Edit tour

Windows Analysis Report
https://cookcountyil.my.canva.site/

Overview

General Information

Sample URL:	https://cookcountyil.my.canva.site/
Analysis ID:	1596234
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

AI detected suspicious Javascript

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML title does not match URL

Invalid T&C link found

Sample execution stops while process was sleeping (likely an evasion)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4828 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5764 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2212,i,11843610541508885920,4969398186590137081,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6724 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5500 --field-trial-handle=2212,i,11843610541508885920,4969398186590137081,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cookcountyil.my.canva.site/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

conhost.exe (PID: 6576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://5261427917.feddocsolutions.com/next.php

Avira URL Cloud: Label: malware

Phishing

AI detected phishing page

Source: https://cookcountyil.courtfilenet.com/qukn8/	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The provided URL 'cookcountyil.courtfilenet.com' does not match the legitimate domain for Microsoft., The URL contains multiple segments and does not resemble any known Microsoft subdomains or services., The domain 'courtfilenet.com' does not have any known association with Microsoft., The presence of a seemingly unrelated domain name suggests a potential phishing attempt. DOM: 2.4.pages.csv
Source: https://cookcountyil.courtfilenet.com/qukn8/	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The provided URL 'cookcountyil.courtfilenet.com' does not match the legitimate domain for Microsoft., The URL does not contain any elements that suggest a direct association with Microsoft., The domain 'courtfilenet.com' appears unrelated to Microsoft and may be used to impersonate or mislead users., The presence of a subdomain 'cookcountyil' suggests a possible attempt to mimic a legitimate service or entity, but it is not related to Microsoft., The input field 'qwyxaw@tvtoymw.io' does not provide any context that links it to Microsoft, increasing suspicion. DOM: 2.5.pages.csv

AI detected suspicious Javascript

Source: 0.26.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://cookcountyil.courtfilenet.com/qukn8/... This script exhibits several high-risk behaviors, including dynamic code execution through the use of `atob()` to decode a potentially malicious value, and the presence of obfuscated code and URLs. Additionally, the script appears to be collecting and potentially exfiltrating user data through the use of the `location.search` property. These factors indicate a high likelihood of malicious intent, warranting a risk score of 8.