Analysis Report http://covid19.iqwasithealth.com/jillian-ratke-iii/kathy_edler-43.zip

Overview

General Information

Sample URL: http://covid19.iqwasithealth.com/jillian-ratke-iii/kathy_edler-43.zip
Analysis ID: 426544
Infos:

Most interesting Screenshot:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for domain / URL

Classification

AV Detection:

barindex
Multi AV Scanner detection for domain / URL
Source: covid19.iqwasithealth.com Virustotal: Detection: 5% Perma Link
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 52.29.153.112:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.29.153.112:443 -> 192.168.2.3:49722 version: TLS 1.2
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 28 May 2021 23:26:50 GMTServer: ApacheVary: Accept-EncodingContent-Encoding: gziphost-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==Content-Length: 497Keep-Alive: timeout=5, max=74Connection: Keep-AliveContent-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 9d 52 cb 8e d4 30 10 bc cf 57 f4 fa c0 01 36 c9 30 70 40 90 04 b4 0b 48 9c 16 89 41 88 d3 aa 63 f7 c4 d6 fa 85 ed 4c 94 1b bf c1 ef ed 97 e0 cc 8b 81 b9 71 4a b9 5d ae aa ee 4e 7d f5 fe ee 76 fd fd f3 07 90 c9 e8 76 51 cf 1f d0 68 fb 86 91 65 ed 62 01 50 4b 42 d1 66 90 a1 a1 84 c0 25 86 48 a9 61 5f d7 1f 8b 57 ec fc ca a2 a1 86 6d 15 8d de 85 c4 80 3b 9b c8 66 ea a8 44 92 8d a0 ad e2 54 ec 0e d7 a0 ac 4a 0a 75 11 39 6a 6a 9e 97 cb a3 94 56 f6 01 02 e9 86 c5 34 69 8a 92 28 6b c9 40 9b 86 55 55 a7 07 92 2e a6 82 0b 5b 72 67 2a 43 42 61 35 44 0a 55 1c a2 27 2b 48 dc 23 e7 6e b0 a9 ba ef e4 9f 6a c9 63 bc 34 f1 81 72 4e 4b fc cc 64 93 83 c7 b2 8f 09 93 e2 b3 cb 5f cf fe 61 39 d7 6b 42 af e2 2e 4e f6 58 bd dd a0 51 7a 6a ee b2 ef b3 2f 68 e3 eb b1 97 e9 dd 8b e5 f2 cd cb e5 f2 89 50 d1 6b 9c 9a 38 a2 67 17 9d ce 4e 75 b5 9f fa 0c 3b 27 a6 83 bb 50 db 3d ca 58 99 1e b8 c6 18 f3 e3 7d 83 85 97 2e 39 06 31 f0 ff 1b 54 47 1d f2 87 22 3a 67 4b 6f 7b 06 a8 f3 ee 6e 08 e6 32 cc 65 d8 5b 9c 42 c8 d5 31 43 47 c5 cc 62 ed 39 fd 2a f7 b1 3a 91 fd 91 3b 52 17 55 a2 c2 b8 2d 09 d6 ae a5 8a 70 a8 41 86 43 0e 16 c0 a0 9a 7f 1e b4 9c ca ba ea 42 7b 2b 29 cb ee b4 93 33 2e 04 37 66 7d 7f 92 9f 39 17 56 3f 06 8a 49 39 9b f7 fe f4 d3 06 26 37 3c fe fc 15 08 92 24 70 a3 cd 3e 6e 93 0f 67 01 d0 0a 90 b8 25 38 3d bd ce 2b 42 2e c1 0d 29 3b c3 cd 61 ae 25 7c a3 bd 98 44 ef a7 f9 4a 92 f6 e5 29 53 5d 1d f6 95 a3 ed 76 b8 c8 e3 48 46 b7 8b df 9a 24 1b 73 78 03 00 00 Data Ascii: R0W60p@HAcLqJ]N}vvQhebPKBf%Ha_Wm;fDTJu9jjV4i(k@UU.[rg*CBa5DU'+H#njc4rNKd_a9kB.NXQzj/hPk8gNu;'P=X}.91TG":gKo{n2e[B1CGb9*:;RU-pACB{+)3.7f}9V?I9&7<$p>ng%8=+B.);a%|DJ)S]vHF$sx
Source: global traffic HTTP traffic detected: GET /jillian-ratke-iii/kathy_edler-43.zip HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: covid19.iqwasithealth.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: covid19.iqwasithealth.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /media/user/suspended_account/_bh/beback-soon.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: http://covid19.iqwasithealth.com/cgi-sys/suspendedpage.cgiAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: bluehost-cdn.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /media/user/suspended_account/_bh/suspended.css HTTP/1.1Accept: text/css, */*Referer: http://covid19.iqwasithealth.com/cgi-sys/suspendedpage.cgiAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: bluehost-cdn.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: covid19.iqwasithealth.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1User-Agent: AutoItHost: covid19.iqwasithealth.com
Source: msapplication.xml0.2.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x729530cf,0x01d75464</date><accdate>0x729530cf,0x01d75464</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.2.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x729530cf,0x01d75464</date><accdate>0x729530cf,0x01d75464</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.2.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x7299f579,0x01d75464</date><accdate>0x7299f579,0x01d75464</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.2.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x7299f579,0x01d75464</date><accdate>0x7299f579,0x01d75464</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.2.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x7299f579,0x01d75464</date><accdate>0x7299f579,0x01d75464</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.2.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x7299f579,0x01d75464</date><accdate>0x7299f579,0x01d75464</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: unknown DNS traffic detected: queries for: covid19.iqwasithealth.com
Source: ~DF2D0378F71AA387A3.TMP.2.dr String found in binary or memory: http://covid19.iqwasithealth.com/cgi-sys/suspendedpage.cgi
Source: {9C23E857-C057-11EB-90E4-ECF4BB862DED}.dat.2.dr String found in binary or memory: http://covid19.iqwasithealth.com/cgi-sys/suspendedpage.cgiRoot
Source: css2[1].css.3.dr String found in binary or memory: http://fonts.gstatic.com/s/opensans/v20/mem5YaGs126MiZpBA-UN_r8-Vg.woff)
Source: css2[1].css.3.dr String found in binary or memory: http://fonts.gstatic.com/s/opensans/v20/mem8YaGs126MiZpBA-U1UQ.woff)
Source: msapplication.xml.2.dr String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.2.dr String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.2.dr String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.2.dr String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.2.dr String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.2.dr String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.2.dr String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.2.dr String found in binary or memory: http://www.youtube.com/
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown HTTPS traffic detected: 52.29.153.112:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.29.153.112:443 -> 192.168.2.3:49722 version: TLS 1.2
Source: classification engine Classification label: mal48.win@3/23@3/2
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DF0730CF74CFD88E68.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5464 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5464 CREDAT:17410 /prefetch:2 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 426544 URL: http://covid19.iqwasithealt... Startdate: 29/05/2021 Architecture: WINDOWS Score: 48 12 covid19.iqwasithealth.com 2->12 18 Multi AV Scanner detection for domain / URL 2->18 7 iexplore.exe 2 83 2->7         started        signatures3 process4 process5 9 iexplore.exe 2 43 7->9         started        dnsIp6 14 covid19.iqwasithealth.com 50.87.248.41, 49716, 49717, 49734 UNIFIEDLAYER-AS-1US United States 9->14 16 bluehost-cdn.com 52.29.153.112, 443, 49718, 49719 AMAZON-02US United States 9->16
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
52.29.153.112
 bluehost-cdn.com United States
16509 AMAZON-02US false
50.87.248.41
 covid19.iqwasithealth.com United States
46606 UNIFIEDLAYER-AS-1US true

Contacted Domains

Name IP Active
covid19.iqwasithealth.com 50.87.248.41 true
bluehost-cdn.com 52.29.153.112 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://covid19.iqwasithealth.com/cgi-sys/suspendedpage.cgi true
    		unknown
    http://bluehost-cdn.com/media/user/suspended_account/_bh/suspended.css false
    • Avira URL Cloud: safe
    		 unknown
    http://covid19.iqwasithealth.com/favicon.ico true
    • Avira URL Cloud: safe
    		 unknown
    http://covid19.iqwasithealth.com/cgi-sys/suspendedpage.cgi true
      		unknown
      http://covid19.iqwasithealth.com/jillian-ratke-iii/kathy_edler-43.zip true
        		unknown
        http://bluehost-cdn.com/media/user/suspended_account/_bh/beback-soon.png false
        • Avira URL Cloud: safe
        		 unknown