Analysis Report http://axpo.open-directory.be/12/#adfg.sadgfa@aasdk.com

Overview

General Information

Sample URL:	http://axpo.open-directory.be/12/#adfg.sadgfa@aasdk.com
Analysis ID:	356759
Infos:
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on shot template match)

Yara detected HtmlPhish_10

Found iframes

HTML body contains low number of good links

HTML title does not match URL

Suspicious form URL found

URL contains potential PII (phishing indication)

Classification

Signatures

Phishing:

Phishing site detected (based on shot template match)

Source: https://hrtlnd.co.za/0f33x/userid/chudy/38l2tm58wl77unnx103f3o6mro.php?0=YWRmZy5zYWRnZmFAYWFzZGsuY29t&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_

Matcher: Template: generic matched

Yara detected HtmlPhish_10

Source: Yara match	File source: 210979.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\src[1].htm, type: DROPPED

Found iframes

Source: https://hrtlnd.co.za/0f33x/userid/chudy/38l2tm58wl77unnx103f3o6mro.php?0=YWRmZy5zYWRnZmFAYWFzZGsuY29t&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_	HTTP Parser: Iframe src: src.php?0=YWRmZy5zYWRnZmFAYWFzZGsuY29t&a=0
Source: https://hrtlnd.co.za/0f33x/userid/chudy/38l2tm58wl77unnx103f3o6mro.php?0=YWRmZy5zYWRnZmFAYWFzZGsuY29t&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_	HTTP Parser: Iframe src: src.php?0=YWRmZy5zYWRnZmFAYWFzZGsuY29t&a=0

HTML body contains low number of good links

Source: https://hrtlnd.co.za/0f33x/userid/chudy/38l2tm58wl77unnx103f3o6mro.php?0=YWRmZy5zYWRnZmFAYWFzZGsuY29t&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_	HTTP Parser: Number of links: 0
Source: https://hrtlnd.co.za/0f33x/userid/chudy/38l2tm58wl77unnx103f3o6mro.php?0=YWRmZy5zYWRnZmFAYWFzZGsuY29t&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://hrtlnd.co.za/0f33x/userid/chudy/38l2tm58wl77unnx103f3o6mro.php?0=YWRmZy5zYWRnZmFAYWFzZGsuY29t&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_	HTTP Parser: Title: Sign In to Update does not match URL
Source: https://hrtlnd.co.za/0f33x/userid/chudy/38l2tm58wl77unnx103f3o6mro.php?0=YWRmZy5zYWRnZmFAYWFzZGsuY29t&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_	HTTP Parser: Title: Sign In to Update does not match URL

Suspicious form URL found

Source: https://hrtlnd.co.za/0f33x/userid/chudy/38l2tm58wl77unnx103f3o6mro.php?0=YWRmZy5zYWRnZmFAYWFzZGsuY29t&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_	HTTP Parser: Form action: snd.php?c=
Source: https://hrtlnd.co.za/0f33x/userid/chudy/38l2tm58wl77unnx103f3o6mro.php?0=YWRmZy5zYWRnZmFAYWFzZGsuY29t&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_	HTTP Parser: Form action: snd.php?c=

URL contains potential PII (phishing indication)

Source: http://axpo.open-directory.be/12/#adfg.sadgfa@aasdk.com

Sample URL: PII: adfg.sadgfa@aasdk.com

Source: https://hrtlnd.co.za/0f33x/userid/chudy/38l2tm58wl77unnx103f3o6mro.php?0=YWRmZy5zYWRnZmFAYWFzZGsuY29t&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_	HTTP Parser: No <meta name="author".. found
Source: https://hrtlnd.co.za/0f33x/userid/chudy/38l2tm58wl77unnx103f3o6mro.php?0=YWRmZy5zYWRnZmFAYWFzZGsuY29t&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_	HTTP Parser: No <meta name="author".. found

Source: https://hrtlnd.co.za/0f33x/userid/chudy/38l2tm58wl77unnx103f3o6mro.php?0=YWRmZy5zYWRnZmFAYWFzZGsuY29t&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_	HTTP Parser: No <meta name="copyright".. found
Source: https://hrtlnd.co.za/0f33x/userid/chudy/38l2tm58wl77unnx103f3o6mro.php?0=YWRmZy5zYWRnZmFAYWFzZGsuY29t&.verify??guce_referrer=aHR0cHM6Ly9sb2dpbi55YWhvby5jb20v&guce_referrer_sig=AQAAABA99NmGR9iNQOyU5mI3ASjQfYjcPATD_A8modgjxpNXYNmo8n5zxdi8EZV7GFYPzoSc_RpMz0hYfdCk0OLmxnMB6tpfZnd5ENcxTcI3e56K0Vz3pSL6PoIoDveE6VV6vAiBzqdjcYAbAHdiaf7gx2w9XRGmCh4orbe2VcZO9aN_	HTTP Parser: No <meta name="copyright".. found

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 162.219.250.43:443 -> 192.168.2.3:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.219.250.43:443 -> 192.168.2.3:49715 version: TLS 1.2

Networking:

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 23 Feb 2021 15:06:59 GMTServer: ApacheX-Powered-By: PHP/5.6.40X-Mod-Pagespeed: 1.13.35.2-0Vary: Accept-EncodingContent-Encoding: gzipCache-Control: max-age=0, no-cache, s-maxage=10Content-Length: 211Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 35 8f dd 6a 02 31 10 85 ef 05 df 21 44 a8 8a 92 b1 78 a7 c9 fa 02 5e 48 a1 f4 a2 94 32 6c 46 32 25 dd 84 cd f8 d7 a7 ef 86 6d e7 ea f0 cd df 39 36 c8 77 6c d4 74 62 03 a1 af 42 0d 65 85 25 52 73 8a 84 85 d4 1b b2 18 63 2c 8c b4 0e 97 b6 e7 2c 4a 1e 99 9c 16 ba 0b 7c e1 15 47 aa 9b 2b f6 2a 60 09 ee c6 9d 4f 37 13 53 8b c2 a9 33 15 ee 6b f7 f5 e5 e8 74 10 c9 65 07 10 7a 89 9d 37 6d 32 3f 08 9b f3 76 7b 87 4b a1 9e 3d b4 e1 e2 1f 70 60 c7 4f 1b a7 57 75 dd 94 1c 59 16 f3 d9 7c f9 fe fc b1 ff fb 90 32 75 8b e1 e8 5a 7f 16 8a 67 bd b4 30 9a 69 a6 93 c1 2e fc 87 1b 54 cd fb 0b 08 9d 7e 86 f6 00 00 00 Data Ascii: 5j1!Dx^H2lF2%m96wltbBe%Rsc,,J|G+*`O7S3ktez7m2?v{K=p`OWuY|2uZg0i.T~

Source: global traffic

HTTP traffic detected: GET /12/ HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: axpo.open-directory.beConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: axpo.open-directory.be

Source: 38l2tm58wl77unnx103f3o6mro[1].htm.3.dr, src[1].htm.3.dr	String found in binary or memory: http:///favicon.ico
Source: ~DF94BFFBA9E3232B83.TMP.2.dr, {365F4BE9-7634-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: http://axpo.open-directory.be/12/#adfg.sadgfa
Source: background_styles[1].css.3.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Raleway
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v19/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvaorCIPrc.woff)
Source: {365F4BE9-7634-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://hrtlnd.co.za/0
Source: ~DF94BFFBA9E3232B83.TMP.2.dr	String found in binary or memory: https://hrtlnd.co.za/0f33x/userid/chudy/38l2tm58wl77unnx103f3o6mro.php?0=YWRmZy5zYWRnZmFAYWFzZGsuY29
Source: 12[1].htm.3.dr	String found in binary or memory: https://hrtlnd.co.za/0f33x/userid/chudy/?i=i&0=
Source: imagestore.dat.3.dr, ~DF94BFFBA9E3232B83.TMP.2.dr	String found in binary or memory: https://hrtlnd.co.za/0f33x/userid/chudy/serv/main.ico
Source: ~DF94BFFBA9E3232B83.TMP.2.dr	String found in binary or memory: https://hrtlnd.co.za/0f33x/userid/chudy/src.php?0=YWRmZy5zYWRnZmFAYWFzZGsuY29t&a=0
Source: ~DF94BFFBA9E3232B83.TMP.2.dr	String found in binary or memory: https://hrtlnd.co.za/0f33x/userid/chudy/z4tfj7ki6h3xkbhd0q9a755pzt.php?0=YWRmZy5zYWRnZmFAYWFzZGsuY29
Source: {365F4BE9-7634-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://hrtlnd.co.za/0tory.be/12/#adfg.sadgfa
Source: imagestore.dat.3.dr	String found in binary or memory: https://hrtlnd.co.za/favicon.icoF
Source: Technology-Bold[1].ttf.3.dr	String found in binary or memory: https://www.coroflot.com/vladimirnikolichttps://www.coroflot.com/vladimirnikolic
Source: Technology-Bold[1].ttf.3.dr	String found in binary or memory: https://www.coroflot.com/vladimirnikolichttps://www.coroflot.com/vladimirnikolicTechnology

Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: unknown	HTTPS traffic detected: 162.219.250.43:443 -> 192.168.2.3:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.219.250.43:443 -> 192.168.2.3:49715 version: TLS 1.2

System Summary:

Source: classification engine

Classification label: mal56.phis.win@3/23@2/2

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFC774FF1C4D3D4D33.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2792 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2792 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
138.201.179.3	unknown	Germany		24940	HETZNER-ASDE	false
162.219.250.43	unknown	United States		33494	IHNETUS	false

Contacted Domains

Name	IP	Active
axpo.open-directory.be	138.201.179.3	true
hrtlnd.co.za	162.219.250.43	true

ID:	356759
Product:	CloudBasic
Start time:	16:06:10
Start date:	23.02.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{365F4BE7-7634-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	9F2E718E5BE24CE89CE2CF2A00328434	50C349BC2019CBAAA5B7A9B08A9DB0FCED492796	75161AA684DD3B860632346D2E299BB0F0CAA18B9D04EF1537CFCF4E976F8AC7
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{365F4BE9-7634-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	565F06CD9C88ED362FADCDA64652BE0F	74B2F3946ECECCEDA71D78DE74769AE47E30CE82	99F7FC7C6BCDAC4AFF6D2869BB9B6ED2ED5FB9459EA36D582DB6F8FDF79F44EC
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{408D34E5-7634-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	18E01F71441D6C19E2C7A2DF9209C2D7	EE8F2146B47DF279E1DBAFCA45756B602F6ACEF4	BA3C175CDAEF71AD995A0A1F6A59E64FD26DF28487F383DD5C5EDD95F90A0697
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat	data	5AEA308E1BF0288764FA6D85046AF5EA	90BCA28406F8B6ED0BA10E87FF0739C802066FF7	4C7DB7E39E56ADCB4AA0524C8B60C50AA98946F35D470B92C9D9FD4C045049EE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\38l2tm58wl77unnx103f3o6mro[1].htm	HTML document, ASCII text	25D082F6D7CF4D7BEE7BB20186CDD9E8	1EF3F077A7510D7FA14488A2321E726A9733F8F0	3D7545FCE53793B666B1D853450E975EE1E474DA79F53F678E7B97143FBDA9F4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\background_styles[1].css	ASCII text	CCAF38BCC02C350CE2711E6E4C9B6442	10AD12794909A0697F866FBF68FD3484E4A0A6C5	58151938B48F02077AC1809421826B735DFAC46F13CB3E1494938447D99B604E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\cropped-HRTLAND-Logo-6-32x32[1].png	PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced	564F12118C6D1855257C0FBCB441E65D	B5057E101AD2C1CD5C3275EDFB1C1B693FFF6191	A61921AB5165C46171C388FC103CAF69395B8976A1FFA71E4EAF0F74C4603B53
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\styles[1].css	ASCII text	923D2906F51BE6C3ED49E74EFE7664FF	B1393393B0E96F5C806E6480191E03E10B0D9832	D6FC3D1520A00BE1C8C8CB060A85BDB76F8DAA6596E58D2B2A977EA67BB0A886
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvaorCIPrc[1].woff	Web Open Font Format, TrueType, length 25804, version 1.1	CE22119EC5A34EF3D200892F0B1C3C0C	B8A7EA7AB06D9FAA8196949EE273DA5B5E949FD1	A02462A6C8721B680A2BC724BB2BD7E65A38C4F845269493B8DCDF015B8C47BA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\Technology-Bold[1].ttf	Tech	14095C75B16E47BCC0F87A3375521A77	38BD291EDA5E6FEC6D2EFBF3CCD258B6986ED69C	E0820A01E8BE18589121C87E194A0F23F631AD9DA45637C4719D218F5D124BF5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\bg[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1200, frames 3	C4BC5A8E0C3045A10A8E754E9872187E	6AA1B4A76C73C2660649AFD13B52EE05B27384B3	BAA0AB5394BD362CABA2A85B0D7C713BA60F58824AEA1B080A2D790752812C01
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\style2[1].css	ASCII text, with CRLF line terminators	9D0760C05430B2E9D446401C39D51BBC	1A257F78EAB3D07932F222B0D33240517E5F11C4	F87BE9AFBCCA41F247A16B12061D20DEC5492957B5D85658736ED554B9311F30
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\z4tfj7ki6h3xkbhd0q9a755pzt[1].htm	HTML document, ASCII text	B5BB30B1955229C64454DFCE6F13D099	B11E39516B58AF649F4027CA11D0F71014C73EAC	EC80307ABF6BF3C3CDCC002D71E7558729358A637E7B159D1231D11EC705EA4D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\main[1].ico	gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", progressive, precision 8, 400x400, frames 3	88A08B9A93426B11FA22FAB0B5758F7D	4C93EDEAD6171C954B9A7E20C54212C63905DDA2	504DAA52D87531CF53C2340B7CD77752C19A91AD2BA5211ACA32BF745305D862
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\script[1].js	ASCII text	0B5CA22D67C485690CBD259DA621C4B3	7195960C436127E259C9AD16680826910EDC69E5	92FD40762D767AC7711C39B19506D470D901D31C8AC193499B3B673EC1261396
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\style[1].css	ASCII text, with CRLF line terminators	D2071B63B3CDE9CEBF581D6EF528BD13	22B3C4BF7FD2340AF7B9E09CFA4DFEBCF0547828	EDECC97D12F824EEB7BD13EF2E4CF551C3139F79A63504A7CD0DFC3E5333BADC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\12[1].htm	HTML document, ASCII text, with CRLF line terminators	9E68DD285C4153C4697D277F873BC74A	440FB227B9B1354DACDFF73A89D3CCED9D95C0E1	FCB3509C92475DA0F93233D5DEA0F7890B2EF6236DB5A5404BA8FBA5D1138A8F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\bgr[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1920x1152, frames 3	CD7026F33F2C8368AA0EF3C068F31F82	298AF50F409C44EFE589234239B8BFC89B6B26E7	AE3CA3CD183C8DFE9ACDF92751D544555CB50B5E2F3ADFDD57EDB1BA9A6250A4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\css[1].css	ASCII text	63A75C6842F4F0681B41B1CE9190BB02	D7BA7E4A5159DB70CBC5E342586ADA2172CC6E57	B6B0F54AB6D64B19562827E877182F0560F97C6CFA2C75FF970B29CC1304C5EC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\src[1].htm	HTML document, UTF-8 Unicode text, with CRLF line terminators	FE34823465BB04466272425E629D8C21	967195D22B9EE8198EB32A5212C60D00867C3F30	228DB533A758A0E2271466FB25F6C683D271E91DC4920D53E383018A964EF4ED
C:\Users\user\AppData\Local\Temp\~DF643C991D1957F575.TMP	data	717DC226AE7164675FD1935A3B1477BD	6C12CD4CF85E21483B406AFB9D5D0E1B0B26F8DB	C3195DE6B9853C2720D49C6961E8E53256A9FCEA48A8B71200A550E442584F53
C:\Users\user\AppData\Local\Temp\~DF94BFFBA9E3232B83.TMP	data	3CA46057FD4C2935649601B509726ECA	0C9DB76183914204B755D50999E209B8BEEF8941	0B98C0A7065795074D098679C0B4DDF5686E261746A071F9D4A2EC7FA502FEBE
C:\Users\user\AppData\Local\Temp\~DFC774FF1C4D3D4D33.TMP	data	06856EEF29FACF5E613B1CE0AE852FC9	790305BC60CDE1321663492232E6DD848C4DDAC3	5491E6887B362DBED745440A70AC5777D8213D1CDBAA651BA01F6A02C8CC90B5

Analysis Report http://axpo.open-directory.be/12/#adfg.sadgfa@aasdk.com

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing:

Compliance:

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains