Edit tour

Windows Analysis Report
https://rise.articulate.com/share/zO8B8EFq4bxdit8kVRcUzBOZMbkl1WSz#/lessons/2GyyR-D75sLlZcXDanN5dOaLxSSkgNvo

Overview

General Information

Sample URL:	https://rise.articulate.com/share/zO8B8EFq4bxdit8kVRcUzBOZMbkl1WSz#/lessons/2GyyR-D75sLlZcXDanN5dOaLxSSkgNvo
Analysis ID:	1432378
Infos:

Detection

HTMLPhisher

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Yara detected HtmlPhish10

Yara detected HtmlPhish7

Phishing site or detected (based on various text indicators)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML title does not match URL

Phishing site detected (based on OCR NLP Model)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3752 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5332 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1944,i,14890840254824104869,1922609647715769866,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6520 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://rise.articulate.com/share/zO8B8EFq4bxdit8kVRcUzBOZMbkl1WSz#/lessons/2GyyR-D75sLlZcXDanN5dOaLxSSkgNvo" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_142	JoeSecurity_HtmlPhish_7	Yara detected HtmlPhish_7	Joe Security
dropped/chromecache_142	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTML

Source	Rule	Description	Author	Strings
3.6.pages.csv	JoeSecurity_HtmlPhish_7	Yara detected HtmlPhish_7	Joe Security
3.6.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://moink.missionoutdoors.org/images/gmail.png	Avira URL Cloud: Label: phishing
Source: https://missionoutdoors.org/wp-legalagreement.php	Avira URL Cloud: Label: phishing

Phishing

Yara detected HtmlPhish10

Source: Yara match	File source: 3.6.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_142, type: DROPPED

Yara detected HtmlPhish7

Source: Yara match	File source: 3.6.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_142, type: DROPPED

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 3.6

OCR Text: Adobe Document Cloud To read the document, please choose your email provider below login to view shared file. _ Sign in with Outlook Sign in with Office365 O Sign in with Other Mail Built uEX)n Adobe Document Cloud, Document Cloud features can be unlocked by providing an additional license key. CopyRightO 2024 Adobe system incorporated, All right reserved.