Automated Malware Analysis IOC Report for

Details

Filetype:	URL
Filename:	http://www.optimumsource.net

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
None HTTPS page querying sensitive user data (password, username or email)	Phishing
No HTML title found	Phishing
Performs DNS lookups	Networking	Non-Application Layer Protocol Application Layer Protocol
Classification label	System Summary
Downloads compressed data via HTTP	Networking
Uses HTTPS	Networking
Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis		Encrypted Channel
Spawns processes	System Summary	Process Injection
Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.
Connects to IPs without corresponding DNS lookups	Networking
META author tag missing	Phishing
Downloads files from webservers via HTTP	Networking
Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)	Networking	Ingress Tool Transfer
Creates files inside the program directory	System Summary	Masquerading
META copyright tag missing	Phishing
Creates a directory in C:\Program Files	Compliance, System Summary
Found graphical window changes (likely an installer)	System Summary

Details

Name:	http://www.optimumsource.net/wp-includes/js/jquery/ui/datepicker.min.js?ver=1.13.1
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/plugins/revslider/rs-plugin/assets/large_left.png
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/plugins/jquery-updater/js/jquery-migrate-3.3.2.min.js?ver=3.3.2
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/uploads/2013/11/Banner-Home2.jpg
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/plugins/revslider/rs-plugin/css/settings.css?ver=5.9.4
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

Details

Name:	http://www.optimumsource.net/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/plugins/wip-mega-menu/assets/js/idangerous.swiper.3dflow-2.0.js?ver=2.0
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/plugins/contact-form-7-datepicker/js/jquery-ui-sliderAccess.js?ver=5.9.4
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/plugins/jquery-updater/js/jquery-3.6.0.min.js?ver=3.6.0
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-includes/js/jquery/ui/core.min.js?ver=1.13.1
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/plugins/revslider/rs-plugin/assets/shadow2.png
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/themes/pantherhead/assets/js/jquery.transit.min.js?ver=0.9.9
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://s174710176.onlinehome.us/optimumsource/wp-content/uploads/2013/12/slider_bg.jpg
IP:	74.208.236.114
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/uploads/2013/12/home_banner3.jpg
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/themes/pantherhead/modules/wip-content-manager/assets/js/content.manager.lib.min.js?ver=1.0
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/plugins/revslider/rs-plugin/assets/timer.png
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/themes/pantherhead/assets/css/font-awesome/css/font-awesome.min.css?ver=3.2.1
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

Details

Name:	http://www.optimumsource.net/wp-content/themes/pantherhead/custom-css.php?ver=1648301343&c=1&theme=wip_theme
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/uploads/2013/12/home_page_banner2.jpg
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/themes/pantherhead/assets/css/font-awesome/font/fontawesome-webfont.woff?v=3.2.1
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://s174710176.onlinehome.us/optimumsource/wp-content/uploads/2013/11/home_bg_section.jpg
IP:	74.208.236.114
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/themes/pantherhead/assets/js/modernizr.custom.js?ver=2.6.2
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/plugins/revslider/rs-plugin/assets/loader.gif
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.5.6
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-includes/js/jquery/ui/slider.min.js?ver=1.13.1
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/uploads/2013/12/slider_bg.jpg
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/themes/pantherhead/assets/css/base.css?ver=1.0.1
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

Details

Name:	http://www.optimumsource.net/
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

Details

Name:	http://www.optimumsource.net/wp-content/uploads/2013/11/resquestquote_homepage.jpg
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-includes/js/comment-reply.min.js?ver=5.9.4
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/clients/
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser

Signature Hits	Behavior Group	Mitre Attack
No HTML title found	Phishing
None HTTPS page querying sensitive user data (password, username or email)	Phishing
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
META author tag missing	Phishing
META copyright tag missing	Phishing

Details

Name:	http://www.optimumsource.net/wp-content/themes/pantherhead/assets/js/jquery.easing.1.3.js?ver=1.3
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/plugins/contact-form-7-datepicker/js/jquery-ui-timepicker/jquery-ui-timepicker-addon.min.css?ver=5.9.4
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/plugins/wip-mega-menu/assets/js/idangerous.swiper.js?ver=2.1
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/themes/pantherhead/assets/js/global.min.js?ver=1.0.1
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-includes/js/jquery/ui/mouse.min.js?ver=1.13.1
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/uploads/2013/11/Optimum-Source-Logo-Web.png
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/clients/
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
No HTML title found	Phishing
None HTTPS page querying sensitive user data (password, username or email)	Phishing
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
META author tag missing	Phishing
META copyright tag missing	Phishing

Details

Name:	http://www.optimumsource.net/wp-content/themes/pantherhead/style.css?ver=5.9.4
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-includes/js/hoverIntent.min.js?ver=1.10.2
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/plugins/revslider/rs-plugin/css/captions.css?ver=5.9.4
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Downloads compressed data via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Spawns processes	System Summary	Process Injection
Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

Details

Name:	http://www.optimumsource.net/wp-includes/js/jquery/ui/button.min.js?ver=1.13.1
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/themes/pantherhead/assets/css/light.css?ver=1.0.1
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/plugins/revslider/rs-plugin/js/jquery.themepunch.revolution.min.js?ver=5.9.4
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/uploads/2013/11/industriesserved_homepage.jpg
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/themes/pantherhead/assets/css/reset.css
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/themes/pantherhead/assets/css/responsive.css?ver=1.0.1
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/uploads/2013/11/Business-meeting-Supplier-Management1.jpg
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.5.6
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/uploads/2013/11/greencleaning_homepage.jpg
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/plugins/revslider/rs-plugin/assets/large_right.png
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/themes/pantherhead/assets/js/jquery.isotope.min.js?ver=1.5.25
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-includes/js/jquery/ui/controlgroup.min.js?ver=1.13.1
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-includes/js/jquery/ui/checkboxradio.min.js?ver=1.13.1
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/uploads/2013/11/services_homepage.jpg
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/services/
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser

Signature Hits	Behavior Group	Mitre Attack
No HTML title found	Phishing
None HTTPS page querying sensitive user data (password, username or email)	Phishing
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
META author tag missing	Phishing
META copyright tag missing	Phishing

Details

Name:	http://www.optimumsource.net/wp-content/plugins/contact-form-7-datepicker/js/jquery-ui-timepicker/jquery-ui-timepicker-addon.min.js?ver=5.9.4
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-includes/js/wp-emoji-release.min.js?ver=5.9.4
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/plugins/wip-mega-menu/assets/js/wip-megamenu.js?ver=1.1
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Details

Name:	http://www.optimumsource.net/wp-content/uploads/2013/11/favicon.ico
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

Details

Name:	http://www.optimumsource.net/services/
IP:	160.153.91.65
TargetID:	1
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
No HTML title found	Phishing
None HTTPS page querying sensitive user data (password, username or email)	Phishing
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
META author tag missing	Phishing
META copyright tag missing	Phishing

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
http://www.optimumsource.net

URLs

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttp://www.optimumsource.net

URLs

Domains

IPs

IOC Report
http://www.optimumsource.net