Click to jump to signature section
| Source: file:///C:/Users/user/Desktop/Final%20Contract.htm | Joe Sandbox AI: Score: 10 Reasons: HTML file with login form DOM: 1.0.pages.csv |
| Source: file:///C:/Users/user/Desktop/Final%20Contract.htm | Joe Sandbox AI: Score: 10 Reasons: HTML file with login form DOM: 1.1.pages.csv |
| Source: Yara match | File source: Final Contract.htm, type: SAMPLE |
| Source: Yara match | File source: 1.1.pages.csv, type: HTML |
| Source: Yara match | File source: 1.0.pages.csv, type: HTML |
| Source: 0.0.id.script.csv | Joe Sandbox AI: Detected suspicious JavaScript with source url: file:///C:/Users/user/Desktop/Final%20Contract... This script demonstrates several high-risk behaviors, including data exfiltration, dynamic code execution, and the use of obfuscated URLs. The script collects user email and password credentials and sends them to a suspicious third-party domain, which is a clear indication of malicious intent. Additionally, the script attempts to redirect the user to a different domain after a certain number of failed login attempts, further suggesting phishing or other malicious activities. Overall, this script poses a significant security risk and should be treated with caution. |
| Source: Final Contract.htm | HTTP Parser: location.href |
| Source: Final Contract.htm | HTTP Parser: .location |
| Source: Final Contract.htm | HTTP Parser: .location |
| Source: file:///C:/Users/user/Desktop/Final%20Contract.htm | HTTP Parser: sj6f1k@nxl.co |
| Source: Final Contract.htm | HTTP Parser: Number of links: 0 |
| Source: file:///C:/Users/user/Desktop/Final%20Contract.htm | HTTP Parser: Number of links: 0 |
| Source: Final Contract.htm | HTTP Parser: <input type="password" .../> found but no <form action="... |
| Source: file:///C:/Users/user/Desktop/Final%20Contract.htm | HTTP Parser: <input type="password" .../> found but no <form action="... |
| Source: Final Contract.htm | HTTP Parser: Title: Adobe Secured File does not match URL |
| Source: file:///C:/Users/user/Desktop/Final%20Contract.htm | HTTP Parser: Title: Adobe Secured File does not match URL |
| Source: Final Contract.htm | HTTP Parser: Invalid link: Privacy & Cookies |
| Source: file:///C:/Users/user/Desktop/Final%20Contract.htm | HTTP Parser: Invalid link: Privacy & Cookies |
| Source: file:///C:/Users/user/Desktop/Final%20Contract.htm | HTTP Parser: Invalid link: Privacy & Cookies |
| Source: file:///C:/Users/user/Desktop/Final%20Contract.htm | HTTP Parser: Has password / email / username input fields |
| Source: Final Contract.htm | HTTP Parser: <input type="password" .../> found |
| Source: file:///C:/Users/user/Desktop/Final%20Contract.htm | HTTP Parser: <input type="password" .../> found |
| Source: Final Contract.htm | HTTP Parser: No favicon |
| Source: file:///C:/Users/user/Desktop/Final%20Contract.htm | HTTP Parser: No favicon |
| Source: file:///C:/Users/user/Desktop/Final%20Contract.htm | HTTP Parser: No favicon |
| Source: Final Contract.htm | HTTP Parser: No <meta name="author".. found |
| Source: file:///C:/Users/user/Desktop/Final%20Contract.htm | HTTP Parser: No <meta name="author".. found |
| Source: file:///C:/Users/user/Desktop/Final%20Contract.htm | HTTP Parser: No <meta name="author".. found |
| Source: Final Contract.htm | HTTP Parser: No <meta name="copyright".. found |
| Source: file:///C:/Users/user/Desktop/Final%20Contract.htm | HTTP Parser: No <meta name="copyright".. found |
| Source: file:///C:/Users/user/Desktop/Final%20Contract.htm | HTTP Parser: No <meta name="copyright".. found |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries | Jump to behavior |
| Source: unknown | HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49709 version: TLS 1.2 |
| Source: unknown | HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49731 version: TLS 1.2 |
| Source: unknown | HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49822 version: TLS 1.2 |
| Source: unknown | HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49946 version: TLS 1.2 |
| Source: unknown | HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50009 version: TLS 1.2 |
| Source: unknown | HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50012 version: TLS 1.2 |
| Source: unknown | HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50014 version: TLS 1.2 |
| Source: unknown | HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50015 version: TLS 1.2 |
| Source: Network traffic | Suricata IDS: 2031566 - Severity 1 - ET PHISHING Terse POST to Wordpress Folder - Probable Successful Phishing : 192.168.2.6:49927 -> 66.206.36.128:443 |
| Source: Network traffic | Suricata IDS: 2031566 - Severity 1 - ET PHISHING Terse POST to Wordpress Folder - Probable Successful Phishing : 192.168.2.6:50008 -> 66.206.36.128:443 |
| Source: Network traffic | Suricata IDS: 2031566 - Severity 1 - ET PHISHING Terse POST to Wordpress Folder - Probable Successful Phishing : 192.168.2.6:50003 -> 66.206.36.128:443 |
| Source: global traffic | TCP traffic: 192.168.2.6:49968 -> 1.1.1.1:53 |
| Source: Joe Sandbox View | IP Address: 199.232.192.193 199.232.192.193 |
| Source: Joe Sandbox View | IP Address: 199.232.196.193 199.232.196.193 |
| Source: Joe Sandbox View | IP Address: 239.255.255.250 239.255.255.250 |
| Source: Joe Sandbox View | ASN Name: TURNKEY-INTERNETUS TURNKEY-INTERNETUS |
| Source: Joe Sandbox View | JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e |
| Source: Network traffic | Suricata IDS: 2812237 - Severity 1 - ETPRO PHISHING Possible Successful Generic Phish July 28 : 192.168.2.6:49927 -> 66.206.36.128:443 |
| Source: Network traffic | Suricata IDS: 2812237 - Severity 1 - ETPRO PHISHING Possible Successful Generic Phish July 28 : 192.168.2.6:50008 -> 66.206.36.128:443 |
| Source: Network traffic | Suricata IDS: 2812237 - Severity 1 - ETPRO PHISHING Possible Successful Generic Phish July 28 : 192.168.2.6:50003 -> 66.206.36.128:443 |
| Source: Network traffic | Suricata IDS: 2025005 - Severity 1 - ET PHISHING Possible Successful Generic Phish Jan 14 2016 : 66.206.36.128:443 -> 192.168.2.6:49927 |
| Source: Network traffic | Suricata IDS: 2025005 - Severity 1 - ET PHISHING Possible Successful Generic Phish Jan 14 2016 : 66.206.36.128:443 -> 192.168.2.6:50003 |
| Source: Network traffic | Suricata IDS: 2025005 - Severity 1 - ET PHISHING Possible Successful Generic Phish Jan 14 2016 : 66.206.36.128:443 -> 192.168.2.6:50008 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 173.222.162.64 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 173.222.162.64 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 173.222.162.64 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 173.222.162.64 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 173.222.162.64 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 173.222.162.64 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 173.222.162.64 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 40.113.103.199 |
| Source: unknown | TCP traffic detected without corresponding DNS query: 1.1.1.1 |
| Source: global traffic | HTTP traffic detected: GET /gOkYzuw.png HTTP/1.1Host: i.imgur.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | HTTP traffic detected: GET /gOkYzuw.png HTTP/1.1Host: i.imgur.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: global traffic | DNS traffic detected: DNS query: i.imgur.com |
| Source: global traffic | DNS traffic detected: DNS query: www.google.com |
| Source: global traffic | DNS traffic detected: DNS query: airtekincheatingandcooling.com |
| Source: unknown | HTTP traffic detected: POST /wp-induc/adobe.php HTTP/1.1Host: airtekincheatingandcooling.comConnection: keep-aliveContent-Length: 59sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: */*Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
| Source: Final Contract.htm | String found in binary or memory: https://airtekincheatingandcooling.com/wp-induc/adobe.php |
| Source: Final Contract.htm | String found in binary or memory: https://i.imgur.com/gOkYzuw.png |
| Source: unknown | Network traffic detected: HTTP traffic on port 49674 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 49708 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 49672 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 49731 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 49706 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 50009 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 50011 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 50015 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 49725 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 50012 |
| Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 50011 |
| Source: unknown | Network traffic detected: HTTP traffic on port 49748 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 50014 |
| Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 50015 |
| Source: unknown | Network traffic detected: HTTP traffic on port 50003 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49717 |
| Source: unknown | Network traffic detected: HTTP traffic on port 49717 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49714 |
| Source: unknown | Network traffic detected: HTTP traffic on port 49709 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 50012 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49731 |
| Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 50009 |
| Source: unknown | Network traffic detected: HTTP traffic on port 49673 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 50008 |
| Source: unknown | Network traffic detected: HTTP traffic on port 49927 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 50008 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 49822 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 49946 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 50014 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 49703 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 50003 |
| Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49709 |
| Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49708 |
| Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49927 |
| Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49706 |
| Source: unknown | Network traffic detected: HTTP traffic on port 49714 -> 443 |
| Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49748 |
| Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49946 |
| Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49725 |
| Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49703 |
| Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49822 |
| Source: unknown | HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49709 version: TLS 1.2 |
| Source: unknown | HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49731 version: TLS 1.2 |
| Source: unknown | HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49822 version: TLS 1.2 |
| Source: unknown | HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49946 version: TLS 1.2 |
| Source: unknown | HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50009 version: TLS 1.2 |
| Source: unknown | HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50012 version: TLS 1.2 |
| Source: unknown | HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50014 version: TLS 1.2 |
| Source: unknown | HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50015 version: TLS 1.2 |
| Source: classification engine | Classification label: mal76.phis.winHTM@26/3@8/7 |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | File created: C:\Program Files\Google\Chrome\Application\Dictionaries | Jump to behavior |
| Source: unknown | Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Final Contract.htm" | |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2216,i,4583716381143380160,5174444017956621571,262144 /prefetch:8 | |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2216,i,4583716381143380160,5174444017956621571,262144 /prefetch:8 | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Process created: unknown unknown | Jump to behavior |
| Source: C:\Program Files\Google\Chrome\Application\chrome.exe | Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries | Jump to behavior |
| Source: file:///C:/Users/user/Desktop/Final%20Contract.htm | HTTP Parser: file:///C:/Users/user/Desktop/Final%20Contract.htm |
Edit tour
chrome.exe (PID: 5328 cmdline: 
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet
