Edit tour

Windows Analysis Report
https://us-west-2.protection.sophos.com/?d=powerbi.com&u=aHR0cHM6Ly9hcHAucG93ZXJiaS5jb20vdmlldz9yPWV5SnJJam9pWWpBNU5UZGtPVEl0T1RVNVpDMDBNVEl3TFRrNFpqVXROR1U1T0dWaU5XVTVNRE01SWl3aWRDSTZJakUxTVdNeE5qWmxMV00zWldFdE5HSTFaQzFoTWpRM0xUTmtNVEF5TlRFelkySXdNeUo5&i=NjAzNTFlYmUxMmQ2N2MzMjNhNzYzZDg0&t=cXRBVTE0Z

Overview

General Information

Sample URL:	https://us-west-2.protection.sophos.com/?d=powerbi.com&u=aHR0cHM6Ly9hcHAucG93ZXJiaS5jb20vdmlldz9yPWV5SnJJam9pWWpBNU5UZGtPVEl0T1RVNVpDMDBNVEl3TFRrNFpqVXROR1U1T0dWaU5XVTVNRE01SWl3aWRDSTZJakUxTVdNeE5qWmx
Analysis ID:	1611314
Infos:

Detection

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

AI detected suspicious Javascript

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded SVGs detected

HTML body with high number of embedded images detected

HTML title does not match URL

Invalid T&C link found

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 4872 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6896 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1936,i,17990906817109875502,10326347469112585898,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6516 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://us-west-2.protection.sophos.com/?d=powerbi.com&u=aHR0cHM6Ly9hcHAucG93ZXJiaS5jb20vdmlldz9yPWV5SnJJam9pWWpBNU5UZGtPVEl0T1RVNVpDMDBNVEl3TFRrNFpqVXROR1U1T0dWaU5XVTVNRE01SWl3aWRDSTZJakUxTVdNeE5qWmxMV00zWldFdE5HSTFaQzFoTWpRM0xUTmtNVEF5TlRFelkySXdNeUo5&i=NjAzNTFlYmUxMmQ2N2MzMjNhNzYzZDg0&t=cXRBVTE0Z3RLSGRTdEd4cm1WNzFhUm4wLzUzdXZKYklHYmduYnhYNlpsVT0=&h=5e715a0526a946bcaa614abc851141f0&s=AVNPUEhUT0NFTkNSWVBUSVYXtWfTC_gnxLfx0tqsdWatsuMxIHchoBDvy0tVrFrMxg" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://invoicepayout.storagedocumentapp.com/gQete/1.png	Avira URL Cloud: Label: malware
Source: https://5023386162.hostingfederal.com/next.php	Avira URL Cloud: Label: malware

Phishing

AI detected phishing page

Source: https://invoicepayout.storagedocumentapp.com/gQete/	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL 'invoicepayout.storagedocumentapp.com' does not match the legitimate domain 'microsoft.com'., The domain 'storagedocumentapp.com' is not associated with Microsoft., The use of a subdomain 'invoicepayout' and the main domain 'storagedocumentapp.com' is suspicious and not typical for Microsoft services., The presence of input fields asking for email on a non-Microsoft domain increases the risk of phishing. DOM: 2.8.pages.csv
Source: https://invoicepayout.storagedocumentapp.com/gQete/	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL 'invoicepayout.storagedocumentapp.com' does not match the legitimate domain 'microsoft.com'., The domain 'storagedocumentapp.com' is not associated with Microsoft and appears to be a generic or unrelated domain., The use of a subdomain 'invoicepayout' could be an attempt to mimic a legitimate service or function related to Microsoft., The email domain 'omegalole.net' is unrelated to Microsoft, which raises suspicion., The URL structure and domain do not align with typical Microsoft services or products. DOM: 2.9.pages.csv

AI detected suspicious Javascript

Source: 0.45.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://invoicepayout.storagedocumentapp.com/gQete... This script exhibits several high-risk behaviors, including dynamic code execution through the use of `atob()` to decode a value from the URL, and potential data exfiltration by sending the decoded value to an unknown destination. The script also uses obfuscated code and URL parameters, which further increases the risk. While the specific intent is unclear, the overall behavior is highly suspicious and indicative of a potentially malicious script.