Find similar analyses in TI Lookup
Analysis date (UTC): 20 May 2025, 11:06Analysis environment: Windows 10 Pro, build 19044, x64

http://deliv.date/

MD5:D1569A15595EE3D1365E8A961E72CF29
SHA1:134C20EBAD06E490C562893D8C2925A8CD5DE12A
SHA256:99B2B7C4E90864DE5916F099EAFE9CF464938E37DDC85E5518DB29861D8D3096

Analysis result

Threat level:Malicious activity
Tags:
obfuscated-jsphishingautogeneric
Full analysis:Analysis http://deliv.date/ Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

GENERIC has been found (auto)

  • msedge.exe (PID: 6268)
  • msedge.exe (PID: 7352)

PHISHING has been detected (SURICATA)

  • svchost.exe (PID: 2196)

SUSPICIOUS

Executable content was dropped or overwritten

  • NinjaBrowser_7qaksTSsF6.exe (PID: 1168)
  • NinjaBrowser_7qaksTSsF6.exe (PID: 644)
  • NinjaBrowser_7qaksTSsF6.tmp (PID: 6228)

Reads security settings of Internet Explorer

  • NinjaBrowser_7qaksTSsF6.tmp (PID: 5508)

Reads the Windows owner or organization settings

  • NinjaBrowser_7qaksTSsF6.tmp (PID: 6228)

INFO

Reads Environment values

  • identity_helper.exe (PID: 7756)

Checks supported languages

  • identity_helper.exe (PID: 7756)
  • NinjaBrowser_7qaksTSsF6.exe (PID: 1168)
  • NinjaBrowser_7qaksTSsF6.tmp (PID: 5508)
  • NinjaBrowser_7qaksTSsF6.exe (PID: 644)
  • NinjaBrowser_7qaksTSsF6.tmp (PID: 6228)

Reads the computer name

  • identity_helper.exe (PID: 7756)
  • NinjaBrowser_7qaksTSsF6.tmp (PID: 5508)
  • NinjaBrowser_7qaksTSsF6.exe (PID: 644)
  • NinjaBrowser_7qaksTSsF6.tmp (PID: 6228)

Application launched itself

  • msedge.exe (PID: 6268)

Executable content was dropped or overwritten

  • msedge.exe (PID: 7352)
  • msedge.exe (PID: 6268)

Create files in a temporary directory

  • NinjaBrowser_7qaksTSsF6.exe (PID: 1168)
  • NinjaBrowser_7qaksTSsF6.exe (PID: 644)
  • NinjaBrowser_7qaksTSsF6.tmp (PID: 6228)

Process checks computer location settings

  • NinjaBrowser_7qaksTSsF6.tmp (PID: 5508)

Checks proxy server information

  • NinjaBrowser_7qaksTSsF6.tmp (PID: 6228)

Reads the software policy settings

  • NinjaBrowser_7qaksTSsF6.tmp (PID: 6228)

Threats

PIDProcessClassMessage
7352msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
7352msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
7352msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
7352msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
7352msedge.exePotentially Bad TrafficSUSPICIOUS [ANY.RUN] Suspected Malicious domain by CrossDomain (nb-download .com)
7352msedge.exePotentially Bad TrafficSUSPICIOUS [ANY.RUN] Suspected Malicious domain by CrossDomain (nb-download .com)
7352msedge.exePotentially Bad TrafficSUSPICIOUS [ANY.RUN] Suspected Malicious domain by CrossDomain (nb-download .com)
7352msedge.exePotentially Bad TrafficSUSPICIOUS [ANY.RUN] Suspected Malicious domain by CrossDomain (nb-download .com)
2196svchost.exePossible Social Engineering AttemptedPHISHING [ANY.RUN] Suspected Phishing domain by CrossDomain ( .ninja-browser .com)

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED