Source: http://worker-quiet-cherry-3fda.cbb2856.workers.dev/favicon.ico |
Avira URL Cloud: detection malicious, Label: phishing |
Source: http://worker-quiet-cherry-3fda.cbb2856.workers.dev/favicon.ico |
SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social usering |
Source: https://worker-quiet-cherry-3fda.cbb2856.workers.dev/favicon.ico |
Avira URL Cloud: Label: phishing |
Source: http://worker-quiet-cherry-3fda.cbb2856.workers.dev/style.css |
Avira URL Cloud: Label: phishing |
Source: https://worker-quiet-cherry-3fda.cbb2856.workers.dev/favicon.ico |
Virustotal: Detection: 20% |
Perma Link |
Source: http://worker-quiet-cherry-3fda.cbb2856.workers.dev/favicon.ico |
Virustotal: Detection: 21% |
Perma Link |
Source: http://worker-quiet-cherry-3fda.cbb2856.workers.dev/favicon.ico |
LLM: Score: 9 brands: Microsoft OneNote Reasons: The URL 'http://worker-quiet-cherry-3fda.cbb2856.workers.dev/favicon.ico' does not match the legitimate domain for Microsoft OneNote, which should be something like 'onenote.com' or 'microsoft.com'. The page contains multiple login options, which is a common tactic used in phishing sites to capture credentials from various services. The domain name is highly suspicious and does not correspond to any known legitimate Microsoft domain. The presence of a login form and the use of social usering techniques further indicate that this is likely a phishing site. DOM: 0.0.pages.csv |
Source: Yara match |
File source: 0.0.pages.csv, type: HTML |
Source: Yara match |
File source: 0.0.pages.csv, type: HTML |
Source: http://worker-quiet-cherry-3fda.cbb2856.workers.dev/favicon.ico |
LLM: Score: 10 Reasons: The JavaScript code captures user email and password, along with IP address, user-agent, and cookies, and sends this information to a Telegram chat. This behavior is indicative of phishing and data exfiltration, which is highly malicious. DOM: 0.0.pages.csv |
Source: http://worker-quiet-cherry-3fda.cbb2856.workers.dev/favicon.ico |
Matcher: Found strong image similarity, combo hit |
Source: http://worker-quiet-cherry-3fda.cbb2856.workers.dev/favicon.ico |
HTTP Parser: Number of links: 0 |
Source: http://worker-quiet-cherry-3fda.cbb2856.workers.dev/favicon.ico |
HTTP Parser: Total embedded image size: 142766 |
Source: http://worker-quiet-cherry-3fda.cbb2856.workers.dev/favicon.ico |
HTTP Parser: Title: Document does not match URL |
Source: http://worker-quiet-cherry-3fda.cbb2856.workers.dev/favicon.ico |
HTTP Parser: Has password / email / username input fields |
Source: http://worker-quiet-cherry-3fda.cbb2856.workers.dev/favicon.ico |
HTTP Parser: <input type="password" .../> found |
Source: http://worker-quiet-cherry-3fda.cbb2856.workers.dev/favicon.ico |
HTTP Parser: No favicon |
Source: http://worker-quiet-cherry-3fda.cbb2856.workers.dev/favicon.ico |
HTTP Parser: No <meta name="author".. found |
Source: http://worker-quiet-cherry-3fda.cbb2856.workers.dev/favicon.ico |
HTTP Parser: No <meta name="copyright".. found |
Source: unknown |
HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:61590 version: TLS 1.0 |
Source: unknown |
HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49709 version: TLS 1.2 |
Source: unknown |
HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49722 version: TLS 1.2 |
Source: unknown |
HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.6:49723 version: TLS 1.2 |
Source: unknown |
HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.6:49725 version: TLS 1.2 |
Source: unknown |
HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:61591 version: TLS 1.2 |
Source: unknown |
HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:61593 version: TLS 1.2 |
Source: global traffic |
TCP traffic: 192.168.2.6:61584 -> 1.1.1.1:53 |
Source: unknown |
HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:61590 version: TLS 1.0 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 173.222.162.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 173.222.162.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 173.222.162.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 40.115.3.253 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 40.115.3.253 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 40.115.3.253 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 40.115.3.253 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 40.115.3.253 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 40.115.3.253 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 40.115.3.253 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 40.115.3.253 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 40.115.3.253 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 40.115.3.253 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 40.115.3.253 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 40.115.3.253 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 40.115.3.253 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 40.115.3.253 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 2.19.104.72 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 2.19.104.72 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 2.19.104.72 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 173.222.162.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 173.222.162.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 173.222.162.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 40.115.3.253 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 2.19.104.72 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 40.115.3.253 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 2.19.104.72 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 40.115.3.253 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 40.115.3.253 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 40.115.3.253 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 2.19.104.72 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 2.19.104.72 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 40.115.3.253 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 40.115.3.253 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 2.19.104.72 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 2.19.104.72 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 2.19.104.72 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 2.19.104.72 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 2.19.104.72 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 2.19.104.72 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 2.19.104.72 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 2.19.104.72 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 2.19.104.72 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 2.19.104.72 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 2.19.104.72 |
Source: global traffic |
HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: worker-quiet-cherry-3fda.cbb2856.workers.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
Source: global traffic |
HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com |
Source: global traffic |
HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: worker-quiet-cherry-3fda.cbb2856.workers.devConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9 |
Source: global traffic |
HTTP traffic detected: GET /style.css HTTP/1.1Host: worker-quiet-cherry-3fda.cbb2856.workers.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,*/*;q=0.1Referer: http://worker-quiet-cherry-3fda.cbb2856.workers.dev/favicon.icoAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9 |
Source: global traffic |
HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: worker-quiet-cherry-3fda.cbb2856.workers.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://worker-quiet-cherry-3fda.cbb2856.workers.dev/favicon.icoAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9 |
Source: global traffic |
DNS traffic detected: DNS query: worker-quiet-cherry-3fda.cbb2856.workers.dev |
Source: global traffic |
DNS traffic detected: DNS query: www.google.com |
Source: unknown |
Network traffic detected: HTTP traffic on port 49674 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49722 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49721 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49720 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49672 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 61593 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 61590 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 61591 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49725 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49704 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49720 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49722 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 61590 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49709 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 61596 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49673 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49721 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49723 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49709 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 61593 |
Source: unknown |
Network traffic detected: HTTP traffic on port 61591 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49704 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 61596 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49725 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49723 |
Source: unknown |
HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49709 version: TLS 1.2 |
Source: unknown |
HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49722 version: TLS 1.2 |
Source: unknown |
HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.6:49723 version: TLS 1.2 |
Source: unknown |
HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.6:49725 version: TLS 1.2 |
Source: unknown |
HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:61591 version: TLS 1.2 |
Source: unknown |
HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:61593 version: TLS 1.2 |
Source: classification engine |
Classification label: mal100.phis.win@21/7@8/5 |
Source: unknown |
Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" |
|
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2028,i,13474438376048537650,4722948158718503826,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 |
|
Source: unknown |
Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://worker-quiet-cherry-3fda.cbb2856.workers.dev/favicon.ico" |
|
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2028,i,13474438376048537650,4722948158718503826,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: Window Recorder |
Window detected: More than 3 window changes detected |