download: | index.html |
Full analysis: | https://app.any.run/tasks/9dafb873-9092-4973-80b0-5e06a6a324cb |
Verdict: | Malicious activity |
Analysis date: | January 18, 2019, 07:00:55 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/html |
File info: | HTML document, UTF-8 Unicode text, with very long lines |
MD5: | 02D3AAC5490209E6BE14539CDEFE692E |
SHA1: | 299F1BEB90D445EB286980E356652D0A79B73AD3 |
SHA256: | CE6333AE3E28A96AB6CB02E4BFD2DF40D69514E8DD54E0567C612B6FC991ACD1 |
SSDEEP: | 768:NUNNTcpNv+r5AZpUxnHeCb4f1u0eywO0H+UJFqUAl9USoKjDbga30:NUU6nzcUSoKjp0 |
.html | | | HyperText Markup Language (100) |
---|
Refresh: | 0;URL=http://gg.gg/cwtna |
---|---|
Generator: | blogger |
msapplicationNavbuttonColor: | #eeeeee |
themeColor: | #eeeeee |
ContentType: | text/html; charset=UTF-8 |
Title: | pabzewsthinri1974 |
viewport: | width=device-width, initial-scale=1 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2992 | "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\index.html | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3464 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2992 CREDAT:79873 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3292 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2992 CREDAT:137473 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2992 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
2992 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
2992 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFE1DD7F6A9E7E14F2.TMP | — | |
MD5:— | SHA256:— | |||
3292 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\bootstrap[1].css | text | |
MD5:9AF8936DFD9ACD0BDF62D8D532CF6BFE | SHA256:A1C2CD3458B84401B707E3C090E6A726EA11B145F0A23178EB3F4B3B1DD45D15 | |||
3464 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019011820190119\index.dat | dat | |
MD5:E83BE51ACC4640A5F523E0800ED60AE1 | SHA256:0828EB473113C4425FAA9074DB51F0A264C1CAA843A2FB54F63A1F3D9431DC01 | |||
3292 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\asseenin[1].jpg | image | |
MD5:28F5AA523E75FDAAF8CF33D3034A2975 | SHA256:F5ECE729D9C97A39C66AA124F9ACEC039EA0D43250505FCD17827803E89390FA | |||
3292 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@juntre[1].txt | text | |
MD5:872AA6CA72FD43186F3AF2C05429A488 | SHA256:DB31D8C49C03F1078F6C1A1673188FFC371D2E76FD18AB3CBCEDF319123517D1 | |||
3292 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\timer2[1].js | text | |
MD5:C99855E7B44147AA00B38056B6E4F5EE | SHA256:223EAB4A14511AD0CD76360C5BE4F08E7E4AB938EF514D8ACFCCF3129349C1E2 | |||
3292 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\font-awesome[1].css | text | |
MD5:3606D902006E9D86A3ACCD48DFFFC285 | SHA256:00EBF74557A2F5060F100C45BE2CD2FA1E3D61010F1C8783A5A6F881501EFE86 | |||
2992 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{B130D0CC-1AF2-11E9-AA93-5254004A04AF}.dat | binary | |
MD5:9A8B8CED2455F6F428516B107136D388 | SHA256:651EB3F5239A41D7A6C8E25719F2762C2CB7B34E7C96A88C7087A61473EDCD25 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3292 | iexplore.exe | GET | — | 104.31.94.206:80 | http://prl.juntre.club/prelands/401/cnnmoney-icons.eot%3F%22)%20format(%22embedded-opentype%22),%20url(%22../fonts/cnnmoney-icons.woff%22)%20format(%22woff | US | — | — | suspicious |
3292 | iexplore.exe | GET | 302 | 104.31.94.206:80 | http://vip.juntre.club/tracker?offer_id=2164&aff_id=225&pl=401:100&cb=1&gl=off | US | — | — | suspicious |
3292 | iexplore.exe | GET | 301 | 104.27.202.93:80 | http://gg.gg/cwtna | US | — | — | shared |
3292 | iexplore.exe | GET | 200 | 104.31.94.206:80 | http://prl.juntre.club/prelands/401/fonts/cnn-tech-logo_tech-2_black.svg | US | image | 573 b | suspicious |
3292 | iexplore.exe | GET | 200 | 104.31.94.206:80 | http://prl.juntre.club/prelands/401/css/bootstrap.css | US | text | 19.5 Kb | suspicious |
3292 | iexplore.exe | GET | 200 | 104.31.94.206:80 | http://prl.juntre.club/prelands/401/css/style.css | US | text | 8.96 Kb | suspicious |
3292 | iexplore.exe | GET | 200 | 104.31.94.206:80 | http://prl.juntre.club/prelands/401/images/asseenin.jpg | US | image | 17.2 Kb | suspicious |
3292 | iexplore.exe | GET | 200 | 104.31.94.206:80 | http://prl.juntre.club/?pl=401.1cd8162ecbbf19232619c2e01db1fffc&n=aHR0cDovL2VuLmJpdGNvaW4tc29mdC52aXAuanVudHJlLmNsdWIvP3Nlc3Npb249ZDM4ODI4NzhhYmU0NDNiNTlmNjc3YTRmOTJiMjI2ZTQmYWZmX2lkPTIyNSZjYj0xJmZwcD0xJmJwPTE= | US | html | 13.6 Kb | suspicious |
3292 | iexplore.exe | GET | 200 | 104.31.94.206:80 | http://prl.juntre.club/prelands/401/images/zz1.jpg | US | image | 90.0 Kb | suspicious |
3292 | iexplore.exe | GET | 404 | 104.31.94.206:80 | http://prl.juntre.club/prelands/401/cnntech-icons.eot%3F')%20format('embedded-opentype'),%20url('../fonts/cnntech-icons.woff')%20format('woff'),%20url('../cnntech-icons.ttf.html')%20format('truetype | US | html | 264 b | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2992 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3464 | iexplore.exe | 172.217.21.195:443 | www.gstatic.com | Google Inc. | US | whitelisted |
3464 | iexplore.exe | 216.58.205.225:443 | themes.googleusercontent.com | Google Inc. | US | whitelisted |
3464 | iexplore.exe | 172.217.22.105:443 | resources.blogblog.com | Google Inc. | US | whitelisted |
3292 | iexplore.exe | 104.31.94.206:80 | vip.juntre.club | Cloudflare Inc | US | shared |
2992 | iexplore.exe | 104.31.94.206:80 | vip.juntre.club | Cloudflare Inc | US | shared |
3292 | iexplore.exe | 104.18.48.221:443 | cdn.dolly.media | Cloudflare Inc | US | shared |
3292 | iexplore.exe | 104.27.202.93:80 | gg.gg | Cloudflare Inc | US | shared |
Domain | IP | Reputation |
---|---|---|
www.bing.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
resources.blogblog.com |
| whitelisted |
themes.googleusercontent.com |
| whitelisted |
www.blogger.com |
| shared |
gg.gg |
| shared |
vip.juntre.club |
| suspicious |
prl.juntre.club |
| suspicious |
cdn.dolly.media |
| whitelisted |