Analysis Report http://coronavirus.app

Overview

General Information

Sample URL: http://coronavirus.app
Analysis ID: 341582

Most interesting Screenshot:

Detection

Score: 0
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

No high impact signatures.

Classification

There are no high impact signatures.

Compliance:

barindex
Uses new MSVCR Dlls
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Uses secure TLS version for HTTPS connections
Source: unknown HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.5:49693 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.126.175:443 -> 192.168.2.5:49701 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.126.175:443 -> 192.168.2.5:49700 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.5:49698 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.5:49696 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.5:49699 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.5:49697 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 173.194.76.157:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 173.194.76.157:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: coronavirus.appConnection: Keep-Alive
Source: msapplication.xml0.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xabbc9533,0x01d6eeb6</date><accdate>0xabbc9533,0x01d6eeb6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xabbc9533,0x01d6eeb6</date><accdate>0xabbc9533,0x01d6eeb6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xabc159e6,0x01d6eeb6</date><accdate>0xabc159e6,0x01d6eeb6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xabc159e6,0x01d6eeb6</date><accdate>0xabc159e6,0x01d6eeb6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xabc159e6,0x01d6eeb6</date><accdate>0xabc159e6,0x01d6eeb6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xabc159e6,0x01d6eeb6</date><accdate>0xabc159e6,0x01d6eeb6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: unknown DNS traffic detected: queries for: coronavirus.app
Source: shp[1].js0.2.dr String found in binary or memory: http://article.gmane.org/gmane.comp.gis.proj-4.devel/6039
Source: charts[1].js.2.dr String found in binary or memory: http://chartjs.org/
Source: shp[1].js0.2.dr String found in binary or memory: http://feross.org
Source: shp[1].js0.2.dr String found in binary or memory: http://fits.gsfc.nasa.gov/fitsbits/saf.93/saf.9302
Source: font-awesome.min[1].css.2.dr String found in binary or memory: http://fontawesome.io
Source: font-awesome.min[1].css.2.dr String found in binary or memory: http://fontawesome.io/license
Source: shp[1].js0.2.dr String found in binary or memory: http://jsperf.com/arraybuffer-to-string-apply-performance/2
Source: shp[1].js0.2.dr String found in binary or memory: http://jsperf.com/converting-a-uint8array-to-a-string/2
Source: leaflet[1].js.2.dr String found in binary or memory: http://leafletjs.com
Source: shp[1].js0.2.dr String found in binary or memory: http://mathworld.wolfram.com/GnomonicProjection.html
Source: shp[1].js0.2.dr String found in binary or memory: http://seclists.org/fulldisclosure/2009/Sep/394
Source: shp[1].js0.2.dr String found in binary or memory: http://stackoverflow.com/a/22747272/680742
Source: shp[1].js0.2.dr String found in binary or memory: http://stuk.github.io/jszip/documentation/howto/read_zip.html
Source: shp[1].js0.2.dr String found in binary or memory: http://unix.stackexchange.com/questions/14705/the-zip-formats-external-file-attribute
Source: msapplication.xml.1.dr String found in binary or memory: http://www.amazon.com/
Source: shp[1].js0.2.dr String found in binary or memory: http://www.delorie.com/djgpp/doc/rbinter/it/52/13.html
Source: shp[1].js0.2.dr String found in binary or memory: http://www.delorie.com/djgpp/doc/rbinter/it/65/16.html
Source: shp[1].js0.2.dr String found in binary or memory: http://www.delorie.com/djgpp/doc/rbinter/it/66/16.html
Source: shp[1].js0.2.dr String found in binary or memory: http://www.ecma-international.org/publications/files/ECMA-ST/ECMA-262.pdf
Source: msapplication.xml1.1.dr String found in binary or memory: http://www.google.com/
Source: shp[1].js0.2.dr String found in binary or memory: http://www.info-zip.org/FAQ.html#backslashes
Source: shp[1].js0.2.dr String found in binary or memory: http://www.linz.govt.nz/docs/miscellaneous/nz-map-definition.pdf
Source: shp[1].js0.2.dr String found in binary or memory: http://www.linz.govt.nz/docs/miscellaneous/nzmg.pdf
Source: msapplication.xml2.1.dr String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.1.dr String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.1.dr String found in binary or memory: http://www.reddit.com/
Source: shp[1].js0.2.dr String found in binary or memory: http://www.swisstopo.admin.ch/internet/swisstopo/fr/home/topics/survey/sys/refsys/switzerland.parsys
Source: msapplication.xml5.1.dr String found in binary or memory: http://www.twitter.com/
Source: shp[1].js0.2.dr String found in binary or memory: http://www.webtoolkit.info/
Source: msapplication.xml6.1.dr String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.1.dr String found in binary or memory: http://www.youtube.com/
Source: shp[1].js0.2.dr String found in binary or memory: http://zlib.net/manual.html#Advanced
Source: shp[1].js0.2.dr String found in binary or memory: http://zlib.net/manual.html#Advanced)
Source: js[1].js.2.dr String found in binary or memory: https://ade.googlesyndication.com/ddm/activity
Source: js[1].js.2.dr String found in binary or memory: https://adservice.google.com/ddm/regclk
Source: analytics[1].js.2.dr String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: shp[1].js0.2.dr String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=695438.
Source: leaflet[1].css.2.dr String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=888319
Source: 0PV1MQT6.htm.2.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Source: shp[1].js0.2.dr String found in binary or memory: https://codereview.chromium.org/121173009/
Source: 0PV1MQT6.htm.2.dr String found in binary or memory: https://coronavirus-92ebd.web.app/assets/css/feather/feather.css
Source: 0PV1MQT6.htm.2.dr String found in binary or memory: https://coronavirus-92ebd.web.app/assets/css/styles.css?v=258
Source: 0PV1MQT6.htm.2.dr String found in binary or memory: https://coronavirus-92ebd.web.app/assets/img/logo/16.png
Source: imagestore.dat.2.dr, 0PV1MQT6.htm.2.dr String found in binary or memory: https://coronavirus-92ebd.web.app/assets/img/logo/192.png
Source: 0PV1MQT6.htm.2.dr String found in binary or memory: https://coronavirus-92ebd.web.app/assets/img/logo/32.png
Source: 0PV1MQT6.htm.2.dr String found in binary or memory: https://coronavirus-92ebd.web.app/assets/img/logo/96.png
Source: 0PV1MQT6.htm.2.dr String found in binary or memory: https://coronavirus-92ebd.web.app/assets/img/logo/browserconfig.xml
Source: 0PV1MQT6.htm.2.dr String found in binary or memory: https://coronavirus-92ebd.web.app/assets/img/logo/favicon.ico
Source: 0PV1MQT6.htm.2.dr String found in binary or memory: https://coronavirus-92ebd.web.app/assets/img/logo/safari-pinned-tab.svg
Source: 0PV1MQT6.htm.2.dr String found in binary or memory: https://coronavirus-92ebd.web.app/assets/img/logo/social.jpg?v=1
Source: 0PV1MQT6.htm.2.dr String found in binary or memory: https://coronavirus-92ebd.web.app/assets/js/app.js?v=258
Source: 0PV1MQT6.htm.2.dr String found in binary or memory: https://coronavirus-92ebd.web.app/assets/js/charts.js
Source: 0PV1MQT6.htm.2.dr String found in binary or memory: https://coronavirus-92ebd.web.app/assets/js/moment.min.js
Source: 0PV1MQT6.htm.2.dr String found in binary or memory: https://coronavirus.app
Source: ~DF10C5A24FAA9BD71B.TMP.1.dr String found in binary or memory: https://coronavirus.app/
Source: {D510EB75-5AA9-11EB-90E5-ECF4BB570DC9}.dat.1.dr String found in binary or memory: https://coronavirus.app/Root
Source: shp[1].js0.2.dr String found in binary or memory: https://developer.mozilla.org/en-US/docs/JavaScript/Reference/Operators/Bitwise_Operators
Source: shp[1].js0.2.dr String found in binary or memory: https://encoding.spec.whatwg.org/
Source: shp[1].js0.2.dr String found in binary or memory: https://encoding.spec.whatwg.org/encodings.json
Source: 0PV1MQT6.htm.2.dr String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:300
Source: css[1].css.2.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc-.woff)
Source: css[1].css.2.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc-.woff)
Source: css[1].css.2.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc-.woff)
Source: css[1].css.2.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxM.woff)
Source: shp[1].js0.2.dr String found in binary or memory: https://github.com/OSGeo/proj.4/blob/master/src/PJ_qsc.c
Source: shp[1].js0.2.dr String found in binary or memory: https://github.com/OSGeo/proj.4/blob/master/src/PJ_robin.c
Source: shp[1].js0.2.dr String found in binary or memory: https://github.com/beatgammit/base64-js/issues/42
Source: charts[1].js.2.dr String found in binary or memory: https://github.com/chartjs/Chart.js/blob/master/LICENSE.md
Source: shp[1].js0.2.dr String found in binary or memory: https://github.com/feross/buffer/pull/97
Source: shp[1].js0.2.dr String found in binary or memory: https://github.com/google/closure-compiler/issues/247
Source: js[1].js.2.dr String found in binary or memory: https://github.com/krux/postscribe/blob/master/LICENSE.
Source: shp[1].js0.2.dr String found in binary or memory: https://github.com/mbloch/mapshaper-proj/blob/master/src/projections/etmerc.js
Source: shp[1].js0.2.dr String found in binary or memory: https://github.com/mbloch/mapshaper-proj/blob/master/src/projections/tmerc.js
Source: shp[1].js0.2.dr String found in binary or memory: https://github.com/nodeca/pako/
Source: shp[1].js0.2.dr String found in binary or memory: https://heycam.github.io/webidl/#dfn-obtain-unicode
Source: js[1].js.2.dr String found in binary or memory: https://pagead2.googlesyndication.com
Source: js[1].js.2.dr String found in binary or memory: https://pagead2.googlesyndication.com/
Source: 0PV1MQT6.htm.2.dr String found in binary or memory: https://progressier.com/client/script.js?id=VAP1dMEmm5ag8v6vNcVy
Source: analytics[1].js.2.dr String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: 0PV1MQT6.htm.2.dr String found in binary or memory: https://unpkg.com/leaflet
Source: 0PV1MQT6.htm.2.dr String found in binary or memory: https://unpkg.com/shpjs
Source: js[1].js.2.dr String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: analytics[1].js.2.dr String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: analytics[1].js.2.dr String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: js[1].js.2.dr String found in binary or memory: https://www.google.com
Source: js[1].js.2.dr String found in binary or memory: https://www.google.com/travel/flights/click/conversion/
Source: js[1].js.2.dr String found in binary or memory: https://www.googletagmanager.com/debug/bootstrap
Source: analytics[1].js.2.dr String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: 0PV1MQT6.htm.2.dr String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-156994128-2
Source: js[1].js.2.dr String found in binary or memory: https://www.googletraveladservices.com/travel/clk/pagead/conversion/
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.5:49693 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.126.175:443 -> 192.168.2.5:49701 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.126.175:443 -> 192.168.2.5:49700 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.5:49698 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.5:49696 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.5:49699 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.5:49697 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 173.194.76.157:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 173.194.76.157:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: classification engine Classification label: clean0.win@3/31@7/4
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D510EB73-5AA9-11EB-90E5-ECF4BB570DC9}.dat Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DF2F7B38B3350D091D.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2892 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2892 CREDAT:17410 /prefetch:2 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 341582 URL: http://coronavirus.app Startdate: 19/01/2021 Architecture: WINDOWS Score: 0 11 coronavirus-92ebd.web.app 2->11 6 iexplore.exe 1 74 2->6         started        process3 process4 8 iexplore.exe 2 48 6->8         started        dnsIp5 13 stats.l.doubleclick.net 173.194.76.157, 443, 49712, 49713 GOOGLEUS United States 8->13 15 coronavirus.app 151.101.1.195, 443, 49690, 49691 FASTLYUS United States 8->15 17 5 other IPs or domains 8->17
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
173.194.76.157
 unknown United States
15169 GOOGLEUS false
151.101.1.195
 unknown United States
54113 FASTLYUS false
104.16.19.94
 unknown United States
13335 CLOUDFLARENETUS false
104.16.126.175
 unknown United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
stats.l.doubleclick.net 173.194.76.157 true
cdnjs.cloudflare.com 104.16.19.94 true
progressier.com 151.101.1.195 true
unpkg.com 104.16.126.175 true
coronavirus-92ebd.web.app 151.101.1.195 true
coronavirus.app 151.101.1.195 true
stats.g.doubleclick.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://coronavirus.app/ false
  • Avira URL Cloud: safe
 unknown
https://coronavirus.app/ false
    		unknown