Analysis Report https://kezenelectric.ca/First-America

Overview

General Information

Sample URL: https://kezenelectric.ca/First-America
Analysis ID: 432851
Infos:

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 64
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Yara detected HtmlPhish10
HTML body contains low number of good links
HTML title does not match URL
Suspicious form URL found

Classification

AV Detection:

barindex
Antivirus / Scanner detection for submitted sample
Source: https://kezenelectric.ca/First-America SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering
Antivirus detection for URL or domain
Source: https://kezenelectric.ca/First-America/ SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

barindex
Yara detected HtmlPhish10
Source: Yara match File source: 84161.pages.csv, type: HTML
HTML body contains low number of good links
Source: https://kezenelectric.ca/First-America/ HTTP Parser: Number of links: 1
Source: https://kezenelectric.ca/First-America/ HTTP Parser: Number of links: 1
HTML title does not match URL
Source: https://kezenelectric.ca/First-America/ HTTP Parser: Title: First American Title Company - Office365 does not match URL
Source: https://kezenelectric.ca/First-America/ HTTP Parser: Title: First American Title Company - Office365 does not match URL
Suspicious form URL found
Source: https://kezenelectric.ca/First-America/ HTTP Parser: Form action: index2.php
Source: https://kezenelectric.ca/First-America/ HTTP Parser: Form action: index2.php
Source: https://kezenelectric.ca/First-America/ HTTP Parser: No <meta name="author".. found
Source: https://kezenelectric.ca/First-America/ HTTP Parser: No <meta name="author".. found
Source: https://kezenelectric.ca/First-America/ HTTP Parser: No <meta name="copyright".. found
Source: https://kezenelectric.ca/First-America/ HTTP Parser: No <meta name="copyright".. found
Source: unknown HTTPS traffic detected: 104.129.24.42:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.154.247.12:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.70.177.74:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.70.177.74:443 -> 192.168.2.4:49866 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.208.111.117:443 -> 192.168.2.4:49909 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.208.111.117:443 -> 192.168.2.4:49910 version: TLS 1.2
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: kezenelectric.caConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2018/11/LOGO-300x179.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: kezenelectric.ca
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2018/11/CCC.jpg HTTP/1.1Host: kezenelectric.caConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2018/11/index-300x117.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: kezenelectric.ca
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2018/11/CCC.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: kezenelectric.ca
Source: unknown DNS traffic detected: queries for: kezenelectric.ca
Source: 77EC63BDA74BD0D0E0426DC8F8008506.1.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Current Session.0.dr String found in binary or memory: http://kezenelectric.ca/
Source: History-journal.0.dr String found in binary or memory: http://kezenelectric.ca/Kezen
Source: 7646c7fe-eb7f-4111-baed-47a93160456f.tmp.1.dr, manifest.json0.0.dr, 02be7372-55df-4983-b6ff-7018cbaa805c.tmp.1.dr String found in binary or memory: https://accounts.google.com
Source: 7646c7fe-eb7f-4111-baed-47a93160456f.tmp.1.dr, manifest.json0.0.dr, 02be7372-55df-4983-b6ff-7018cbaa805c.tmp.1.dr String found in binary or memory: https://apis.google.com
Source: 7646c7fe-eb7f-4111-baed-47a93160456f.tmp.1.dr, 02be7372-55df-4983-b6ff-7018cbaa805c.tmp.1.dr String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 7646c7fe-eb7f-4111-baed-47a93160456f.tmp.1.dr, 02be7372-55df-4983-b6ff-7018cbaa805c.tmp.1.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: 7646c7fe-eb7f-4111-baed-47a93160456f.tmp.1.dr String found in binary or memory: https://content-autofill.googleapis.com
Source: manifest.json0.0.dr String found in binary or memory: https://content.googleapis.com
Source: Reporting and NEL.1.dr String found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external
Source: 3085c1ef-01c8-4cfa-a8dd-fb9b1ffb49ad.tmp.1.dr, 7646c7fe-eb7f-4111-baed-47a93160456f.tmp.1.dr, 02be7372-55df-4983-b6ff-7018cbaa805c.tmp.1.dr, 9a88bfbb-e9d5-4757-8815-bb24bda897a2.tmp.1.dr String found in binary or memory: https://dns.google
Source: manifest.json0.0.dr String found in binary or memory: https://feedback.googleusercontent.com
Source: 7646c7fe-eb7f-4111-baed-47a93160456f.tmp.1.dr, 02be7372-55df-4983-b6ff-7018cbaa805c.tmp.1.dr String found in binary or memory: https://fonts.googleapis.com
Source: Network Action Predictor.0.dr String found in binary or memory: https://fonts.googleapis.com/
Source: manifest.json0.0.dr String found in binary or memory: https://fonts.googleapis.com;
Source: 7646c7fe-eb7f-4111-baed-47a93160456f.tmp.1.dr, 02be7372-55df-4983-b6ff-7018cbaa805c.tmp.1.dr String found in binary or memory: https://fonts.gstatic.com
Source: Network Action Predictor.0.dr String found in binary or memory: https://fonts.gstatic.com/
Source: manifest.json0.0.dr String found in binary or memory: https://fonts.gstatic.com;
Source: 5278677776ece701_0.0.dr String found in binary or memory: https://google.com/;
Source: manifest.json0.0.dr String found in binary or memory: https://hangouts.google.com/
Source: 7646c7fe-eb7f-4111-baed-47a93160456f.tmp.1.dr String found in binary or memory: https://kezenelectric.ca
Source: 06aba3ef4a05b1d3_0.0.dr String found in binary or memory: https://kezenelectric.ca/
Source: Current Session.0.dr, History-journal.0.dr String found in binary or memory: https://kezenelectric.ca/First-America
Source: Current Session.0.dr, Favicons-journal.0.dr String found in binary or memory: https://kezenelectric.ca/First-America/
Source: Current Session.0.dr String found in binary or memory: https://kezenelectric.ca/First-America/(First
Source: History Provider Cache.0.dr String found in binary or memory: https://kezenelectric.ca/First-America/2(First
Source: History-journal.0.dr String found in binary or memory: https://kezenelectric.ca/First-America/First
Source: Current Session.0.dr String found in binary or memory: https://kezenelectric.ca/First-America/index2.php
Source: History Provider Cache.0.dr String found in binary or memory: https://kezenelectric.ca/First-America2(First
Source: History-journal.0.dr String found in binary or memory: https://kezenelectric.ca/First-AmericaFirst
Source: History-journal.0.dr String found in binary or memory: https://kezenelectric.ca/First-AmericaM
Source: Favicons-journal.0.dr String found in binary or memory: https://kezenelectric.ca/First-Americak
Source: Current Session.0.dr String found in binary or memory: https://kezenelectric.ca/First-Americal
Source: History-journal.0.dr String found in binary or memory: https://kezenelectric.ca/Kezen
Source: c27291f84aa51d71_0.0.dr String found in binary or memory: https://kezenelectric.ca/Wc
Source: Current Session.0.dr String found in binary or memory: https://kezenelectric.ca/exec/fd_helpWin?topic=8
Source: Current Session.0.dr String found in binary or memory: https://kezenelectric.ca/exec/fd_helpWin?topic=8#main
Source: Current Session.0.dr String found in binary or memory: https://kezenelectric.ca/exec/fd_helpWin?topic=8#maintHZQ
Source: Favicons-journal.0.dr String found in binary or memory: https://kezenelectric.ca/favicon.ico
Source: Current Session.0.dr String found in binary or memory: https://kezenelectric.ca/home/about-us/
Source: History-journal.0.dr String found in binary or memory: https://kezenelectric.ca/home/about-us/About
Source: Current Session.0.dr, Favicons-journal.0.dr String found in binary or memory: https://kezenelectric.ca/home/about-us/accreditations-certifications/
Source: History-journal.0.dr String found in binary or memory: https://kezenelectric.ca/home/about-us/accreditations-certifications/Accreditations
Source: Current Session.0.dr String found in binary or memory: https://kezenelectric.ca/home/about-us/accreditations-certifications/c
Source: Current Session.0.dr String found in binary or memory: https://kezenelectric.ca/home/about-us/meet-our-team/
Source: History-journal.0.dr String found in binary or memory: https://kezenelectric.ca/home/about-us/meet-our-team/Meet
Source: Current Session.0.dr, History-journal.0.dr String found in binary or memory: https://kezenelectric.ca/home/contact-us/
Source: History-journal.0.dr String found in binary or memory: https://kezenelectric.ca/home/contact-us/Contact
Source: Current Session.0.dr String found in binary or memory: https://kezenelectric.ca/home/contact-us/testamonials/
Source: History.0.dr String found in binary or memory: https://kezenelectric.ca/home/contact-us/testamonials/Testamonials
Source: Current Session.0.dr String found in binary or memory: https://kezenelectric.ca/home/past-projects/
Source: History-journal.0.dr String found in binary or memory: https://kezenelectric.ca/home/past-projects/Past
Source: 229c73a4fe442ea3_0.0.dr String found in binary or memory: https://kezenelectric.ca/k
Source: 75ddb2c602fd7877_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-content/plugins/wp-customer-reviews/js/wp-customer-reviews.js?ver=3.5.6
Source: 75ddb2c602fd7877_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-content/plugins/wp-customer-reviews/js/wp-customer-reviews.js?ver=3.5.6a
Source: 5da3893660e7a47a_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-content/themes/metrolo/js/hoot.theme.js?ver=1.9.14
Source: 5da3893660e7a47a_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-content/themes/metrolo/js/hoot.theme.js?ver=1.9.14aD
Source: 1d1b2948d4525464_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-content/themes/metrolo/js/jquery.fitvids.js?ver=1.1
Source: 1d1b2948d4525464_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-content/themes/metrolo/js/jquery.fitvids.js?ver=1.1aD
Source: d9852fc8edfab566_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-content/themes/metrolo/js/jquery.lightSlider.js?ver=1.1.1
Source: d9852fc8edfab566_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-content/themes/metrolo/js/jquery.lightSlider.js?ver=1.1.1aD
Source: 786b0adb2bd9c037_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-content/themes/metrolo/js/jquery.parallax.js?ver=1.4.2
Source: 786b0adb2bd9c037_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-content/themes/metrolo/js/jquery.parallax.js?ver=1.4.2aD
Source: 8ed7979f48ca3039_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-content/themes/metrolo/js/jquery.superfish.js?ver=1.7.5
Source: 8ed7979f48ca3039_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-content/themes/metrolo/js/jquery.superfish.js?ver=1.7.5aD
Source: 06aba3ef4a05b1d3_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-content/themes/metrolo/js/modernizr.custom.js?ver=2.8.3
Source: 06aba3ef4a05b1d3_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-content/themes/metrolo/js/modernizr.custom.js?ver=2.8.3aD
Source: Favicons-journal.0.dr String found in binary or memory: https://kezenelectric.ca/wp-content/uploads/2018/09/cropped-LOGO-3-32x32.jpg
Source: Favicons-journal.0.dr String found in binary or memory: https://kezenelectric.ca/wp-content/uploads/2018/09/cropped-LOGO-3-32x32.jpg(
Source: ee05b7802d222e35_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-includes/js/hoverIntent.min.js?ver=1.8.1
Source: ee05b7802d222e35_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-includes/js/hoverIntent.min.js?ver=1.8.1a
Source: ee05b7802d222e35_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-includes/js/hoverIntent.min.js?ver=1.8.1aD
Source: a8d7eb2cedf7692b_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Source: a8d7eb2cedf7692b_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2aD
Source: b92b2c27ad669878_0.0.dr, c27291f84aa51d71_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-includes/js/jquery/jquery.min.js?ver=3.5.1
Source: b92b2c27ad669878_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-includes/js/jquery/jquery.min.js?ver=3.5.1aD
Source: 229c73a4fe442ea3_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-includes/js/wp-embed.min.js?ver=5.7.2
Source: 229c73a4fe442ea3_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-includes/js/wp-embed.min.js?ver=5.7.2aD
Source: bda3c198988ffc1a_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-includes/js/wp-emoji-release.min.js?ver=5.7.2
Source: bda3c198988ffc1a_0.0.dr String found in binary or memory: https://kezenelectric.ca/wp-includes/js/wp-emoji-release.min.js?ver=5.7.2aD
Source: 7646c7fe-eb7f-4111-baed-47a93160456f.tmp.1.dr, 02be7372-55df-4983-b6ff-7018cbaa805c.tmp.1.dr String found in binary or memory: https://ogs.google.com
Source: manifest.json.0.dr String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 7646c7fe-eb7f-4111-baed-47a93160456f.tmp.1.dr, 02be7372-55df-4983-b6ff-7018cbaa805c.tmp.1.dr String found in binary or memory: https://play.google.com
Source: 02be7372-55df-4983-b6ff-7018cbaa805c.tmp.1.dr String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: 7646c7fe-eb7f-4111-baed-47a93160456f.tmp.1.dr, 02be7372-55df-4983-b6ff-7018cbaa805c.tmp.1.dr String found in binary or memory: https://redirector.gvt1.com
Source: manifest.json.0.dr String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 7646c7fe-eb7f-4111-baed-47a93160456f.tmp.1.dr String found in binary or memory: https://ssl.google-analytics.com
Source: 200e0abd4ba2ff0b_0.0.dr String found in binary or memory: https://ssl.google-analytics.com/ga.js
Source: 7646c7fe-eb7f-4111-baed-47a93160456f.tmp.1.dr, 02be7372-55df-4983-b6ff-7018cbaa805c.tmp.1.dr String found in binary or memory: https://ssl.gstatic.com
Source: messages.json41.0.dr String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json41.0.dr String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: bda3c198988ffc1a_0.0.dr String found in binary or memory: https://twemoji.maxcdn.com/v/13.0.1/
Source: 7646c7fe-eb7f-4111-baed-47a93160456f.tmp.1.dr String found in binary or memory: https://wallpaperaccess.com
Source: 000003.log6.0.dr String found in binary or memory: https://wphoot.com
Source: a431c1478c67bc32_0.0.dr String found in binary or memory: https://wphoot.com/
Source: 6c75240678e5e01e_0.0.dr String found in binary or memory: https://wphoot.com/;
Source: 6485724e45ee2243_0.0.dr String found in binary or memory: https://wphoot.com/_
Source: timesi.ttf.0.dr String found in binary or memory: https://wphoot.com/k
Source: Current Session.0.dr String found in binary or memory: https://wphoot.com/themes/metrolo/
Source: History.0.dr String found in binary or memory: https://wphoot.com/themes/metrolo/Metrolo
Source: 80a193e1143879d7_0.0.dr String found in binary or memory: https://wphoot.com/wp-content/plugins/easy-digital-downloads/assets/js/edd-ajax.min.js?ver=2.9.26
Source: 6485724e45ee2243_0.0.dr String found in binary or memory: https://wphoot.com/wp-content/uploads/siteground-optimizer-assets/contact-form-7.min.js?ver=5.3.2
Source: 9e21f8aa16d21fc2_0.0.dr String found in binary or memory: https://wphoot.com/wp-content/uploads/siteground-optimizer-assets/fitvids.min.js?ver=1.1
Source: 002445640ee1de89_0.0.dr String found in binary or memory: https://wphoot.com/wp-content/uploads/siteground-optimizer-assets/hoot-theme.min.js?ver=2.12
Source: f597f914edb8e129_0.0.dr String found in binary or memory: https://wphoot.com/wp-content/uploads/siteground-optimizer-assets/megamenu.min.js?ver=2.9.2
Source: timesi.ttf.0.dr String found in binary or memory: https://wphoot.com/wp-content/uploads/siteground-optimizer-assets/modernizr.min.js?ver=2.8.3
Source: 05a632044e49ec3d_0.0.dr String found in binary or memory: https://wphoot.com/wp-includes/js/hoverIntent.min.js?ver=1.8.1
Source: a431c1478c67bc32_0.0.dr String found in binary or memory: https://wphoot.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Source: f22d5e331d7c4eab_0.0.dr String found in binary or memory: https://wphoot.com/wp-includes/js/wp-embed.min.js?ver=5.7.2
Source: 05a632044e49ec3d_0.0.dr String found in binary or memory: https://wphoot.com/x
Source: Current Session.0.dr String found in binary or memory: https://wphoot.comh
Source: 7646c7fe-eb7f-4111-baed-47a93160456f.tmp.1.dr String found in binary or memory: https://www.dwdtechgroup.com
Source: dc6462b65c6623d5_0.0.dr String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: 000003.log6.0.dr String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr, 000003.log0.0.dr String found in binary or memory: https://www.google.com/
Source: Current Session.0.dr String found in binary or memory: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdXhLgZAAAAAApDk1usB-6gn8C_jiuIVL8OTDth&co=aHR0
Source: manifest.json0.0.dr String found in binary or memory: https://www.google.com;
Source: 7646c7fe-eb7f-4111-baed-47a93160456f.tmp.1.dr, 02be7372-55df-4983-b6ff-7018cbaa805c.tmp.1.dr String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: 7646c7fe-eb7f-4111-baed-47a93160456f.tmp.1.dr, 02be7372-55df-4983-b6ff-7018cbaa805c.tmp.1.dr String found in binary or memory: https://www.gstatic.com
Source: 6c75240678e5e01e_0.0.dr, 5278677776ece701_0.0.dr String found in binary or memory: https://www.gstatic.com/recaptcha/releases/CdDdhZfPbLLrfYLBdThNS0-Y/recaptcha__en.js
Source: manifest.json0.0.dr String found in binary or memory: https://www.gstatic.com;
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown HTTPS traffic detected: 104.129.24.42:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.154.247.12:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.70.177.74:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.70.177.74:443 -> 192.168.2.4:49866 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.208.111.117:443 -> 192.168.2.4:49909 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.208.111.117:443 -> 192.168.2.4:49910 version: TLS 1.2
Source: classification engine Classification label: mal64.phis.win@43/213@11/9
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-60C261B1-1938.pma Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\6bebe0bf-2ac4-40bc-910f-bd8906a292c6.tmp Jump to behavior
Source: QuotaManager.0.dr Binary or memory string: CREATE TABLE HostQuotaTable(host TEXT NOT NULL, type INTEGER NOT NULL, quota INTEGER DEFAULT 0, UNIQUE(host, type));
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'https://kezenelectric.ca/First-America'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,13816511049468976980,9988846167183782253,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1700 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,13816511049468976980,9988846167183782253,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1700 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 432851 URL: https://kezenelectric.ca/Fi... Startdate: 10/06/2021 Architecture: WINDOWS Score: 64 13 www.dwdtechgroup.com 2->13 15 wphoot.com 2->15 17 3 other IPs or domains 2->17 29 Antivirus detection for URL or domain 2->29 31 Antivirus / Scanner detection for submitted sample 2->31 33 Yara detected HtmlPhish10 2->33 7 chrome.exe 14 442 2->7         started        signatures3 process4 dnsIp5 19 192.168.2.1 unknown unknown 7->19 21 239.255.255.250 unknown Reserved 7->21 10 chrome.exe 63 7->10         started        process6 dnsIp7 23 kezenelectric.ca 66.70.177.74, 443, 49734, 49735 OVHFR Canada 10->23 25 dwdtechnology.wpengine.com 104.154.247.12, 443, 49746, 49747 GOOGLEUS United States 10->25 27 8 other IPs or domains 10->27
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.154.247.12
 dwdtechnology.wpengine.com United States
15169 GOOGLEUS false
104.129.24.42
 gofirstam.com United States
8100 ASN-QUADRANET-GLOBALUS false
142.250.180.225
 googlehosted.l.googleusercontent.com United States
15169 GOOGLEUS false
35.208.111.117
 wphoot.com United States
19527 GOOGLE-2US false
172.67.7.204
 wallpaperaccess.com United States
13335 CLOUDFLARENETUS false
66.70.177.74
 kezenelectric.ca Canada
16276 OVHFR false
239.255.255.250
 unknown Reserved
unknown unknown false

Private
IP
192.168.2.1
127.0.0.1

Contacted Domains

Name IP Active
kezenelectric.ca 66.70.177.74 true
wallpaperaccess.com 172.67.7.204 true
gofirstam.com 104.129.24.42 true
dwdtechnology.wpengine.com 104.154.247.12 true
s.w.org 192.0.77.48 true
googlehosted.l.googleusercontent.com 142.250.180.225 true
wphoot.com 35.208.111.117 true
clients2.googleusercontent.com unknown unknown
www.dwdtechgroup.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://kezenelectric.ca/First-America/ true
  • SlashNext: Fake Login Page type: Phishing & Social Engineering
 unknown
https://wphoot.com/themes/metrolo/ false
    		high
    https://kezenelectric.ca/home/past-projects/ true
      		unknown
      http://kezenelectric.ca/wp-content/uploads/2018/11/LOGO-300x179.jpg false
      • Avira URL Cloud: safe
      		 unknown
      https://kezenelectric.ca/ true
        		unknown
        http://kezenelectric.ca/ false
        • Avira URL Cloud: safe
        		 unknown
        http://kezenelectric.ca/wp-content/uploads/2018/11/CCC.jpg false
        • Avira URL Cloud: safe
        		 unknown
        https://kezenelectric.ca/home/about-us/ true
          		unknown
          https://kezenelectric.ca/home/about-us/accreditations-certifications/ true
            		unknown
            https://kezenelectric.ca/home/about-us/meet-our-team/ true
              		unknown
              https://kezenelectric.ca/exec/fd_helpWin?topic=8#main true
                		unknown
                https://kezenelectric.ca/exec/fd_helpWin?topic=8 true
                  		unknown
                  http://kezenelectric.ca/wp-content/uploads/2018/11/index-300x117.png false
                  • Avira URL Cloud: safe
                  		 unknown
                  https://kezenelectric.ca/home/contact-us/testamonials/ true
                    		unknown
                    https://kezenelectric.ca/home/contact-us/ true
                      		unknown