyJzY2hlbWEiOiJpZ2x1OmNvbS5zbm93cGxvd2FuYWx5dGljcy5zbm93cGxvdy9jb250ZXh0cy9qc29uc2NoZW1hLzEtMC0wIiwiZGF0YSI6W3sic2NoZW1hIjoianNfdHJhY2tlcl9jb250ZXh0X3YxLjEuanNvbiIsImRhdGEiOnsicGFnZUlkIjoiZWNiZDlkZGItNjBjNC00MmRhLThjMWItN2Q5NTVhMWM4Mjk1IiwidmFyaWFudElkIjoiYSIsImV2ZW50VHlwZSI6InZpc2l0IiwiZXZlbnRNZXRhZGF0YSI6W10sInJvdXRpbmdTdHJhdGVneSI6IndlaWdodGVkIn19XX0 false
        • Avira URL Cloud: safe
        		 unknown
        http://unbouncepages.com/4659853439303724383934337fl/clkn/https/artsana.limpcome.ml/email@thisisforu.com false
          		high
          http://unbouncepages.com/4659853439303724383934337fl/ false
            		high
            http://unbouncepages.com/4659853439303724383934337fl/ false
              		high
              http://unbouncepages.com/favicon.ico false
                		high
                http://builder-assets.unbounce.com/published-css/main-7b78720.z.css false
                  		high
                  http://unbouncepages.com/4659853439303724383934337fl/favicon.ico false
                    		high