Windows Analysis Report
http://104.155.207.188/win.pac

Overview

General Information

Sample URL: http://104.155.207.188/win.pac
Analysis ID: 624161
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file

Classification

AV Detection

barindex
Source: http://104.155.207.188/win.pac Avira URL Cloud: detection malicious, Label: malware
Source: http://104.155.207.188/win.pac Virustotal: Detection: 9% Perma Link
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Jump to behavior
Source: unknown DNS traffic detected: queries for: accounts.google.com
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 104.155.207.188
Source: unknown TCP traffic detected without corresponding DNS query: 104.155.207.188
Source: unknown TCP traffic detected without corresponding DNS query: 104.155.207.188
Source: unknown TCP traffic detected without corresponding DNS query: 104.155.207.188
Source: unknown TCP traffic detected without corresponding DNS query: 104.155.207.188
Source: unknown TCP traffic detected without corresponding DNS query: 104.155.207.188
Source: unknown TCP traffic detected without corresponding DNS query: 104.155.207.188
Source: unknown TCP traffic detected without corresponding DNS query: 104.155.207.188
Source: unknown TCP traffic detected without corresponding DNS query: 104.155.207.188
Source: unknown TCP traffic detected without corresponding DNS query: 104.155.207.188
Source: unknown TCP traffic detected without corresponding DNS query: 104.155.207.188
Source: unknown TCP traffic detected without corresponding DNS query: 104.155.207.188
Source: unknown TCP traffic detected without corresponding DNS query: 104.155.207.188
Source: unknown TCP traffic detected without corresponding DNS query: 104.155.207.188
Source: unknown TCP traffic detected without corresponding DNS query: 104.155.207.188
Source: unknown TCP traffic detected without corresponding DNS query: 104.155.207.188
Source: global traffic HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /win.pac HTTP/1.1Host: 104.155.207.188Connection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: win.pac_Zone.Identifier.4.dr String found in binary or memory: http://104.155.207.188/win.pac
Source: angular.js.1.dr String found in binary or memory: http://angularjs.org
Source: angular.js.1.dr String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: 0398f951-8cb1-4069-826a-8c56b4dad919.tmp.3.dr, 04b0af2d-2668-4002-97ff-271744050b2c.tmp.3.dr, manifest.json2.1.dr String found in binary or memory: https://accounts.google.com
Source: craw_window.js.1.dr String found in binary or memory: https://accounts.google.com/MergeSession
Source: 0398f951-8cb1-4069-826a-8c56b4dad919.tmp.3.dr, 04b0af2d-2668-4002-97ff-271744050b2c.tmp.3.dr, manifest.json2.1.dr String found in binary or memory: https://apis.google.com
Source: 0398f951-8cb1-4069-826a-8c56b4dad919.tmp.3.dr, 04b0af2d-2668-4002-97ff-271744050b2c.tmp.3.dr String found in binary or memory: https://clients2.google.com
Source: manifest.json.1.dr, manifest.json2.1.dr, manifest.json3.1.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 0398f951-8cb1-4069-826a-8c56b4dad919.tmp.3.dr, 04b0af2d-2668-4002-97ff-271744050b2c.tmp.3.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json2.1.dr String found in binary or memory: https://content.googleapis.com
Source: common.js.1.dr String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: 0398f951-8cb1-4069-826a-8c56b4dad919.tmp.3.dr, 80cfe5db-1550-4897-a8d1-57c904cabb7c.tmp.3.dr, 6e7b1f98-b22a-44f8-808f-4c5bb9271312.tmp.3.dr, 04b0af2d-2668-4002-97ff-271744050b2c.tmp.3.dr String found in binary or memory: https://dns.google
Source: manifest.json2.1.dr String found in binary or memory: https://feedback.googleusercontent.com
Source: 0398f951-8cb1-4069-826a-8c56b4dad919.tmp.3.dr, 04b0af2d-2668-4002-97ff-271744050b2c.tmp.3.dr String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json2.1.dr String found in binary or memory: https://fonts.googleapis.com;
Source: 0398f951-8cb1-4069-826a-8c56b4dad919.tmp.3.dr, 04b0af2d-2668-4002-97ff-271744050b2c.tmp.3.dr String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json2.1.dr String found in binary or memory: https://fonts.gstatic.com;
Source: angular.js.1.dr, material_css_min.css.1.dr String found in binary or memory: https://github.com/angular/material
Source: craw_background.js.1.dr, craw_window.js.1.dr String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: manifest.json2.1.dr String found in binary or memory: https://hangouts.google.com/
Source: 0398f951-8cb1-4069-826a-8c56b4dad919.tmp.3.dr, 04b0af2d-2668-4002-97ff-271744050b2c.tmp.3.dr String found in binary or memory: https://ogs.google.com
Source: manifest.json.1.dr, craw_window.js.1.dr String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 04b0af2d-2668-4002-97ff-271744050b2c.tmp.3.dr String found in binary or memory: https://r2---sn-1gi7znes.gvt1.com
Source: 04b0af2d-2668-4002-97ff-271744050b2c.tmp.3.dr String found in binary or memory: https://redirector.gvt1.com
Source: manifest.json.1.dr, craw_window.js.1.dr String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 0398f951-8cb1-4069-826a-8c56b4dad919.tmp.3.dr, 04b0af2d-2668-4002-97ff-271744050b2c.tmp.3.dr String found in binary or memory: https://ssl.gstatic.com
Source: feedback.html.1.dr String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: feedback.html.1.dr String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: craw_background.js.1.dr, craw_window.js.1.dr String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 0398f951-8cb1-4069-826a-8c56b4dad919.tmp.3.dr, 04b0af2d-2668-4002-97ff-271744050b2c.tmp.3.dr, manifest.json2.1.dr String found in binary or memory: https://www.google.com
Source: manifest.json.1.dr String found in binary or memory: https://www.google.com/
Source: craw_window.js.1.dr String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.1.dr String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.1.dr String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.1.dr String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.1.dr String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: feedback_script.js.1.dr String found in binary or memory: https://www.google.com/tools/feedback
Source: manifest.json2.1.dr String found in binary or memory: https://www.google.com;
Source: 0398f951-8cb1-4069-826a-8c56b4dad919.tmp.3.dr, craw_background.js.1.dr, 04b0af2d-2668-4002-97ff-271744050b2c.tmp.3.dr, craw_window.js.1.dr String found in binary or memory: https://www.googleapis.com
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/
Source: manifest.json2.1.dr String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json2.1.dr String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json2.1.dr String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json2.1.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json2.1.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json2.1.dr String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json2.1.dr String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json2.1.dr String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: 0398f951-8cb1-4069-826a-8c56b4dad919.tmp.3.dr, 04b0af2d-2668-4002-97ff-271744050b2c.tmp.3.dr String found in binary or memory: https://www.gstatic.com
Source: common.js.1.dr String found in binary or memory: https://www.gstatic.com/hangouts_echo_detector/release/%
Source: manifest.json2.1.dr String found in binary or memory: https://www.gstatic.com;
Source: unknown HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\c1e0b3d4-c691-48dc-8bab-d22cac04bb2f.tmp Jump to behavior
Source: classification engine Classification label: mal56.win@35/183@3/8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "http://104.155.207.188/win.pac
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1568,8254746983986450573,12491079493607844637,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1924 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1568,8254746983986450573,12491079493607844637,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=4612 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1568,8254746983986450573,12491079493607844637,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1924 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1568,8254746983986450573,12491079493607844637,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=4612 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-627BE47B-1818.pma Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Jump to behavior