download:

index.html

Full analysis: https://app.any.run/tasks/c3789500-3081-4cb8-94cd-ab31ff8d3a95
Verdict: Malicious activity
Analysis date: April 23, 2021, 16:03:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/html
File info: HTML document, UTF-8 Unicode text, with very long lines
MD5:

C757D936B6D0B4403894B8789789DEC4

SHA1:

A09179707BEA2D8690F805E7BBEB13B0AEEB5CFC

SHA256:

7348850B26D5D75C029E7A682B2C3A094BA4B016D795DB9EDAE62ECC69E3121D

SSDEEP:

1536:GaZCeQ0UDH8uLXO4uiKKifG/hIcWzfLhyWuSkPjUCojs0QScuDH:nXQScaH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2532)
      • iexplore.exe (PID: 988)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2616)
      • iexplore.exe (PID: 2532)
      • iexplore.exe (PID: 988)

    • Changes settings of System certificates

      • iexplore.exe (PID: 988)
      • iexplore.exe (PID: 2616)
      • iexplore.exe (PID: 2532)

    • Changes internet zones settings

      • iexplore.exe (PID: 2532)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1792)
      • iexplore.exe (PID: 2616)
      • iexplore.exe (PID: 988)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 988)
      • iexplore.exe (PID: 2616)
      • iexplore.exe (PID: 2532)

    • Creates files in the user directory

      • iexplore.exe (PID: 2616)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.html | HyperText Markup Language (100)

EXIF

HTML

msapplicationConfig: https://gateway.jerkmate.com/cno/assets/cno/favicon/browserconfig.xml
msapplicationTileColor: #00c4ff
themeColor: #ffffff
viewport: width=device-width
Title: Jerkmate | Never jerk off alone again
Robots: noindex, nofollow
nextHeadCount: 4
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
5
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe iexplore.exe no specs iexplore.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
988"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2532 CREDAT:209922 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1792"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2532 CREDAT:930823 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2532"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\index.htmlC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2616"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2532 CREDAT:144385 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
3489660927
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3072"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2532 CREDAT:464129 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
2 463
Read events
2 276
Write events
180
Delete events
7

Modification events

(PID) Process:(2532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
1676415178
(PID) Process:(2532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30881882
(PID) Process:(2532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A5000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2532) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
0
Suspicious files
50
Text files
44
Unknown types
24

Dropped files

PID
Process
Filename
Type
2616iexplore.exeC:\Users\admin\AppData\Local\Temp\CabD8A5.tmp —
MD5:—
SHA256:—
2616iexplore.exeC:\Users\admin\AppData\Local\Temp\TarD8A6.tmp —
MD5:—
SHA256:—
2616iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833Bbinary
MD5:772C96E0B347D0C4BE1FC408DB526D89
SHA256:1F0009E7A3B213E8399A0598107B07D7B6282760F5C6AE0240C83AE47B133EF2
2616iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833Bder
MD5:975389D23F435985B782152AB9B72F68
SHA256:0A6E43FD38234CB38FF532A7C672668164845C372E1C1C23A46956F481386B02
2616iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\css2[1].csstext
MD5:892F8496D20BEDC77819810F618C5E4E
SHA256:E9E967269CB30B6E896550A7BD049B429BF8D03FF42FE7FACE6A1D4B54BC31BC
2616iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC197601BE0898B7B0FCC91FA15D8A69_B121B36398E3075386664ABDAC5E9443der
MD5:28DB8779A4266CB2606E632BA261124A
SHA256:1B0DA6C1B5861668145D23EB6BC6898D345CDFA6842BE3799F2F05D43E708FAC
2616iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\7ea93529f30a2029e675[1].csstext
MD5:54CEA487CDF42AE56E286320C618A52B
SHA256:F32EDFE361EF67339A5AD8E11945E23113737D6F1C3FD058241D1B06B7C47EC4
2616iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\css2[1].csstext
MD5:15435647B9085FFE0CED0975039013F9
SHA256:F6A556B9FE6DB8A4C2790F8C476433B344693C4D6A2684C91E70E2121DBB51BF
2616iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC197601BE0898B7B0FCC91FA15D8A69_26C7F4B3495094E052465C09FE520C26der
MD5:7728F55671EC7851CCB250C6AD262F42
SHA256:288EF07B0AA01FEB0A7D34B78F057883611EFE4E03144263E27ECAE9AACE2824
2616iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288Bbinary
MD5:C167128120C766EE544428C95FA5B803
SHA256:7EC5064E4112EDBC393AF792319D4A81FA66D055C9844D316618BF49065EDD98
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
88
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2616
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEBN9U5yqfDGppDNwGWiEeo0%3D
US
der
727 b
whitelisted
2616
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEBN9U5yqfDGppDNwGWiEeo0%3D
US
der
727 b
whitelisted
2616
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEBN9U5yqfDGppDNwGWiEeo0%3D
US
der
727 b
whitelisted
2616
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEBN9U5yqfDGppDNwGWiEeo0%3D
US
der
727 b
whitelisted
2616
iexplore.exe
GET
200
151.139.128.14:80
http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl
US
der
978 b
whitelisted
2616
iexplore.exe
GET
200
142.250.185.195:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEFHDnp8qw0uNAwAAAADL1z8%3D
US
der
471 b
whitelisted
2616
iexplore.exe
GET
200
151.139.128.14:80
http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl
US
der
978 b
whitelisted
2616
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEQCxO7cScNSyI7vtcvHevU2x
US
der
472 b
whitelisted
2532
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2532
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2616
iexplore.exe
142.250.185.138:443
fonts.googleapis.com
Google Inc.
US
whitelisted
2616
iexplore.exe
185.59.220.194:443
gateway.jerkmate.com
Datacamp Limited
DE
suspicious
2616
iexplore.exe
151.139.128.14:80
ocsp.usertrust.com
Highwinds Network Group, Inc.
US
suspicious
2616
iexplore.exe
142.250.185.195:80
ocsp.pki.goog
Google Inc.
US
whitelisted
2616
iexplore.exe
142.250.186.131:443
fonts.gstatic.com
Google Inc.
US
whitelisted
2616
iexplore.exe
142.250.186.40:443
www.googletagmanager.com
Google Inc.
US
suspicious
2616
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2532
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
4
System
65.9.66.8:445
rules.quantcount.com
AT&T Services, Inc.
US
suspicious
4
System
65.9.66.6:445
rules.quantcount.com
AT&T Services, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
fonts.googleapis.com
  • 142.250.185.138
whitelisted
gateway.jerkmate.com
  • 185.59.220.194
  • 185.59.220.198
malicious
ocsp.usertrust.com
  • 151.139.128.14
whitelisted
ocsp.pki.goog
  • 142.250.185.195
whitelisted
ocsp.sectigo.com
  • 151.139.128.14
whitelisted
fonts.gstatic.com
  • 142.250.186.131
whitelisted
www.googletagmanager.com
  • 142.250.186.40
whitelisted
secure.quantserve.com
  • 91.228.74.226
  • 91.228.74.134
  • 91.228.74.189
  • 91.228.74.198
  • 91.228.74.133
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
api.bing.com
  • 13.107.13.80
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
index.html