analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| download: | index.html |
| Full analysis: | https://app.any.run/tasks/2681ae04-5edf-4531-860f-e8f3680dfa82 |
| Verdict: | Malicious activity |
| Analysis date: | September 18, 2019, 17:38:07 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/html |
| File info: | HTML document, UTF-8 Unicode text, with very long lines |
| MD5: | E88644D0D8DB6B88115206395882B0CC |
| SHA1: | 8DF00F4AF02B4428F94F1E325E8A0E030CBF929F |
| SHA256: | 21FC6E9195AE2B32C5DCEAA83F3F9356853F2792BBE08809CB918DD86DE3A761 |
| SSDEEP: | 384:0UBWWTZd/jIBHcOL8cLyR/A5bjXCn/OrcXO4OwFxyOtO+O3GcM6J++90ghY7+OKR:XBWWTZVjIBtM6SfnIqYMo6HoLH |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executed via COM
- FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3552)
INFO
Changes internet zones settings
- iexplore.exe (PID: 2968)
Creates files in the user directory
- FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3552)
- iexplore.exe (PID: 3380)
- iexplore.exe (PID: 2872)
Reads internet explorer settings
- iexplore.exe (PID: 3380)
- iexplore.exe (PID: 2872)
Application launched itself
- iexplore.exe (PID: 2968)
Reads Internet Cache Settings
- iexplore.exe (PID: 2872)
- iexplore.exe (PID: 3380)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .htm/html | | | HyperText Markup Language with DOCTYPE (80.6) |
|---|---|---|
| .html | | | HyperText Markup Language (19.3) |
EXIF
HTML
| twitterImage: | https://www.lockwoodpublishing.com/wp-content/uploads/2019/09/LockwoodBestPGamerTop50_2019_698x400.png |
|---|---|
| twitterTitle: | Lockwood Publishing | Makers of Avakin Life |
| twitterDescription: | We’re the brains behind Avakin life, a 3D virtual + social world for mobile. Create your own Avatar and interact with our online community + make friends. |
| twitterCard: | summary_large_image |
| Description: | We’re the brains behind Avakin life, a 3D virtual + social world for mobile. Create your own Avatar and interact with our online community + make friends. |
| viewport: | width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0 |
| Title: | Lockwood Publishing | Makers of Avakin Life |
| HTTPEquivXUACompatible: | IE=9;IE=10;IE=Edge,chrome=1 |
| ContentType: | text/html; charset=UTF-8 |
Total processes
37
Monitored processes
4
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2968 | "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\index.html.htm | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3380 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2968 CREDAT:79873 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 2872 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2968 CREDAT:203009 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3552 | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe | — | svchost.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Version: 26,0,0,131 | ||||
Total events
623
Read events
529
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
1
Text files
149
Unknown types
20
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2968 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 2968 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 3380 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\fatfrank[1].eot | eot | |
MD5:560BFE13C2278D3527F5271C56DB5817 | SHA256:340390BBA825E72D5E445006365EEB4A5784DE6EEDF799D954179A547B784FF6 | |||
| 3380 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\roboto-bold[1].eot | eot | |
MD5:6178442A399667A3C1B73D3D21A390D0 | SHA256:4D2BE00FD6DB9ED78A1566073E3124ECD4A4B2CA336AA582476F46D0D89AEB0D | |||
| 3380 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\style[1].css | text | |
MD5:AA17677FDD602FE132F6557A1F73E36E | SHA256:25459891828E129B7038B6F0160A80AEB0AFF881BD3AEC9A410837ED215B1D79 | |||
| 3380 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\BPTW_Winner_White-e1540389688208[1].png | image | |
MD5:064AF39C973C3D98643E21DC71AD2A3B | SHA256:CEA40318328D55AC59C8C6B8C4EBD0997E05A595C5AB86ADE80BCCDE0BE5757B | |||
| 3380 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\roboto-light[1].eot | eot | |
MD5:B9E92D3E08A8C0D47EF87BA86C72BF1E | SHA256:499973B352EA6D8578D9036455BC311704B02E770E08EB4166CD34B2E6E96B7E | |||
| 3380 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\NON-Deloitte-Fast50-Winner-UK-SEC-RGB_72dpi[1].png | image | |
MD5:33556E39DAB60ACCDA46B320A5B324C8 | SHA256:F3C0D7356F77A0FEC4322B408D20EB52568D790A77D919BC4B67924CA2E03053 | |||
| 3380 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\2019-Tech-Track-100-logo[1].png | image | |
MD5:BA0DD8FAAC4724DC6EC9B0BFE3899817 | SHA256:030F841F8F6EA6C61FBB73545C52C9FC5A5B7076C5F1A418A7DADC930F6784EE | |||
| 3380 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\dl-but-gplay-235x70[1].png | image | |
MD5:70C18698012EB55F9F7027CDF6F79E55 | SHA256:FBBDBA7BDD26224D2D44153848E3AB6399658B4A7B955C4775340BAADC797DB9 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
170
DNS requests
9
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2872 | iexplore.exe | GET | 200 | 13.35.253.70:80 | http://cdn.trackduck.com/toolbar/prod/td.js | US | — | — | whitelisted |
2872 | iexplore.exe | GET | 301 | 212.84.66.225:80 | http://www.lockwoodpublishing.com/wp-content/themes/lkwd/dist/css/style.css?ver=1.0.0 | GB | html | 419 b | unknown |
2872 | iexplore.exe | GET | 301 | 212.84.66.225:80 | http://www.lockwoodpublishing.com/wp-content/themes/lkwd/dist/fonts/roboto.eot? | GB | html | 413 b | unknown |
2872 | iexplore.exe | GET | 301 | 212.84.66.225:80 | http://www.lockwoodpublishing.com/wp-content/themes/lkwd/dist/fonts/fatfrank.eot? | GB | html | 415 b | unknown |
2968 | iexplore.exe | GET | 200 | 212.84.66.225:80 | http://www.lockwoodpublishing.com/favicon.ico | GB | — | — | unknown |
2872 | iexplore.exe | GET | 301 | 212.84.66.225:80 | http://www.lockwoodpublishing.com/wp-content/themes/lkwd/dist/js/main.js?ver=1.0.0 | GB | html | 416 b | unknown |
2872 | iexplore.exe | GET | 301 | 212.84.66.225:80 | http://www.lockwoodpublishing.com/wp-content/themes/lkwd/dist/fonts/roboto-medium.eot? | GB | html | 420 b | unknown |
2872 | iexplore.exe | GET | 301 | 212.84.66.225:80 | http://www.lockwoodpublishing.com/wp-includes/js/wp-embed.min.js?ver=4.9.11 | GB | html | 409 b | unknown |
2872 | iexplore.exe | GET | 301 | 212.84.66.225:80 | http://www.lockwoodpublishing.com/wp-content/themes/lkwd/assets/js/scripts/job-sort.js?ver=1.0.0 | GB | html | 430 b | unknown |
2872 | iexplore.exe | GET | 301 | 212.84.66.225:80 | http://www.lockwoodpublishing.com/wp-content/themes/lkwd/dist/fonts/roboto-light.eot? | GB | html | 419 b | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2968 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3380 | iexplore.exe | 212.84.66.225:443 | www.lockwoodpublishing.com | 1st Easy Limited | GB | unknown |
3380 | iexplore.exe | 151.101.2.110:443 | fast.wistia.com | Fastly | US | suspicious |
3380 | iexplore.exe | 216.58.206.10:443 | ajax.googleapis.com | Google Inc. | US | whitelisted |
4 | System | 13.32.218.80:445 | cdn.trackduck.com | Amazon.com, Inc. | US | unknown |
4 | System | 13.32.218.55:445 | cdn.trackduck.com | Amazon.com, Inc. | US | unknown |
4 | System | 13.32.218.29:445 | cdn.trackduck.com | Amazon.com, Inc. | US | unknown |
4 | System | 13.32.218.166:139 | cdn.trackduck.com | Amazon.com, Inc. | US | unknown |
3380 | iexplore.exe | 172.217.18.168:443 | www.googletagmanager.com | Google Inc. | US | whitelisted |
4 | System | 13.32.218.166:445 | cdn.trackduck.com | Amazon.com, Inc. | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.googletagmanager.com |
| whitelisted |
www.lockwoodpublishing.com |
| unknown |
ajax.googleapis.com |
| whitelisted |
fast.wistia.com |
| whitelisted |
www.bing.com |
| whitelisted |
cdn.trackduck.com |
| whitelisted |
www.google-analytics.com |
| whitelisted |