Analysis Report https://joom.ag/jSeI

Overview

General Information

Sample URL:	https://joom.ag/jSeI
Analysis ID:	363595
Infos:
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Phishing site detected (based on shot template match)

Yara detected HtmlPhish_10

Yara detected HtmlPhish_7

HTML body contains low number of good links

HTML title does not match URL

Classification

Signatures

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://joom.ag/jSeI

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://view.joomag.com/sharefile/0291789001614882763?short&	SlashNext: Label: Fake Login Page type: Phishing & Social Engineering
Source: https://calfvessel.com/file/adobe/	SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Phishing site detected (based on shot template match)

Source: https://calfvessel.com/file/adobe/

Matcher: Template: office matched

Yara detected HtmlPhish_10

Source: Yara match	File source: 364339.0.links.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\adobe[1].htm, type: DROPPED

Yara detected HtmlPhish_7

Source: Yara match	File source: 364339.0.links.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\adobe[1].htm, type: DROPPED

HTML body contains low number of good links

Source: https://calfvessel.com/file/adobe/	HTTP Parser: Number of links: 0
Source: https://calfvessel.com/file/adobe/	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://calfvessel.com/file/adobe/	HTTP Parser: Title: Share Point Online does not match URL
Source: https://calfvessel.com/file/adobe/	HTTP Parser: Title: Share Point Online does not match URL

Source: https://calfvessel.com/file/adobe/	HTTP Parser: No <meta name="author".. found
Source: https://calfvessel.com/file/adobe/	HTTP Parser: No <meta name="author".. found

Source: https://calfvessel.com/file/adobe/	HTTP Parser: No <meta name="copyright".. found
Source: https://calfvessel.com/file/adobe/	HTTP Parser: No <meta name="copyright".. found

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.217:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.217:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.15.154:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.15.154:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.182.226.40:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.182.226.40:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.22.227:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.22.227:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.25:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.25:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.38.171.82:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.38.171.82:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.4:49782 version: TLS 1.2

Networking:

Source: magazine[1].js.2.dr

String found in binary or memory: joomag.magazine.openYoutubeVideo=function(videoID,startTime){var $body=$("body");var videoUrl="https://www.youtube.com/embed/"+videoID+"?html5=1"+"&autoplay=1"+"&iv_load_policy=3"+"&modestbranding=1"+"&rel=0"+"&showinfo=0"+"&fs=1"+"&enablejsapi=1"+"&start="+startTime;var modalSelector="#j-remote-youtube-video-modal-dialog";var $modal=$(modalSelector);var $modalContent;var getVideoSize=function(){var closeButtonWidth=60;var availableSpace={w:window.innerWidth-50,h:window.innerHeight-50};var videoRatio= equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: joom.ag

Source: hover[1].css.2.dr	String found in binary or memory: http://ianlunn.co.uk/
Source: hover[1].css.2.dr	String found in binary or memory: http://ianlunn.github.io/Hover/)
Source: popper.min[1].js.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: olb8zpk[1].js.2.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000148a0
Source: olb8zpk[1].js.2.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000148a2
Source: olb8zpk[1].js.2.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000148a4
Source: olb8zpk[1].js.2.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000148a6
Source: olb8zpk[1].js.2.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000148ac
Source: olb8zpk[1].js.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000000001499c
Source: gtm[1].js.2.dr	String found in binary or memory: https://adservice.google.com/ddm/regclk
Source: gtm[1].js.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: adobe[1].htm.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: analytics[1].js.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://browser.sentry-cdn.com/5.11.2/bundle.min.js
Source: {7E770D05-7D33-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://calfvessel.com
Source: ~DFF8E1FCFAEB5B2E87.TMP.1.dr	String found in binary or memory: https://calfvessel.com/file/adobe/91789001614882763?short&BG
Source: gtm[1].js.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: adobe[1].htm.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: adobe[1].htm.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: adobe[1].htm.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: adobe[1].htm.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.3.1.js
Source: magazine[1].js.2.dr	String found in binary or memory: https://dme0ih8comzn4.cloudfront.net/imaging/v3/editor.js
Source: free.min[1].css.2.dr	String found in binary or memory: https://fontawesome.com
Source: free.min[1].css.2.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: adobe[1].htm.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Yellowtail&display=swap
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/yellowtail/v11/OZpGg_pnoDtINPfRIlLohlvHxw.woff)
Source: bootstrap.min[1].js.2.dr, bootstrap.min[1].css.2.dr	String found in binary or memory: https://getbootstrap.com)
Source: hover[1].css.2.dr	String found in binary or memory: https://github.com/IanLunn/Hover
Source: bundle.min[1].js.2.dr	String found in binary or memory: https://github.com/getsentry/sentry-javascript
Source: bootstrap.min[1].js.2.dr, bootstrap.min[1].css.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: bootstrap.min[1].js.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: 585b051251[1].js.2.dr	String found in binary or memory: https://ka-f.fontawesome.com
Source: 585b051251[1].js.2.dr	String found in binary or memory: https://kit.fontawesome.com
Source: adobe[1].htm.2.dr	String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: adobe[1].htm.2.dr	String found in binary or memory: https://login.microsoftonline.com/common/login
Source: adobe[1].htm.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: adobe[1].htm.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: olb8zpk[1].js.2.dr	String found in binary or memory: https://p.typekit.net/p.gif
Source: gtm[1].js.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: magazine[1].js.2.dr	String found in binary or memory: https://player.vimeo.com/video/
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://s9cdn.joomag.com/res_mag/1/1702/1702695/2420210/thumbs/58582055.jpg?1614889819
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://s9cdn.joomag.com/res_mag/1/1702/1702695/2420210/thumbs/spread/0.jpg?1614889819
Source: analytics[1].js.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: olb8zpk[1].js.2.dr	String found in binary or memory: https://use.typekit.net/af/1eef01/0000000000000000000148ac/23/
Source: olb8zpk[1].js.2.dr	String found in binary or memory: https://use.typekit.net/af/3ba24d/0000000000000000000148a0/23/
Source: olb8zpk[1].js.2.dr	String found in binary or memory: https://use.typekit.net/af/3d81f6/0000000000000000000148a2/23/
Source: olb8zpk[1].js.2.dr	String found in binary or memory: https://use.typekit.net/af/42fca5/0000000000000000000148a4/23/
Source: olb8zpk[1].js.2.dr	String found in binary or memory: https://use.typekit.net/af/bc719c/00000000000000000001499c/23/
Source: olb8zpk[1].js.2.dr	String found in binary or memory: https://use.typekit.net/af/e0b8be/0000000000000000000148a6/23/
Source: {7E770D05-7D33-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://view.Root
Source: {7E770D05-7D33-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://view.joom/file/adobe/91789001614882763?short&Root
Source: {7E770D05-7D33-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://view.joomRoot
Source: {7E770D05-7D33-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://view.joomag.co
Source: ~DFF8E1FCFAEB5B2E87.TMP.1.dr	String found in binary or memory: https://view.joomag.com/sharefile/0291789001614882763?short&
Source: ~DFF8E1FCFAEB5B2E87.TMP.1.dr	String found in binary or memory: https://view.joomag.com/sharefile/0291789001614882763?short&BG
Source: {7E770D05-7D33-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://view.joomag.com/sharefile/0291789001614882763?short&Root
Source: {7E770D05-7D33-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://view.joomjoomag.com/sharefile/0291789001614882763?short&
Source: {7E770D05-7D33-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://view.joomm/sharefile/0291789001614882763?short&Root
Source: main.2813cfbe59a2f8c75923[1].js.2.dr	String found in binary or memory: https://vimeo.com/api/oembed.json?url=
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: gtm[1].js.2.dr	String found in binary or memory: https://www.google.com
Source: magazine[1].js.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js?onload=
Source: gtm[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/debug/bootstrap
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com//static/locale/en.js?_=5.1.6.0
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/Frontend/WebService/getThumbnailSocial.php?mID=2420210&spread=0&1614889819
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/Frontend/WebService/getThumbnailSocial.php?mID=2420210&spread=0&width=500&161
Source: manifest.8e10809dba1c553a5a2a[1].js.2.dr	String found in binary or memory: https://www.joomag.com/Frontend/mobile/viewer/
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/Frontend/mobile/viewer/favicon.ico
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/Frontend/mobile/viewer/main.2813cfbe59a2f8c75923.js
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/Frontend/mobile/viewer/manifest.8e10809dba1c553a5a2a.js
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/Frontend/mobile/viewer/normalize.d0dfb984f88d0dbb9fde.js
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/Frontend/mobile/viewer/styles/main.867208e99122488d74f9a620279f9cd9.css
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/Frontend/mobile/viewer/vendor.7bc4df7aaac8424047c3.js
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/Frontend/pixel/joomag-pixel.3df7f73f177625835141.js
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/res_mag/logos/2420210.PNG?1614882780
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/static/css/html5-viewer-external.css?_=5.1.6.0
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/static/js/magazine.js?_=5.1.6.0
Source: magazine[1].js.2.dr	String found in binary or memory: https://www.youtube.com/embed/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.217:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.217:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.15.154:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.15.154:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.182.226.40:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.182.226.40:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.22.227:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.22.227:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.25:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.25:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.38.171.82:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.38.171.82:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.4:49782 version: TLS 1.2

System Summary:

Source: classification engine

Classification label: mal80.phis.win@3/59@19/8

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7E770D03-7D33-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF9697AB0B8A418A42.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3492 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3492 CREDAT:17410 /prefetch:2	Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Windows\SysWOW64\Macromed\Flash\ss.cfg

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
108.177.15.154	stats.l.doubleclick.net	United States	15169	GOOGLEUS	false
209.95.50.25	an3.joomag.com	United States	32780	HOSTINGSERVICES-INCUS	false
151.101.194.217	browser.sentry-cdn.com	United States	54113	FASTLYUS	false
92.38.171.82	calfvessel.com	Austria	202422	GHOSTRU	false
172.217.22.227	www.google.co.uk	United States	15169	GOOGLEUS	false
104.16.18.94	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
209.95.50.27	lb.joomag.com	United States	32780	HOSTINGSERVICES-INCUS	false
107.182.226.40	s9.joomag.com	United States	32780	HOSTINGSERVICES-INCUS	false

Contacted Domains

Name	IP	Active
lb.joomag.com	209.95.50.27	true
browser.sentry-cdn.com	151.101.194.217	true
stats.l.doubleclick.net	108.177.15.154	true
cdnjs.cloudflare.com	104.16.18.94	true
www.google.co.uk	172.217.22.227	true
calfvessel.com	92.38.171.82	true
s9.joomag.com	107.182.226.40	true
an3.joomag.com	209.95.50.25	true
joom.ag	209.95.50.27	true
www.joomag.com	unknown	unknown
use.typekit.net	unknown	unknown
ka-f.fontawesome.com	unknown	unknown
kit.fontawesome.com	unknown	unknown
js-agent.newrelic.com	unknown	unknown
maxcdn.bootstrapcdn.com	unknown	unknown
s9cdn.joomag.com	unknown	unknown
stats.g.doubleclick.net	unknown	unknown
p.typekit.net	unknown	unknown
code.jquery.com	unknown	unknown
view.joomag.com	unknown	unknown
bam-cell.nr-data.net	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://view.joomag.com/sharefile/0291789001614882763?short&	false	SlashNext: Fake Login Page type: Phishing & Social Engineering	high
https://calfvessel.com/file/adobe/	true	SlashNext: Fake Login Page type: Phishing & Social Engineering	unknown

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://joom.ag/jSeI

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://view.joomag.com/sharefile/0291789001614882763?short&	SlashNext: Label: Fake Login Page type: Phishing & Social Engineering
Source: https://calfvessel.com/file/adobe/	SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Phishing site detected (based on shot template match)

Source: https://calfvessel.com/file/adobe/

Matcher: Template: office matched

Yara detected HtmlPhish_10

Source: Yara match	File source: 364339.0.links.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\adobe[1].htm, type: DROPPED

Yara detected HtmlPhish_7

Source: Yara match	File source: 364339.0.links.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\adobe[1].htm, type: DROPPED

HTML body contains low number of good links

Source: https://calfvessel.com/file/adobe/	HTTP Parser: Number of links: 0
Source: https://calfvessel.com/file/adobe/	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://calfvessel.com/file/adobe/	HTTP Parser: Title: Share Point Online does not match URL
Source: https://calfvessel.com/file/adobe/	HTTP Parser: Title: Share Point Online does not match URL

Source: https://calfvessel.com/file/adobe/	HTTP Parser: No <meta name="author".. found
Source: https://calfvessel.com/file/adobe/	HTTP Parser: No <meta name="author".. found

Source: https://calfvessel.com/file/adobe/	HTTP Parser: No <meta name="copyright".. found
Source: https://calfvessel.com/file/adobe/	HTTP Parser: No <meta name="copyright".. found

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.217:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.217:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.15.154:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.15.154:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.182.226.40:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.182.226.40:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.22.227:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.22.227:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.25:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.25:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.38.171.82:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.38.171.82:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.4:49782 version: TLS 1.2

Networking:

Source: magazine[1].js.2.dr

Source: unknown

DNS traffic detected: queries for: joom.ag

Source: hover[1].css.2.dr	String found in binary or memory: http://ianlunn.co.uk/
Source: hover[1].css.2.dr	String found in binary or memory: http://ianlunn.github.io/Hover/)
Source: popper.min[1].js.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: olb8zpk[1].js.2.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000148a0
Source: olb8zpk[1].js.2.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000148a2
Source: olb8zpk[1].js.2.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000148a4
Source: olb8zpk[1].js.2.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000148a6
Source: olb8zpk[1].js.2.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000148ac
Source: olb8zpk[1].js.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000000001499c
Source: gtm[1].js.2.dr	String found in binary or memory: https://adservice.google.com/ddm/regclk
Source: gtm[1].js.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: adobe[1].htm.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: analytics[1].js.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://browser.sentry-cdn.com/5.11.2/bundle.min.js
Source: {7E770D05-7D33-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://calfvessel.com
Source: ~DFF8E1FCFAEB5B2E87.TMP.1.dr	String found in binary or memory: https://calfvessel.com/file/adobe/91789001614882763?short&BG
Source: gtm[1].js.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: adobe[1].htm.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: adobe[1].htm.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: adobe[1].htm.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: adobe[1].htm.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.3.1.js
Source: magazine[1].js.2.dr	String found in binary or memory: https://dme0ih8comzn4.cloudfront.net/imaging/v3/editor.js
Source: free.min[1].css.2.dr	String found in binary or memory: https://fontawesome.com
Source: free.min[1].css.2.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: adobe[1].htm.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Yellowtail&display=swap
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/yellowtail/v11/OZpGg_pnoDtINPfRIlLohlvHxw.woff)
Source: bootstrap.min[1].js.2.dr, bootstrap.min[1].css.2.dr	String found in binary or memory: https://getbootstrap.com)
Source: hover[1].css.2.dr	String found in binary or memory: https://github.com/IanLunn/Hover
Source: bundle.min[1].js.2.dr	String found in binary or memory: https://github.com/getsentry/sentry-javascript
Source: bootstrap.min[1].js.2.dr, bootstrap.min[1].css.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: bootstrap.min[1].js.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: 585b051251[1].js.2.dr	String found in binary or memory: https://ka-f.fontawesome.com
Source: 585b051251[1].js.2.dr	String found in binary or memory: https://kit.fontawesome.com
Source: adobe[1].htm.2.dr	String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: adobe[1].htm.2.dr	String found in binary or memory: https://login.microsoftonline.com/common/login
Source: adobe[1].htm.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: adobe[1].htm.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: olb8zpk[1].js.2.dr	String found in binary or memory: https://p.typekit.net/p.gif
Source: gtm[1].js.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: magazine[1].js.2.dr	String found in binary or memory: https://player.vimeo.com/video/
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://s9cdn.joomag.com/res_mag/1/1702/1702695/2420210/thumbs/58582055.jpg?1614889819
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://s9cdn.joomag.com/res_mag/1/1702/1702695/2420210/thumbs/spread/0.jpg?1614889819
Source: analytics[1].js.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: olb8zpk[1].js.2.dr	String found in binary or memory: https://use.typekit.net/af/1eef01/0000000000000000000148ac/23/
Source: olb8zpk[1].js.2.dr	String found in binary or memory: https://use.typekit.net/af/3ba24d/0000000000000000000148a0/23/
Source: olb8zpk[1].js.2.dr	String found in binary or memory: https://use.typekit.net/af/3d81f6/0000000000000000000148a2/23/
Source: olb8zpk[1].js.2.dr	String found in binary or memory: https://use.typekit.net/af/42fca5/0000000000000000000148a4/23/
Source: olb8zpk[1].js.2.dr	String found in binary or memory: https://use.typekit.net/af/bc719c/00000000000000000001499c/23/
Source: olb8zpk[1].js.2.dr	String found in binary or memory: https://use.typekit.net/af/e0b8be/0000000000000000000148a6/23/
Source: {7E770D05-7D33-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://view.Root
Source: {7E770D05-7D33-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://view.joom/file/adobe/91789001614882763?short&Root
Source: {7E770D05-7D33-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://view.joomRoot
Source: {7E770D05-7D33-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://view.joomag.co
Source: ~DFF8E1FCFAEB5B2E87.TMP.1.dr	String found in binary or memory: https://view.joomag.com/sharefile/0291789001614882763?short&
Source: ~DFF8E1FCFAEB5B2E87.TMP.1.dr	String found in binary or memory: https://view.joomag.com/sharefile/0291789001614882763?short&BG
Source: {7E770D05-7D33-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://view.joomag.com/sharefile/0291789001614882763?short&Root
Source: {7E770D05-7D33-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://view.joomjoomag.com/sharefile/0291789001614882763?short&
Source: {7E770D05-7D33-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://view.joomm/sharefile/0291789001614882763?short&Root
Source: main.2813cfbe59a2f8c75923[1].js.2.dr	String found in binary or memory: https://vimeo.com/api/oembed.json?url=
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: gtm[1].js.2.dr	String found in binary or memory: https://www.google.com
Source: magazine[1].js.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js?onload=
Source: gtm[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/debug/bootstrap
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com//static/locale/en.js?_=5.1.6.0
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/Frontend/WebService/getThumbnailSocial.php?mID=2420210&spread=0&1614889819
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/Frontend/WebService/getThumbnailSocial.php?mID=2420210&spread=0&width=500&161
Source: manifest.8e10809dba1c553a5a2a[1].js.2.dr	String found in binary or memory: https://www.joomag.com/Frontend/mobile/viewer/
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/Frontend/mobile/viewer/favicon.ico
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/Frontend/mobile/viewer/main.2813cfbe59a2f8c75923.js
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/Frontend/mobile/viewer/manifest.8e10809dba1c553a5a2a.js
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/Frontend/mobile/viewer/normalize.d0dfb984f88d0dbb9fde.js
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/Frontend/mobile/viewer/styles/main.867208e99122488d74f9a620279f9cd9.css
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/Frontend/mobile/viewer/vendor.7bc4df7aaac8424047c3.js
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/Frontend/pixel/joomag-pixel.3df7f73f177625835141.js
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/res_mag/logos/2420210.PNG?1614882780
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/static/css/html5-viewer-external.css?_=5.1.6.0
Source: 0291789001614882763[1].htm.2.dr	String found in binary or memory: https://www.joomag.com/static/js/magazine.js?_=5.1.6.0
Source: magazine[1].js.2.dr	String found in binary or memory: https://www.youtube.com/embed/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.217:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.217:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.15.154:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.15.154:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.182.226.40:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.182.226.40:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.22.227:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.22.227:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.25:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.25:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.95.50.27:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.38.171.82:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.38.171.82:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.4:49782 version: TLS 1.2

System Summary:

Source: classification engine

Classification label: mal80.phis.win@3/59@19/8

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7E770D03-7D33-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF9697AB0B8A418A42.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3492 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3492 CREDAT:17410 /prefetch:2	Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Windows\SysWOW64\Macromed\Flash\ss.cfg

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

ID:	363595
Product:	CloudBasic
Start time:	22:48:46
Start date:	04.03.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\E5F0NRSV\view.joomag[1].xml	ASCII text, with very long lines, with no line terminators	D66C0AC9AD591AF604109E7EBBE5D8D9	3F54B7C196CB1DAA41247448B8D94F1868DFE76B	D80FA2BCE5FE3396681C52E1437E2698A713172712F8302B0C0D176BECB0B6FD
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7E770D03-7D33-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	E19B9E9DA18A638FAC4C1C9C5AB79D16	4ABF4A5C6E8E0B3153354DBB5934761E022F07F7	2B81F6F10B015DD98BC2F8FC421E2727CA494FB6F8EFE2286A5669816D8D37B6
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7E770D05-7D33-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	571954E03C36DCEE83D36704A4BF1156	4EE592476BB9EE0CC055E89F1A6CFB26D6F006E3	5DE450158BCB8B43DCE85C4F3DAAF30BEE9574400BF047AED54A2021B1728CFD
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{84EB8697-7D33-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	146CB607D235A28EAFA32BD6250A3E46	5098275B0B15B731359744B6286205B39ECC2F1F	1C7E85163F5B01E4199A31E30F372EE9BD87E45D8489348CDAF2B98CE8161B62
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\gee00pr\imagestore.dat	data	14C3F70FB085768F54BFEE862D6E5145	4B84CF602AAA2D5C50A6707EA5B1DCF89C297082	14C87ABEBF9A91451CDD2EFC44D4CA381E408DCD5024DD9A1A646C40EB824B85
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\0291789001614882763[1].htm	HTML document, ASCII text, with very long lines	78FF6DD9DC275F12255D306E3185B2C8	2A317EF778FCBB84F7A4EF0A328763549B646363	05B73A0A832E0B0FC7399DBF1774E80CC6CACB83126C0BA8CB8D691B8789D4D5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\15.70ea2a8c03ea7ff25ab5[1].js	HTML document, UTF-8 Unicode text, with very long lines, with no line terminators	64991CAAC2AFC2D864D53F6F50F2AC5E	C6F0816D8E68E4F5D8912C5062A6D438F3B7675C	1C1AFECF3ECE6A0238218FE66E1EEB80F4A190FDFC5DA57B428AD730E4E576DB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\adobe[1].htm	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	8B525EE23344A0EE2B3EC02B5478500A	82443BF89D02DE9009D5E85A8C1D9725EE3020D3	4AF6302A1FB709D92E3C6242F0F5257C8964C0A0859BC9A328350895F6B0EB40
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\bootstrap.min[1].css	ASCII text, with very long lines	450FC463B8B1A349DF717056FBB3E078	895125A4522A3B10EE7ADA06EE6503587CBF95C5	2C0F3DCFE93D7E380C290FE4AB838ED8CADFF1596D62697F5444BE460D1F876D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\bootstrap.min[1].js	ASCII text, with very long lines	14D449EB8876FA55E1EF3C2CC52B0C17	A9545831803B1359CFEED47E3B4D6BAE68E40E99	E7ED36CEEE5450B4243BBC35188AFABDFB4280C7C57597001DE0ED167299B01B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\bundle.min[1].js	ASCII text, with very long lines	D33EF5731DB495D5A0AC66BB566032C2	EE1E5070EC879D17AE785F74B21C4E4E0F0F0597	85BB43DAE06F4D48B885E878395E5984A2AFB942FF778DFB8BDA87D8EB475BC8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\e2270d116b[1].js	ASCII text, with no line terminators	06DD80AEB628C60DC680BC7A4BEE6651	8C86EB7DDFF5E1E5D527BD7A41C9D3F6767E23E0	5E864C2E3F674C60970513411EAEEEAFD2D615D842E65EC01D09CCFCB4A7B38D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\favicon[1].ico	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	ADE8D9C3689EC45EA5DE1D9AF2537570	FF5D323C7B817F7246D6797D87F0DE4FD5C894E8	92FB6872A27431518F6C8374776CCF2218A09986EA3E3D2D9A86E80FD0FDAEB5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\jquery.min[1].js	ASCII text, with very long lines	2F6B11A7E914718E0290410E85366FE9	69BB69E25CA7D5EF0935317584E6153F3FD9A88C	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\nr-1198.min[1].js	ASCII text, with very long lines, with no line terminators	59C98195BA35E0B45CBE2E5BEEBD1AC8	BB1DD82667456B0B608750BBF8D2871A018535B0	39893061747F88B837A34D0395D05FCA83E7CD5BBF2D582D181A73C5C9A174C6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\olb8zpk[1].js	UTF-8 Unicode text, with very long lines	5076E0879850567ED8A5CE8D65F00DFD	1733D25CAF88876D3F6B44BFD04751E02AA717E3	B7F0115AFBD3505857C7A7515CBDFD9B595A750B8A0C576DB45992C2F87C0355
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\other1[1].png	PNG image data, 190 x 187, 8-bit/color RGBA, non-interlaced	6843A244E12FAB158AA189680B5E7049	0E1C691F87CC4FA35C88344974F2829C40176B70	3A9B144D6482B78AFC4E0A940A1D3C22240F14FA535B808CF4DAB9635339569F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\p[1].gif	GIF image data, version 89a, 1 x 1	81144D75B3E69E9AA2FA3E9D83A64D03	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\2420210[1].png	PNG image data, 180 x 45, 8-bit/color RGBA, non-interlaced	E1A55E85CB8B88AF96DDC9BBCC83E7A0	FF1549872E19ED1CEB5D2316DAD779F81F84F0A3	9588DCB72AC03F9D7386F8A602D75126751E22B8504FE4B9E19F3B62EBBA0524
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\585b051251[1].js	ASCII text, with very long lines	4B900F0AF3BBDA85E1077C8EC8C83831	7E7015965195F25AFA3A47BE2108278AD6A0A4AC	7943D6D067DB8587E9FB675F0D2CC78D6C90C91B187CF8642A3F52FF91381685
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\d[1]	Web Open Font Format, TrueType, length 59940, version 0.0	3AEB74FE14E1ACCAE157879343062A13	7A736AD47EE70212EEB9CD4179826F9CB8D55781	E3E487D6036BB95CCD6D97CA641B5FA6ED85FF93E11A5649C72534AF0DD272C3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\d[2]	Web Open Font Format, TrueType, length 60240, version 0.0	1E15B536F74EF394FCEC8470F8D64323	50942FD78ECBA94C12DA7E63866585B26CED24C5	4A4E9A7F3425D3D460A9FFC77A56391B62AF222391DB604B5924D90637549204
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\d[3]	Web Open Font Format, TrueType, length 61612, version 0.0	D26D2BAB4625361DA030917B4FA4CBF0	972FF9E8DF21F1CAE4B0ABA7C36577A72E18CD8A	5F8EE1622F6CDD2E3B343DB9BC25A58053C24959A7D72242E783ABD6C65A9070
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\d[4]	Web Open Font Format, TrueType, length 61728, version 0.0	C30498C311ECC433CB7CD23D32159AFC	F442B2B9EAAEE7FF71F57EBAA58734B4724FAC6A	9F46E13E2EC896C2461E4C55C7393A69F7E70D85276544AC2693C42F3BC1DC89
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\gmail[1].png	PNG image data, 1280 x 1280, 8-bit/color RGBA, non-interlaced	DCE2F2B0E50CB1DBB0246D152791CB46	D0A69C159304EDC08DB005163E7A0DAF5A1E98A6	ACF087C1757F08B0CFD53D59066544D7EF0BFCC50999E77C5813739CD9DC1479
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\gtm[1].js	ASCII text, with very long lines	0E9D06DCFA96E71097F3535428435C01	2A45A9C4F44394AB6DD0060A9981BAB8CBB2893B	7AF802FC329C950BD76D11EEC1DC93306F0C6688A9383B7016B0A6144BB1B736
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\main-sprite[1].png	PNG image data, 246 x 2285, 8-bit/color RGBA, non-interlaced	BFEE27F6F585496810D51DB33B21C6B0	241443D9422CB53B944748F7463DAADF16967BE0	37BB0DD1A742ABEBD521B9A2DB0860876258E6D07325204FFE6D569EAEC4602D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\main[1].svg	SVG Scalable Vector Graphics image	D430C0916334AD1ECEFE82B51BEABFAE	F60EC8720AC3047006A01F201A046B4D9867B3FD	0E891FE3D7FD17382D0AB63B6E0B95A3A92B90AA346379A77819B984DC8F5A87
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\office3651[1].png	PNG image data, 187 x 188, 8-bit/color RGBA, non-interlaced	FE22440D79FFA34950F512EF4A718B2A	0E147E59544EE6580D3095353D4420849FA5EB8A	A2F26B68A6C8810C1AEB4048C938F835A86BA83756A7A440F989B967E78F3BA8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\outlook1[1].png	PNG image data, 26 x 26, 8-bit/color RGBA, non-interlaced	C3FC46C5799C76F9107504028F39190F	519096AD3F03410CF9CE3C9B9FCCA6B439D97B23	57898461712A639D119BDF88B7145919DCC8956C7A271D2E4A1084B29EAE6785
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\8[1].jpg	[TIFF image data, big-endian, direntries=12, height=709, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=1200], baseline, precision 8, 1200x646, frames 3	F17B5B1163EFB6D2D47DE6BAE6D3A9CD	6D6964B34BC44C6D2B106ADE1AE675985B96D012	7829F065E0E10C8466F3D57766E0719421B7B652F6A1082F21B98702F1B28A30
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\analytics[1].js	ASCII text, with very long lines	6A10EB2BB5C90414980729F4F96FFBDA	8BBBD5948255549E4B691B614AA3177DEA9AF1B7	0F3BE44690AE9914AE3E47B7752E1BDEA316F09938E9094F99E0DE19CCD8987A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\css[1].css	ASCII text	04F7435B2672FBE66984EA436E7087C6	44896875E69B297EB979CC0D3E8522D872656BA8	F9088C15A062F0C7708C3864C5E261A2E4961DFEB0F150DF744FAEC2E3B74AD6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\en[1].js	ASCII text, with very long lines	CB366D30D8FCCFFC4D8BBA7691D448B8	52C9ACA8C89D7ED70531FAD3A46E79425C87B996	C9F8D111F907C656EB1915623CE51178DCB8027A555C8F8201B5BC3C58874AAE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\free-v4-shims.min[1].css	ASCII text, with very long lines	1848E71668F42835079E5FA2AF6CF4A8	6AE345E2FEB8C2A524E7CF9E22A3A87BAEE60593	D7CC3C57F9BDA4C6DCB83BB3C19F2F2AA86ECEC6274E243CD4EC315AE8E30101
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\free.min[1].css	ASCII text, with very long lines	4ECC071B77D6B1790FA9FB8A5173F972	B44FCBAAC4F3AA7381D71DE20064AC84B0B729D1	8C7BBA7DEB64FF95E98F7AC8CD0D3B675A4BCF02F302E57EDC5A1D6FA3D6CF94
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\html5-viewer-external[1].css	ASCII text, with very long lines, with no line terminators	A88A9B92156449D9653C68C43A6CE7AC	39FC272CE9382CA89FE8439341B52F797110A4C5	4921FE5BF8E8473256784688DD1CB2CC153272E66309F7271B8409F11FF0B524
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\joomag-pixel.3df7f73f177625835141[1].js	UTF-8 Unicode text, with very long lines, with LF, NEL line terminators	643599917A7FE230B0F5E5AD68528405	5C5D99185ABD4395603DD081987275F7A00429B9	1CE995D95A406CAFD36A2D5FD8F2D4AE63CB596113A8293FC731DC7B47668D43
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\magazine[1].js	HTML document, ASCII text, with very long lines	062D79DAC749FF4F8BDB0FEB3BA0F5D4	49FE94F61D094E122CFEF6898B27D0841FA645DB	86254DB9234149D12207619980E9FC9F2A68A7360518A027E662EA66244082E0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\main.2813cfbe59a2f8c75923[1].js	UTF-8 Unicode text, with very long lines, with no line terminators	8A6955AF4091942697C5DAC3912E9796	CAFB5ADF801CDBDA1FAA800A90DC04F1A004C578	EA0A7FBF305F7B0DABF67CBF27DE4223F1DD3C1E51976EAC1E2405E489987F7A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\main.867208e99122488d74f9a620279f9cd9[1].css	ASCII text, with very long lines, with no line terminators	867208E99122488D74F9A620279F9CD9	C24307613ADE7673A33350B663C0E0864A82F4C6	BC75594D9ACA2EF4A9806EB58734D67AF1E3540B58CBC3D39BA94C487E2695B7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\popper.min[1].js	ASCII text, with very long lines	70D3FDA195602FE8B75E0097EED74DDE	C3B977AA4B8DFB69D651E07015031D385DED964B	A52F7AA54D7BCAAFA056EE0A050262DFC5694AE28DEE8B4CAC3429AF37FF0D66
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\vendor.7bc4df7aaac8424047c3[1].js	HTML document, UTF-8 Unicode text, with very long lines, with no line terminators, with escape sequences	42690687B144654E18A4697D09D27891	7A32BD488D27FB727BAA6C89422047C704CD2FB3	C6A86343582954B195FD2F3D0DB29C69E886D7CC165607FEAA84B08E4EBCADA8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\0_3-0[1].svg	SVG Scalable Vector Graphics image	9C23D0C46DA7E074B8EEDAF7DCEA2761	DF657799BC7B97E92C97B177791AD371B5F72E89	256D409AFAC730FA0CDE8BAFB409134E105BD96B10D247C37434589826C62DB4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\adobe[1].jpg	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 400x400, frames 3	BE5274AF7D8BD25B8148A190FF515399	B8D0850FD92EE935287E17988B89E53607808C8C	26C62DBDF527B8DCBF378EA62F129CBBBA3B244730687909BA21ECD729C9D2E6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\d[1]	Web Open Font Format, TrueType, length 58272, version 0.0	25EB786C99DB8F58DF013C81F8F14C0D	83FDDE6AC8D51CAD2BDF8C33813FEE6BA34002A7	054E8C55D84A3EBFF0722AB57AB4A00BB60736DCFF97B81401019D714FFAF688
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\d[2]	Web Open Font Format, TrueType, length 55916, version 0.0	642BF1228C9D1BCF62992C08DF8A92B8	05DA82C550C25254ACA29DAD238EABCFC149BF9C	036F00B2C16BD1CA74B5384DE15D04214CC005A4476BF4A6291AD29D39885BAF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\e2270d116b[1].gif	GIF image data, version 89a, 1 x 1	BC32ED98D624ACB4008F986349A20D26	2D3DF8C11D2168CE2C27E0937421D11D85016361	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\hover[1].css	ASCII text	FAC4178C15E5A86139C662DAFC809501	EF1481841399156A880EC31B07DDA9CFAA1ACE39	BB88454962767EB6F2DDB1AABAAF844D8A57DE7E8F848D7F6928F81B54998452
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\jquery-3.1.1.min[1].js	ASCII text, with very long lines	E071ABDA8FE61194711CFC2AB99FE104	F647A6D37DC4CA055CED3CF64BBC1F490070ACBA	85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\jquery-3.2.1.slim.min[1].js	ASCII text, with very long lines	5F48FC77CAC90C4778FA24EC9C57F37D	9E89D1515BC4C371B86F4CB1002FD8E377C1829F	9365920887B11B33A3DC4BA28A0F93951F200341263E3B9CEFD384798E4BE398
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\loader[1].gif	GIF image data, version 89a, 78 x 78	54B0F6D2BD07F8D35FE2EFDC7E2F6FFB	D8458F47CC95F901AB3A14AED4554BF162EDFE87	3CDDF3FCB8717496F1D00EC6AB00CF6023C7E62F54B682D14BA0B9F0828892F3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\manifest.8e10809dba1c553a5a2a[1].js	ASCII text, with very long lines, with no line terminators	887DBE06F165DF34F6D0AF1DE2676BAB	50EA3408C3927B158B5D857559670DB502FB8B44	C9D6F1138493170765AAEE432342BCD8A0424FC3A44B179E385B1133DBA819AF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\normalize.d0dfb984f88d0dbb9fde[1].js	ASCII text, with very long lines, with no line terminators	3453C3FA8930DEFC531DEF3B9A6B593B	88C3B2A4F49600F3D8462A1C928C5ED0E975AF47	1442E8E49EC12B7CDE355CE5CBC3A6D0CDD47BA5D035FE927E8F204326E64B9C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\ping[1].htm	ASCII text, with no line terminators	6FDB087AA3FBFBCB8287A593A0919E61	0E514A0662BCB69DC863953D1CE26E3D40E81A87	9795C5FF8937F23526CCB207A5684C1FC94A7854E19C021B39D944E51F5BAEF2
C:\Users\user\AppData\Local\Temp\~DF9697AB0B8A418A42.TMP	data	9AC6D7E94AB01DEB8163A89B51434184	FA2343EC4899F3E0D3803CAF9D982A46434D43AB	2475F3358FBBA56EA68A7CF6DD00310BA82B3D47AE586E64C4DB14C78F9F1ABA
C:\Users\user\AppData\Local\Temp\~DFA3DE0DB72D585233.TMP	data	AB889A32AB9ACD33E816C2422337C69A	1190C6B34DED2D295827C2A88310D10A8B90B59B	4D6EC54B8D244E63B0F04FBE2B97402A3DF722560AD12F218665BA440F4CEFDA
C:\Users\user\AppData\Local\Temp\~DFF8E1FCFAEB5B2E87.TMP	data	9834AE45D49B772E8E9F866D3560470C	8B38E3554477FEA7C7A7F956749B2EC23D6891AD	235641FD6AB383F7D3C3D3C7B693AADEF483D161D07C75F0AA02CE27BE34B79C
C:\Users\user\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx	data	AAD3AF9484B3DC05F1964D58D3E6E947	ADC9439E7CAE1B3351D048167EF2969029A1EA85	FF5B87881863AE143AA8AF9308AE7266A540A5B6F6EDE58D533FFD3E5600E551

Analysis Report https://joom.ag/jSeI

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Phishing:

Compliance:

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs