analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| URL: | http://api.htmlobfuscator.com |
| Full analysis: | https://app.any.run/tasks/d5f4db19-a8db-4be8-824f-b6bcb1f962b3 |
| Verdict: | Malicious activity |
| Analysis date: | December 14, 2018, 13:49:28 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | C512A518C5885D09EFB1A67A4E2E2845 |
| SHA1: | DEB6197096CF9249E1923C6AC35D3DB706A5C1F1 |
| SHA256: | 9F016A289277C6CEDF4B5214E48BF283CB3BB5FB6A080B20A03387F2ABE6A427 |
| SSDEEP: | 3:N1Kf8UJcXGJI:CEUzG |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Application launched itself
- iexplore.exe (PID: 2820)
Reads Internet Cache Settings
- iexplore.exe (PID: 2820)
- iexplore.exe (PID: 3136)
Changes internet zones settings
- iexplore.exe (PID: 2820)
Creates files in the user directory
- iexplore.exe (PID: 3136)
Reads internet explorer settings
- iexplore.exe (PID: 3136)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
31
Monitored processes
2
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2820 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3136 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2820 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
Total events
390
Read events
328
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
7
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2820 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 2820 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 3136 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\ww1_htmlobfuscator_com[1].txt | — | |
MD5:— | SHA256:— | |||
| 3136 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@htmlobfuscator[1].txt | text | |
MD5:CF35AEE7C5209C45BD01210CDA304AC7 | SHA256:1D92818AE6F6DA1F8185B83B2EC156B332D26FB8F87861C03C43BFB4BE604DED | |||
| 3136 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\logo_white[1].png | image | |
MD5:39B0A05252EEA66E96C606EE3A957756 | SHA256:C2BF172FEEF4965B1E8251052062B1F26DD97A240399B3C51FF0F5160127760D | |||
| 2820 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012018121420181215\index.dat | dat | |
MD5:417CD8AC83C32736AC281A9D34AE416E | SHA256:9538A3AD61819CA52A0DDA1627592E6BEF99988E2806D148C7B3D91B6923D816 | |||
| 3136 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\ww1_htmlobfuscator_com[1].htm | html | |
MD5:19DD134ADD0F7D703BAC71C55FD4257F | SHA256:F37F73058795CDA16F21AECC50CDC101573DEF312F38927417EF6E4B245FDD05 | |||
| 3136 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\caf[1].js | text | |
MD5:4C1357FDA1328E439E6BBB996A0F898C | SHA256:1DC59DAD7BA1F9E5D30AC6ACFC0371AF2EBD68F825695BA2F3DBB37BFEF3EAA8 | |||
| 3136 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\jquery-1.4.2.min[1].js | text | |
MD5:0D658C3F0A7EFAA05A6FCEE9758231B3 | SHA256:E186F74C971A978C1DAF20BB51A1B71BCB075D8D09D678EE1D12665C136B1487 | |||
| 3136 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\enhance[1].js | html | |
MD5:CED50DB333D513ABCC6F7A178214BBAB | SHA256:7E802557F7DC6A9D26CB5E8CF8EEA4DFDCBB7A2A3A478E8853FA1A5B0DB63A99 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
7
DNS requests
6
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3136 | iexplore.exe | GET | 302 | 67.227.226.241:80 | http://api.htmlobfuscator.com/ | US | — | — | malicious |
3136 | iexplore.exe | GET | 200 | 205.234.175.175:80 | http://img.sedoparking.com/js/jquery-1.4.2.min.js | US | text | 26.1 Kb | whitelisted |
3136 | iexplore.exe | GET | 200 | 205.234.175.175:80 | http://img.sedoparking.com/templates/brick_gfx/common/logo_white.png | US | image | 2.18 Kb | whitelisted |
3136 | iexplore.exe | GET | 200 | 67.225.218.50:80 | http://parking.parklogic.com/page/enhance.js?pcId=2&domain=htmlobfuscator.com | US | html | 2.17 Kb | suspicious |
3136 | iexplore.exe | GET | 200 | 72.52.4.90:80 | http://ww1.htmlobfuscator.com/ | US | html | 7.93 Kb | malicious |
3136 | iexplore.exe | GET | 200 | 72.52.4.90:80 | http://ww1.htmlobfuscator.com/log/jserr.php?msg=Object+doesn't+support+this+property+or+method&file=http%3A%2F%2Fwww.google.com%2Fadsense%2Fdomains%2Fcaf.js&line=207 | US | compressed | 7.93 Kb | malicious |
3136 | iexplore.exe | GET | 200 | 172.217.168.228:80 | http://www.google.com/adsense/domains/caf.js | US | text | 52.7 Kb | whitelisted |
3136 | iexplore.exe | GET | 200 | 72.52.4.90:80 | http://ww1.htmlobfuscator.com/log/jserr.php?msg='google'+is+undefined&file=%5Brendered+html%5D&line=100 | US | compressed | 7.93 Kb | malicious |
3136 | iexplore.exe | GET | 200 | 72.52.4.90:80 | http://ww1.htmlobfuscator.com/search/tsc.php?200=MjE3MzE1ODM2&21=MTg1LjIxNy4xMTcuMjY=&681=MTU0NDc5NTM5OGUzM2ViMzI5ZmIzOTk3OGY4Mjk5YjM5ODk4NTg5Nzc1&crc=a212f86ebc692096d9f2b1b8b105e412fea494ea&cv=1 | US | — | — | malicious |
2820 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3136 | iexplore.exe | 72.52.4.90:80 | ww1.htmlobfuscator.com | Akamai Technologies, Inc. | US | whitelisted |
3136 | iexplore.exe | 205.234.175.175:80 | img.sedoparking.com | CacheNetworks, Inc. | US | suspicious |
3136 | iexplore.exe | 172.217.168.228:80 | www.google.com | Google Inc. | US | whitelisted |
3136 | iexplore.exe | 67.227.226.241:80 | api.htmlobfuscator.com | Liquid Web, L.L.C | US | malicious |
2820 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3136 | iexplore.exe | 67.225.218.50:80 | parking.parklogic.com | Liquid Web, L.L.C | US | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| whitelisted |
api.htmlobfuscator.com |
| malicious |
ww1.htmlobfuscator.com |
| malicious |
img.sedoparking.com |
| whitelisted |
parking.parklogic.com |
| suspicious |
www.google.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3136 | iexplore.exe | A Network Trojan was detected | SC TROJAN Malicious behaviour by LNK/Agent.CH |
3136 | iexplore.exe | A Network Trojan was detected | SC TROJAN Malicious behaviour by LNK/Agent.CH |
3136 | iexplore.exe | A Network Trojan was detected | SC BAD_UNKNOWN Trojan Unknown JS |