Analysis Report https://architectchintanvirani.com/1/2support/index.php?email=mmaye4@uottawa.ca

Overview

General Information

Sample URL: https://architectchintanvirani.com/1/2support/index.php?email=mmaye4@uottawa.ca
Analysis ID: 356287

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 64
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for domain / URL
Yara detected HtmlPhish_10
HTML body contains low number of good links
No HTML title found
URL contains potential PII (phishing indication)

Classification

AV Detection:

barindex
Antivirus / Scanner detection for submitted sample
Source: https://architectchintanvirani.com/1/2support/index.php?email=mmaye4@uottawa.ca SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering
Multi AV Scanner detection for domain / URL
Source: www.politikesgeuseis.gr Virustotal: Detection: 7% Perma Link

Phishing:

barindex
Yara detected HtmlPhish_10
Source: Yara match File source: 473627.pages.csv, type: HTML
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0[1].htm, type: DROPPED
HTML body contains low number of good links
Source: https://openplaywcowuk.gb.net/qwehbgfvdcfvtbgrvfecd/QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0/?Key=QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0&rand=13InboxLightaspxn_QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0_NHZVVml0czVCRkxRWmsw-&21613cde29049b3c91b62de76cfc8570a2e0ec37b8668ec5d246bab8a58db410#mmaye4@uottawa.ca HTTP Parser: Number of links: 0
Source: https://openplaywcowuk.gb.net/qwehbgfvdcfvtbgrvfecd/QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0/?Key=QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0&rand=13InboxLightaspxn_QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0_NHZVVml0czVCRkxRWmsw-&21613cde29049b3c91b62de76cfc8570a2e0ec37b8668ec5d246bab8a58db410#mmaye4@uottawa.ca HTTP Parser: Number of links: 0
No HTML title found
Source: https://openplaywcowuk.gb.net/qwehbgfvdcfvtbgrvfecd/QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0/?Key=QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0&rand=13InboxLightaspxn_QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0_NHZVVml0czVCRkxRWmsw-&21613cde29049b3c91b62de76cfc8570a2e0ec37b8668ec5d246bab8a58db410#mmaye4@uottawa.ca HTTP Parser: HTML title missing
Source: https://openplaywcowuk.gb.net/qwehbgfvdcfvtbgrvfecd/QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0/?Key=QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0&rand=13InboxLightaspxn_QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0_NHZVVml0czVCRkxRWmsw-&21613cde29049b3c91b62de76cfc8570a2e0ec37b8668ec5d246bab8a58db410#mmaye4@uottawa.ca HTTP Parser: HTML title missing
URL contains potential PII (phishing indication)
Source: https://architectchintanvirani.com/1/2support/index.php?email=mmaye4@uottawa.ca Sample URL: PII: mmaye4@uottawa.ca
Source: https://openplaywcowuk.gb.net/qwehbgfvdcfvtbgrvfecd/QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0/?Key=QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0&rand=13InboxLightaspxn_QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0_NHZVVml0czVCRkxRWmsw-&21613cde29049b3c91b62de76cfc8570a2e0ec37b8668ec5d246bab8a58db410#mmaye4@uottawa.ca HTTP Parser: No <meta name="author".. found
Source: https://openplaywcowuk.gb.net/qwehbgfvdcfvtbgrvfecd/QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0/?Key=QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0&rand=13InboxLightaspxn_QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0_NHZVVml0czVCRkxRWmsw-&21613cde29049b3c91b62de76cfc8570a2e0ec37b8668ec5d246bab8a58db410#mmaye4@uottawa.ca HTTP Parser: No <meta name="author".. found
Source: https://openplaywcowuk.gb.net/qwehbgfvdcfvtbgrvfecd/QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0/?Key=QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0&rand=13InboxLightaspxn_QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0_NHZVVml0czVCRkxRWmsw-&21613cde29049b3c91b62de76cfc8570a2e0ec37b8668ec5d246bab8a58db410#mmaye4@uottawa.ca HTTP Parser: No <meta name="copyright".. found
Source: https://openplaywcowuk.gb.net/qwehbgfvdcfvtbgrvfecd/QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0/?Key=QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0&rand=13InboxLightaspxn_QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0_NHZVVml0czVCRkxRWmsw-&21613cde29049b3c91b62de76cfc8570a2e0ec37b8668ec5d246bab8a58db410#mmaye4@uottawa.ca HTTP Parser: No <meta name="copyright".. found

Compliance:

barindex
Uses new MSVCR Dlls
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Uses secure TLS version for HTTPS connections
Source: unknown HTTPS traffic detected: 173.237.190.111:443 -> 192.168.2.3:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 173.237.190.111:443 -> 192.168.2.3:49715 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.129.25.9:443 -> 192.168.2.3:49718 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.129.25.9:443 -> 192.168.2.3:49719 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.3:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.3:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.214.201.112:443 -> 192.168.2.3:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.214.201.112:443 -> 192.168.2.3:49749 version: TLS 1.2
Source: unknown DNS traffic detected: queries for: architectchintanvirani.com
Source: font-awesome.min[1].css.3.dr String found in binary or memory: http://fontawesome.io
Source: font-awesome.min[1].css.3.dr String found in binary or memory: http://fontawesome.io/license
Source: bootstrap.min[1].css.3.dr String found in binary or memory: http://getbootstrap.com)
Source: popper.min[1].js.3.dr String found in binary or memory: http://opensource.org/licenses/MIT).
Source: QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0[1].htm0.3.dr String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: ~DF5C6855DB7C39EC1D.TMP.1.dr, {78E9B5C8-7593-11EB-90E4-ECF4BB862DED}.dat.1.dr String found in binary or memory: https://architectchintanvirani.com/1/2support/index.php?email=mmaye4
Source: QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0[1].htm0.3.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0[1].htm0.3.dr String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0[1].htm0.3.dr String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0[1].htm0.3.dr String found in binary or memory: https://code.jquery.com/jquery-3.3.1.js
Source: QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0[1].htm0.3.dr String found in binary or memory: https://firebasestorage.googleapis.com/v0/b/dellcssfile.appspot.com/o/bootstrap.min.css?alt=media&to
Source: QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0[1].htm0.3.dr String found in binary or memory: https://firebasestorage.googleapis.com/v0/b/dellcssfile.appspot.com/o/font-awesome.min.css?alt=media
Source: free-fa-regular-400[1].eot.3.dr, free.min[1].css.3.dr String found in binary or memory: https://fontawesome.com
Source: free.min[1].css.3.dr String found in binary or memory: https://fontawesome.com/license/free
Source: free-fa-regular-400[1].eot.3.dr, free-fa-solid-900[1].eot.3.dr String found in binary or memory: https://fontawesome.comhttps://fontawesome.comFont
Source: QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0[1].htm0.3.dr String found in binary or memory: https://fonts.googleapis.com/css?family=Archivo
Source: css[1].css.3.dr String found in binary or memory: https://fonts.gstatic.com/s/archivonarrow/v12/tss0ApVBdCYD5Q7hcxTE1ArZ0bbwiXo.woff)
Source: css[1].css0.3.dr String found in binary or memory: https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN7rgOUuhv.woff)
Source: css[1].css0.3.dr String found in binary or memory: https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0d.woff)
Source: css[1].css0.3.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc-.woff)
Source: css[1].css0.3.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxM.woff)
Source: bootstrap.min[2].js.3.dr String found in binary or memory: https://getbootstrap.com)
Source: bootstrap.min[1].js.3.dr String found in binary or memory: https://getbootstrap.com/)
Source: bootstrap.min[2].js.3.dr, bootstrap.min[1].css.3.dr String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: bootstrap.min[2].js.3.dr String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: 585b051251[1].js.3.dr String found in binary or memory: https://ka-f.fontawesome.com
Source: 585b051251[1].js.3.dr String found in binary or memory: https://kit.fontawesome.com
Source: QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0[1].htm0.3.dr String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0[1].htm0.3.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0[1].htm0.3.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0[1].htm0.3.dr String found in binary or memory: https://melissadatawde.ru/ghyjunhtbgvsadrbt18feb/next.php
Source: ~DF5C6855DB7C39EC1D.TMP.1.dr String found in binary or memory: https://openplaywcowuk.gb.net/qwehbgfvdcfvtbgrvfecd/?sicmalsnj3f3=83djnskjac4fr
Source: ~DF5C6855DB7C39EC1D.TMP.1.dr, {78E9B5C8-7593-11EB-90E4-ECF4BB862DED}.dat.1.dr String found in binary or memory: https://openplaywcowuk.gb.net/qwehbgfvdcfvtbgrvfecd/?sicmalsnj3f3=83djnskjac4fr#mmaye4
Source: ~DF5C6855DB7C39EC1D.TMP.1.dr, QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0[1].htm.3.dr String found in binary or memory: https://openplaywcowuk.gb.net/qwehbgfvdcfvtbgrvfecd/QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5
Source: {78E9B5C8-7593-11EB-90E4-ECF4BB862DED}.dat.1.dr String found in binary or memory: https://openplaywcowukanvirani.com/1/2support/index.php?email=mmaye4
Source: QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0[1].htm0.3.dr String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Source: QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0[1].htm0.3.dr String found in binary or memory: https://www.google.com/s2/favicons?domain=
Source: imagestore.dat.3.dr, QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0[1].htm0.3.dr String found in binary or memory: https://www.google.com/s2/favicons?domain=dell.com?v=BUILD_HASH
Source: {78E9B5C8-7593-11EB-90E4-ECF4BB862DED}.dat.1.dr String found in binary or memory: https://www.politikesg.gb.net/qwehbgfvdcfvtbgrvfecd/QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5
Source: QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0[1].htm0.3.dr String found in binary or memory: https://www.politikesgeuseis.gr/cricl/oauth/site/service/demp.php?email=info
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown HTTPS traffic detected: 173.237.190.111:443 -> 192.168.2.3:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 173.237.190.111:443 -> 192.168.2.3:49715 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.129.25.9:443 -> 192.168.2.3:49718 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.129.25.9:443 -> 192.168.2.3:49719 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.3:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.3:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.214.201.112:443 -> 192.168.2.3:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.214.201.112:443 -> 192.168.2.3:49749 version: TLS 1.2
Source: classification engine Classification label: mal64.phis.win@3/31@9/4
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DFD7E45C6E89F63922.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2024 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2024 CREDAT:17410 /prefetch:2 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 356287 URL: https://architectchintanvir... Startdate: 22/02/2021 Architecture: WINDOWS Score: 64 20 Multi AV Scanner detection for domain / URL 2->20 22 Antivirus / Scanner detection for submitted sample 2->22 24 Yara detected HtmlPhish_10 2->24 6 iexplore.exe 2 61 2->6         started        process3 process4 8 iexplore.exe 2 61 6->8         started        dnsIp5 14 www.politikesgeuseis.gr 35.214.201.112, 443, 49748, 49749 GOOGLE-2US United States 8->14 16 cdnjs.cloudflare.com 104.16.19.94, 443, 49730, 49731 CLOUDFLARENETUS United States 8->16 18 7 other IPs or domains 8->18 12 QXNpYQ==22-02-2021...Vits5BFLQZk0[1].htm, HTML 8->12 dropped file6
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
173.237.190.111
 unknown United States
30496 AS-TIERP-30496US false
35.214.201.112
 unknown United States
19527 GOOGLE-2US true
104.129.25.9
 unknown United States
8100 ASN-QUADRANET-GLOBALUS false
104.16.19.94
 unknown United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
openplaywcowuk.gb.net 104.129.25.9 true
www.politikesgeuseis.gr 35.214.201.112 true
cdnjs.cloudflare.com 104.16.19.94 true
architectchintanvirani.com 173.237.190.111 true
stackpath.bootstrapcdn.com unknown unknown
ka-f.fontawesome.com unknown unknown
code.jquery.com unknown unknown
kit.fontawesome.com unknown unknown
maxcdn.bootstrapcdn.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://openplaywcowuk.gb.net/qwehbgfvdcfvtbgrvfecd/QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0/?Key=QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0&rand=13InboxLightaspxn_QXNpYQ==22-02-202107-56-25pm3803fe4e995ba53820d5309dd609ff4d2cc7b4d82702293091209e3ad38ed14aNHZVVml0czVCRkxRWmswVUVzPQ==UGFraXN0YW4=VUVzPQ==4vUVits5BFLQZk0_NHZVVml0czVCRkxRWmsw-&21613cde29049b3c91b62de76cfc8570a2e0ec37b8668ec5d246bab8a58db410#mmaye4@uottawa.ca true
    		unknown
    https://www.politikesgeuseis.gr/cricl/oauth/site/service/demp.php?email=info@dell.com# true
      		unknown