Analysis Report https://www.golfcoronado.com/

Overview

General Information

Sample URL: https://www.golfcoronado.com/
Analysis ID: 385660
Infos:

Most interesting Screenshot:

Detection

Score: 1
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
HTML title does not match URL
Submit button contains javascript call

Classification

Phishing:

barindex
HTML title does not match URL
Source: https://www.golfcoronado.com/tournaments HTTP Parser: Title: Tournaments does not match URL
Source: https://www.golfcoronado.com/tournaments HTTP Parser: Title: Tournaments does not match URL
Submit button contains javascript call
Source: https://www.golfcoronado.com/tournaments HTTP Parser: On click: RSFormPro.YUICalendar.showHideCalendar('cal2_0Container');
Source: https://www.golfcoronado.com/tournaments HTTP Parser: On click: RSFormPro.YUICalendar.showHideCalendar('cal2_0Container');
Source: https://www.golfcoronado.com/tournaments HTTP Parser: No <meta name="copyright".. found
Source: https://www.golfcoronado.com/tournaments HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 69.167.161.101:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 69.167.161.101:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown HTTPS traffic detected: 69.167.161.119:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown HTTPS traffic detected: 69.167.161.119:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown HTTPS traffic detected: 69.167.161.119:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 69.167.161.119:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown HTTPS traffic detected: 69.167.161.119:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.32.25.34:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.32.25.34:443 -> 192.168.2.6:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 69.167.161.101:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown DNS traffic detected: queries for: www.golfcoronado.com
Source: calendar[1].js.3.dr String found in binary or memory: http://developer.yahoo.com/yui/license.html
Source: calendar[1].css.3.dr String found in binary or memory: http://developer.yahoo.net/yui/license.txt
Source: script[1].js0.3.dr String found in binary or memory: http://kevin.vanzonneveld.net
Source: script[1].js0.3.dr String found in binary or memory: http://kevin.vanzonneveld.net)
Source: social[1].js.3.dr String found in binary or memory: http://twitter.com/share
Source: webcam[1].htm.3.dr String found in binary or memory: http://www.1-2-1marketing.com
Source: KFOmCnqEu92Fr1Mu4mxP[1].ttf.3.dr, KFOlCnqEu92Fr1MmEU9fBBc9[1].ttf.3.dr, KFOlCnqEu92Fr1MmYUtfBBc9[1].ttf.3.dr String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: bootstrap.min[1].js.3.dr String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.txt
Source: juniors[1].jpg.3.dr String found in binary or memory: http://www.dreamstime.com/royalty-free-stock-photos-kids-golf-competition-children-posing-near-car-c
Source: junior_golf[1].jpg.3.dr String found in binary or memory: http://www.dreamstime.com/stock-images-kids-golf-competition-children-playing-taking-part-course-sum
Source: uikit2-2143e9f4[1].js.3.dr String found in binary or memory: http://www.getuikit.com
Source: junior-golf[1].htm.3.dr String found in binary or memory: http://www.girlsgolf.org
Source: jcemediabox.min[1].js.3.dr String found in binary or memory: http://www.gnu.org/licenses/gpl-2.0.html
Source: acymailing_module[1].js.3.dr String found in binary or memory: http://www.gnu.org/licenses/gpl-3.0.html
Source: social[1].js.3.dr String found in binary or memory: http://www.gnu.org/licenses/gpl.html
Source: 622COIJN.htm.3.dr String found in binary or memory: http://www.golfchannel.com/media?guid=9VqDBlqa25FOw9wVpJgZYptJ_R_tRmh2
Source: 622COIJN.htm.3.dr String found in binary or memory: http://www.golfcoronado.com/25-uncategorized/17-welcome
Source: PGA-Profile-Coronado[1].pdf.3.dr String found in binary or memory: http://www.sdjuniorclub.com)
Source: bootstrap[1].css.3.dr String found in binary or memory: http://www.yootheme.com/license)
Source: analytics[1].js.3.dr String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: 622COIJN.htm.3.dr String found in binary or memory: https://campaignpilot.com/plugins/campaignpilot.js
Source: recaptcha__en_gb[1].js.3.dr String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: recaptcha__en_gb[1].js.3.dr String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: recaptcha__en_gb[1].js.3.dr String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: 622COIJN.htm.3.dr String found in binary or memory: https://feastandfarewaycoronado.com/
Source: bootstrap[1].css.3.dr String found in binary or memory: https://fonts.googleapis.com/css?family=Montserrat
Source: bootstrap[1].css.3.dr String found in binary or memory: https://fonts.googleapis.com/css?family=Noto
Source: css[1].css0.3.dr String found in binary or memory: https://fonts.gstatic.com/s/fjallaone/v8/Yq6R-LCAWCX3-6Ky7FAFrOF6lA.woff)
Source: css[1].css0.3.dr String found in binary or memory: https://fonts.gstatic.com/s/lora/v17/0QI6MX1D_JOuGQbT0gvTJPa787weuxJBkqs.woff)
Source: css[1].css0.3.dr String found in binary or memory: https://fonts.gstatic.com/s/lora/v17/0QI6MX1D_JOuGQbT0gvTJPa787z5vBJBkqs.woff)
Source: css[2].css.3.dr String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v15/JTUSjIg1_i6t8kCHKm459WlhzQ.woff)
Source: css[1].css0.3.dr String found in binary or memory: https://fonts.gstatic.com/s/muli/v22/7Aulp_0qiz-aVz7u3PJLcUMYOFkQl0k30e4.woff)
Source: css[1].css0.3.dr String found in binary or memory: https://fonts.gstatic.com/s/muli/v22/7Aulp_0qiz-aVz7u3PJLcUMYOFkpl0k30e4.woff)
Source: css[1].css0.3.dr String found in binary or memory: https://fonts.gstatic.com/s/muli/v22/7Aulp_0qiz-aVz7u3PJLcUMYOFmQkEk30e4.woff)
Source: css[1].css0.3.dr String found in binary or memory: https://fonts.gstatic.com/s/muli/v22/7Aulp_0qiz-aVz7u3PJLcUMYOFnOkEk30e4.woff)
Source: css[1].css.3.dr String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v9/ga6Iaw1J5X9T9RW6j9bNfFcWbg.woff)
Source: css[1].css.3.dr String found in binary or memory: https://fonts.gstatic.com/s/notoserif/v9/ga6Kaw1J5X9T9RW6j9bNfFImajC9.woff)
Source: AcroRd32.exe, 00000008.00000003.408522785.0000000009502000.00000004.00000001.sdmp String found in binary or memory: https://ims-na1.adobelogin.com
Source: recaptcha__en_gb[1].js.3.dr String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: analytics[1].js.3.dr String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: recaptcha__en_gb[1].js.3.dr String found in binary or memory: https://support.google.com/recaptcha
Source: recaptcha__en_gb[1].js.3.dr String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: recaptcha__en_gb[1].js.3.dr String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: recaptcha__en_gb[1].js.3.dr String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: analytics[1].js.3.dr String found in binary or memory: https://tagassistant.google.com/
Source: {BCC0B376-9C01-11EB-90E5-ECF4BB2D2496}.dat.2.dr String found in binary or memory: https://www.golfcoronado.
Source: {BCC0B376-9C01-11EB-90E5-ECF4BB2D2496}.dat.2.dr String found in binary or memory: https://www.golfcoronado.Root
Source: webcam[1].htm.3.dr String found in binary or memory: https://www.golfcoronado.com
Source: ~DF9BE3C77B1405F18B.TMP.2.dr, {BCC0B376-9C01-11EB-90E5-ECF4BB2D2496}.dat.2.dr String found in binary or memory: https://www.golfcoronado.com/
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.golfcoronado.com/#tm-top-a
Source: {BCC0B376-9C01-11EB-90E5-ECF4BB2D2496}.dat.2.dr String found in binary or memory: https://www.golfcoronado.com/FCoronado
Source: {BCC0B376-9C01-11EB-90E5-ECF4BB2D2496}.dat.2.dr String found in binary or memory: https://www.golfcoronado.com/Root
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.golfcoronado.com/course-info/course-information
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.golfcoronado.com/course-info/course-information$Course
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.golfcoronado.com/course-info/rates
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.golfcoronado.com/course-info/ratesinformation
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.golfcoronado.com/course-info/webcam
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.golfcoronado.com/course-info/webcaminformation
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.golfcoronado.com/course-info/webcaminformations
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.golfcoronado.com/course-info/webcaminformation~
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.golfcoronado.com/images/PGA-Profile-Coronado.pdf
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.golfcoronado.com/instruction/adult-group-lessons
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.golfcoronado.com/instruction/adult-group-lessons&Adult
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.golfcoronado.com/instruction/adult-group-lessonsF
Source: ~DF9BE3C77B1405F18B.TMP.2.dr, golf-pro-bios[1].htm.3.dr String found in binary or memory: https://www.golfcoronado.com/instruction/golf-pro-bios
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.golfcoronado.com/instruction/junior-golf
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.golfcoronado.com/instruction/junior-golfessons
Source: ~DF9BE3C77B1405F18B.TMP.2.dr, lesson-rates[1].htm.3.dr String found in binary or memory: https://www.golfcoronado.com/instruction/lesson-rates
Source: 622COIJN.htm.3.dr String found in binary or memory: https://www.golfcoronado.com/media/com_acymailing/css/module_default.css?v=1573072179
Source: 622COIJN.htm.3.dr String found in binary or memory: https://www.golfcoronado.com/media/com_acymailing/js/acymailing_module.js?v=51010
Source: imagestore.dat.3.dr String found in binary or memory: https://www.golfcoronado.com/templates/yoo_avanti/favicon.ico~
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.golfcoronado.com/tm-top-a
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.golfcoronado.com/tm-top-a.com/#tm-top-a
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.golfcoronado.com/tournaments
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.golfcoronado.com/tournamentsunior-golfessons
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.golfcoronado.com/tournamentsunior-golfessonsr
Source: course-information[1].htm.3.dr String found in binary or memory: https://www.golfsandiego.com/welcome-coronado-golfers?utm_source=CoronadoGC_website&amp;utm_medium=l
Source: 622COIJN.htm.3.dr, ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.golfsandiego.com/welcome-coronado-golfers?utm_source=CoronadoGC_website&utm_medium=link&
Source: analytics[1].js.3.dr String found in binary or memory: https://www.google-analytics.com/debug/bootstrap
Source: analytics[1].js.3.dr String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: analytics[1].js.3.dr String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: recaptcha__en_gb[1].js.3.dr String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: 622COIJN.htm.3.dr String found in binary or memory: https://www.google.com/recaptcha/api.js?onload=JoomlaInitReCaptcha2&render=explicit&hl=en-GB
Source: bframe[1].htm.3.dr, api[1].js.3.dr, recaptcha__en_gb[1].js.3.dr, anchor[1].htm0.3.dr String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeR_R8UAAAAAA0VG_vkkJuI1o5wkHexvzimAWK0&co=aHR0
Source: ~DF9BE3C77B1405F18B.TMP.2.dr String found in binary or memory: https://www.google.com/recaptcha/api2/bframe?hl=en-GB&v=539Evs44yecoSf-lkJBQzKKj&k=6LeR_R8UAAAAAA0VG
Source: analytics[1].js.3.dr String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: bframe[1].htm.3.dr, webworker[1].js.3.dr, api[1].js.3.dr, anchor[1].htm0.3.dr String found in binary or memory: https://www.gstatic.com/recaptcha/releases/539Evs44yecoSf-lkJBQzKKj/recaptcha__en_gb.js
Source: bframe[1].htm.3.dr, anchor[1].htm0.3.dr String found in binary or memory: https://www.gstatic.com/recaptcha/releases/539Evs44yecoSf-lkJBQzKKj/styles__ltr.css
Source: jcemediabox.min[1].js.3.dr String found in binary or memory: https://www.joomlacontenteditor.net
Source: adult-group-lessons[1].htm.3.dr String found in binary or memory: https://www.smarterlessons.com/
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 69.167.161.101:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 69.167.161.101:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown HTTPS traffic detected: 69.167.161.119:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown HTTPS traffic detected: 69.167.161.119:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown HTTPS traffic detected: 69.167.161.119:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 69.167.161.119:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown HTTPS traffic detected: 69.167.161.119:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.32.25.34:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.32.25.34:443 -> 192.168.2.6:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 69.167.161.101:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: classification engine Classification label: clean1.win@7/126@4/3
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BCC0B374-9C01-11EB-90E5-ECF4BB2D2496}.dat Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DF71F77B353CF93854.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5624 CREDAT:17410 /prefetch:2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' /o /eo /l /b /ac /id 6108
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 /o /eo /l /b /ac /id 6108
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5624 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' /o /eo /l /b /ac /id 6108 Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 /o /eo /l /b /ac /id 6108 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Anti Debugging:

barindex
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Code function: 8_2_05187110 LdrInitializeThunk, 8_2_05187110
Source: AcroRd32.exe, 00000008.00000002.414484031.0000000005B80000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: AcroRd32.exe, 00000008.00000002.414484031.0000000005B80000.00000002.00000001.sdmp Binary or memory string: Progman
Source: AcroRd32.exe, 00000008.00000002.414484031.0000000005B80000.00000002.00000001.sdmp Binary or memory string: &Program Manager
Source: AcroRd32.exe, 00000008.00000002.414484031.0000000005B80000.00000002.00000001.sdmp Binary or memory string: Progmanlock
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 385660 URL: https://www.golfcoronado.com/ Startdate: 12/04/2021 Architecture: WINDOWS Score: 1 17 www.golfcoronado.com 2->17 19 golfcoronado.com 2->19 8 iexplore.exe 5 56 2->8         started        process3 process4 10 iexplore.exe 2 154 8->10         started        dnsIp5 21 golfcoronado.com 69.167.161.101, 443, 49716, 49717 LIQUIDWEBUS United States 10->21 23 demo.1-2-1marketing.com 69.167.161.119, 443, 49721, 49722 LIQUIDWEBUS United States 10->23 25 2 other IPs or domains 10->25 13 AcroRd32.exe 22 10->13         started        process6 process7 15 AcroRd32.exe 5 13->15         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
69.167.161.101
 golfcoronado.com United States
32244 LIQUIDWEBUS false
13.32.25.34
 campaignpilot.com United States
7018 ATT-INTERNET4US false
69.167.161.119
 demo.1-2-1marketing.com United States
32244 LIQUIDWEBUS false

Contacted Domains

Name IP Active
demo.1-2-1marketing.com 69.167.161.119 true
campaignpilot.com 13.32.25.34 true
golfcoronado.com 69.167.161.101 true
www.golfcoronado.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://www.golfsandiego.com/welcome-coronado-golfers?utm_source=CoronadoGC_website&utm_medium=link&utm_campaign=CoronadoGC_referrals false
    		unknown
    https://www.golfcoronado.com/ false
      		high
      https://www.golfcoronado.com/course-info/webcam false
        		high
        https://www.golfcoronado.com/instruction/lesson-rates false
          		high
          https://www.golfcoronado.com/course-info/rates false
            		high
            https://www.golfcoronado.com/instruction/junior-golf false
              		high
              https://www.golfcoronado.com/#tm-top-a false
                		high
                https://www.golfcoronado.com/instruction/golf-pro-bios false
                  		high
                  https://www.golfcoronado.com/course-info/course-information false
                    		high
                    https://www.golfcoronado.com/tournaments false
                      		high
                      https://www.golfcoronado.com/instruction/adult-group-lessons false
                        		high