analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| download: | index.html |
| Full analysis: | https://app.any.run/tasks/13b45165-7e6e-4577-a67f-3d596c11d821 |
| Verdict: | No threats detected |
| Analysis date: | November 13, 2020, 00:37:54 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/html |
| File info: | HTML document, ASCII text, with very long lines, with CRLF, LF line terminators |
| MD5: | AB9A846C21C09FD1E082156395077DF8 |
| SHA1: | 24D3DC6F6C3C6F684BCF30A1D1E55F75C6BFADD4 |
| SHA256: | 9DB39945F7C9AA8BF6186C9066370DD6FD7BC0A5C3AD758FE35285A6F4296026 |
| SSDEEP: | 384:25UDg5PnimrfIVl7ygywZXjErHH+a3/9ggs1v7f1z:25vU7ygRto+aPDyz1z |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Reads settings of System Certificates
- iexplore.exe (PID: 2080)
- iexplore.exe (PID: 2028)
Reads Internet Cache Settings
- iexplore.exe (PID: 3712)
- iexplore.exe (PID: 2080)
Application launched itself
- iexplore.exe (PID: 2028)
- iexplore.exe (PID: 2080)
Changes settings of System certificates
- iexplore.exe (PID: 2028)
- iexplore.exe (PID: 2080)
Changes internet zones settings
- iexplore.exe (PID: 2080)
Adds / modifies Windows certificates
- iexplore.exe (PID: 2080)
- iexplore.exe (PID: 2028)
Reads internet explorer settings
- iexplore.exe (PID: 2028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .htm/html | | | HyperText Markup Language with DOCTYPE (80.6) |
|---|---|---|
| .html | | | HyperText Markup Language (19.3) |
EXIF
HTML
| ContentScriptType: | text/javascript |
|---|---|
| ContentType: | text/html; charset=UTF-8 |
| Description: | Beautiful and young girls love to show themselves on an online camera so that you drool! You will find the best pictures of young and naked schoolgirls in the rare section. New perescope broadcasts, Snapchats, Tik-Tok videos, and much more you will see on Lolcams.cc |
| Keywords: | ass, boobs ,cute, forum, girls, hebe, hot, jailbaits, jb, jfraction, jimperial, kingpass, kitty, kittygfs, lsmagazine, ls-models, models, mouse, nonude, nude, omegle, periscope, photos, pthc, pussy, secret, session, sets, sexy, siberian, skype, snapcamera, snapcams, snapchat, stickam, teens, tiktok, tinder, tits, vichatter, webcam, young |
| Title: | LoL Cams | Teen Snapchat and Stickam JB Video Forum |
Total processes
36
Monitored processes
3
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2080 | "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\index.html | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
| 2028 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2080 CREDAT:144385 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
| 3712 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2080 CREDAT:333057 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | — | iexplore.exe |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
Total events
1 438
Read events
1 334
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
17
Text files
23
Unknown types
8
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2028 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\CabAE68.tmp | — | |
MD5:— | SHA256:— | |||
| 2028 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\TarAE69.tmp | — | |
MD5:— | SHA256:— | |||
| 2028 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\banner5[1].jpg | image | |
MD5:DC92DE524154A175672B2005C8F1CCB6 | SHA256:05CEADE08D39FCC8D94FAFD3E580467D93B648268BA6AAC701D185A592B3ED82 | |||
| 2028 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\big[1].png | image | |
MD5:87CB5621B285E9FC75B7EAF9CC193F8B | SHA256:4C8A367AA8967FC375C55FD5E48D271459B8A66485DB1FB419F47FF88CFDC8A2 | |||
| 2028 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\jquery[1].js | text | |
MD5:506818B27683A76A07C9C026CC4BE3D7 | SHA256:869BFE77FF727251FB013C36805A83179F9DB813C149868E5CA300FD36ABEA28 | |||
| 2028 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6 | binary | |
MD5:C788DF3F661DD98CD33E40059CAD4FA5 | SHA256:18DEB792F0675D4F8D57A3A9B5C04D6649BB26E88FEC906521A56BECBC996BCA | |||
| 2028 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6 | der | |
MD5:0801939D427D90F7DE415AC7A2FEA6BB | SHA256:CBEC26A4042178CEE26CF780F1814C5E46DA3180C4460AF1D60D8F9EADD4290A | |||
| 2028 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\css3[1].css | text | |
MD5:926DB993B5CE157D2F8DC0A3EBBB198B | SHA256:CA63F43EFF03F479BA21B135C7164D4FF0EEF2D0CF3CEA4767C1C52C14833F6E | |||
| 2028 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 | binary | |
MD5:29A2F3937E8B9F23A6D06A430DC5CF2F | SHA256:722377468EE33FC6291F2D4411DC76F6448F2DCE70DCE50C9E4F4E7B6824D59B | |||
| 2028 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 | der | |
MD5:46FF165DFC905AF45123E4CC82F40AC5 | SHA256:472064C9A965DEF489BD43CE287B62E0F18CB3FA884E3BE7DDA934F2D958949D | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
35
DNS requests
19
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2028 | iexplore.exe | GET | 302 | 5.8.63.7:80 | http://18top.link/button.php?u=jbcams | US | — | — | malicious |
2028 | iexplore.exe | GET | 200 | 103.16.26.85:80 | http://lolcams.al/cache/themes/theme1/css3.css | HK | text | 3.04 Kb | unknown |
2028 | iexplore.exe | GET | 200 | 103.16.26.85:80 | http://lolcams.al/cache/themes/theme1/global.css | HK | text | 30.3 Kb | unknown |
2028 | iexplore.exe | GET | 200 | 103.16.26.85:80 | http://lolcams.al/images/headerlinks_sprite.png | HK | image | 2.29 Kb | unknown |
2028 | iexplore.exe | GET | 200 | 103.16.26.85:80 | http://lolcams.al/images/logo_lol_370x100.png | HK | image | 29.9 Kb | unknown |
2028 | iexplore.exe | GET | 200 | 103.16.26.85:80 | http://lolcams.al/images/thead.png | HK | image | 115 b | unknown |
2028 | iexplore.exe | GET | 200 | 103.16.27.80:80 | http://snaps.al/banner5.jpg | HK | image | 9.26 Kb | suspicious |
2028 | iexplore.exe | GET | 200 | 103.16.26.85:80 | http://lolcams.al/images/buttons_bg.png | HK | image | 101 b | unknown |
2028 | iexplore.exe | GET | 200 | 103.16.26.85:80 | http://lolcams.al/images/tcat.png | HK | image | 131 b | unknown |
2028 | iexplore.exe | GET | 200 | 104.21.234.41:80 | http://vipmodels.tv/banners/big.png | US | image | 93.5 Kb | suspicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2028 | iexplore.exe | 103.16.26.85:80 | lolcams.al | Hong Kong Serverworks Limited | HK | unknown |
2028 | iexplore.exe | 151.101.12.193:443 | i.imgur.com | Fastly | US | malicious |
2028 | iexplore.exe | 103.16.27.80:80 | snaps.al | Hong Kong Serverworks Limited | HK | suspicious |
2028 | iexplore.exe | 104.21.234.41:80 | vipmodels.tv | Cloudflare Inc | US | suspicious |
2028 | iexplore.exe | 5.8.63.7:80 | 18top.link | Handy Networks, LLC | US | suspicious |
2028 | iexplore.exe | 104.24.111.242:443 | cutetop.space | Cloudflare Inc | US | unknown |
2028 | iexplore.exe | 172.67.221.246:443 | toplist.2nn.xyz | — | US | unknown |
2028 | iexplore.exe | 104.18.51.12:80 | toplist.2nn.xyz | Cloudflare Inc | US | suspicious |
2080 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
— | — | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
lolcams.al |
| unknown |
i.imgur.com |
| shared |
vipmodels.tv |
| suspicious |
snaps.al |
| suspicious |
cutecams.space |
| unknown |
toplist.2nn.xyz |
| suspicious |
cutetop.space |
| unknown |
tp1.2nn.xyz |
| suspicious |
18top.link |
| malicious |
ocsp.digicert.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2028 | iexplore.exe | Potentially Bad Traffic | AV INFO HTTP Request to a *.xyz domain |