Edit tour

Windows Analysis Report
Integraconnect Play Now 484 484 6292.htm

Overview

General Information

Sample name:	Integraconnect Play Now 484 484 6292.htm
Analysis ID:	1430328
MD5:	7340ca3c4e18602b676b2a122b83837b
SHA1:	b63e55cd19c68dab54ed1463220e16c0949b1f37
SHA256:	2974def24153a91cf17dde201fa291b17e6547d1541034e221b41e21a1d00a81
Infos:

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

HTML file submission requesting Cloudflare captcha challenge

Yara detected HtmlPhish10

Detected javascript redirector / loader

HTML document with suspicious name

HTML document with suspicious title

HTML page contains suspicious base64 encoded javascript

Phishing site detected (based on logo match)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden URLs or javascript code

HTML title does not match URL

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Invalid T&C link found

JA3 SSL client fingerprint seen in connection with other malware

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Integraconnect Play Now 484 484 6292.htm" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5968 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2000,i,829850008273557891,11942607362507623547,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
3.4.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
4.5.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish10

Source: Yara match	File source: 3.4.pages.csv, type: HTML
Source: Yara match	File source: 4.5.pages.csv, type: HTML

Detected javascript redirector / loader

Source: Integraconnect Play Now 484 484 6292.htm

HTTP Parser: Low number of body elements: 1

HTML document with suspicious title

Source: file:///C:/Users/user/Desktop/Integraconnect%20Play%20Now%20484%20484%206292.htm

Tab title: Integraconnect Play Now 484 484 6292.htm

HTML page contains suspicious base64 encoded javascript

Source: https://aq38e.ishuter.com/kUNZy5W/#Hmelanie.mcclannan@integraconnect.com

HTTP Parser: Base64 decoded: <script>

Phishing site detected (based on logo match)

Source: https://aq38e.ishuter.com/1303648218011338311063032pBluSckRQXEXDSNBUDUNLOUZOTQHFOVHNNHKOJUMLKQUUZGOIXUHMMPNY?smVDNiDmOLwWGqFeokfSHkCXSabKXVGHMFTUYATNRBOJEOJAOPJUGUBS	Matcher: Template: microsoft matched
Source: https://aq38e.ishuter.com/1303648218011338311063032pBluSckRQXEXDSNBUDUNLOUZOTQHFOVHNNHKOJUMLKQUUZGOIXUHMMPNY?smVDNiDmOLwWGqFeokfSHkCXSabKXVGHMFTUYATNRBOJEOJAOPJUGUBS#	Matcher: Template: microsoft matched