| URL: | https://share-eu1.hsforms.com/1Hf0FHpatTR-4D7-vkGay0Q2ev79s |
| Full analysis: | https://app.any.run/tasks/5dc7faf9-2d92-4ffd-8532-e0f3ca95d501 |
| Verdict: | Malicious activity |
| Analysis date: | April 15, 2025, 18:29:24 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| MD5: | CE4A32172CCBFD0A651AAAD753BECF57 |
| SHA1: | E3CAE02625515D6DCF5A27F36070A6A529579E4A |
| SHA256: | 3681A9F8E3DE0CB504531F13333AF0D02CF4CA5FE75E86FE929BDFA941A2549E |
| SSDEEP: | 3:N8AA1U1XIMR6ju4Tx0Fnn:2APKM2u/Fn |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
150
Monitored processes
0
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
88
TCP/UDP connections
88
DNS requests
103
Threats
14
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 172.64.148.142:443 | https://share-eu1.hsforms.com/1Hf0FHpatTR-4D7-vkGay0Q2ev79s | unknown | — | — | — |
— | — | GET | 200 | 23.48.23.164:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.48.23.164:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.16.253.202:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.48.23.164:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.16.253.202:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.16.253.202:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 304 | 172.65.255.172:443 | https://js-eu1.hsforms.net/forms/embed/v3.js | unknown | — | — | — |
— | — | GET | 304 | 172.65.208.22:443 | https://js-eu1.hs-scripts.com/145902736.js | unknown | — | — | — |
— | — | GET | 200 | 104.17.175.91:443 | https://static.hsappstatic.net/forms-submission-pages/static-1.6472/bundles/share-legacy.js | unknown | binary | 3.10 Kb | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 239.255.255.250:1900 | — | — | — | whitelisted |
— | — | 172.65.198.19:443 | share-eu1.hsforms.com | CLOUDFLARENET | US | whitelisted |
— | — | 104.17.175.91:443 | static.hsappstatic.net | CLOUDFLARENET | — | whitelisted |
— | — | 172.65.255.172:443 | js-eu1.hsforms.net | CLOUDFLARENET | US | unknown |
— | — | 2.16.204.152:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
— | — | 172.65.208.22:443 | js-eu1.hs-scripts.com | CLOUDFLARENET | US | whitelisted |
— | — | 172.65.232.43:443 | forms-eu1.hsforms.com | CLOUDFLARENET | US | whitelisted |
— | — | 172.65.192.122:443 | js-eu1.hscollectedforms.net | CLOUDFLARENET | US | unknown |
— | — | 172.65.202.201:443 | js-eu1.hs-banner.com | CLOUDFLARENET | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
share-eu1.hsforms.com |
| whitelisted |
static.hsappstatic.net |
| whitelisted |
www.bing.com |
| whitelisted |
js-eu1.hsforms.net |
| unknown |
fonts.gstatic.com |
| whitelisted |
forms-eu1.hsforms.com |
| whitelisted |
js-eu1.hs-scripts.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Not Suspicious Traffic | INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code .jquery .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code .jquery .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code .jquery .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code .jquery .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare Network Error Logging (NEL) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare Network Error Logging (NEL) |
— | — | Possible Social Engineering Attempted | PHISHING [ANY.RUN] Suspected Phishing Domain (zqrhhm .ru) |
— | — | Possible Social Engineering Attempted | PHISHING [ANY.RUN] Suspected Phishing Domain (zqrhhm .ru) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com) |