Edit tour
Windows
Analysis Report
https://docs.google.com/presentation/d/e/2PACX-1vS-nN7hyacCYt95zNulla0L9qX2DSAc5P5i0gxMOo_AM5wUPw1qtPfPGfFm-j95A08CW22rEIA_1zoH/pub?start=false&loop=false&delayms=1000
Overview
General Information
| Sample URL: | https://docs.google.com/presentation/d/e/2PACX-1vS-nN7hyacCYt95zNulla0L9qX2DSAc5P5i0gxMOo_AM5wUPw1qtPfPGfFm-j95A08CW22rEIA_1zoH/pub?start=false&loop=false&delayms=1000 |
| Analysis ID: | 1623955 |
| Infos: |  |
 | |
Detection
HTMLPhisher
| Score: | 76 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
AI detected phishing page
Antivirus detection for URL or domain
Yara detected HtmlPhish10
AI detected landing page (webpage, office document or email)
AI detected suspicious Javascript
HTML page contains obfuscated javascript
Connects to several IPs in different countries
Detected suspicious crossdomain redirect
HTML body contains low number of good links
HTML page contains hidden javascript code
HTML title does not match URL
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Classification
- System is w10x64_ra
chrome.exe (PID: 6252 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed "about :blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA) - chrome.exe (PID: 6444 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2248 --fi eld-trial- handle=204 0,i,175669 5710272748 9650,91963 0595961029 8527,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
- chrome.exe (PID: 7132 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" "htt ps://docs. google.com /presentat ion/d/e/2P ACX-1vS-nN 7hyacCYt95 zNulla0L9q X2DSAc5P5i 0gxMOo_AM5 wUPw1qtPfP GfFm-j95A0 8CW22rEIA_ 1zoH/pub?s tart=false &loop=fals e&delayms= 1000" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
- cleanup
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_HtmlPhish_10 | Yara detected HtmlPhish_10 | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_HtmlPhish_10 | Yara detected HtmlPhish_10 | Joe Security | ||
| JoeSecurity_HtmlPhish_10 | Yara detected HtmlPhish_10 | Joe Security | ||
| JoeSecurity_HtmlPhish_10 | Yara detected HtmlPhish_10 | Joe Security |
⊘No Sigma rule has matched
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-02-25T18:09:10.000646+0100 | 2022112 | 1 | Exploit Kit Activity Detected | 192.168.2.17 | 50055 | 104.18.27.193 | 443 | TCP |
| 2025-02-25T18:09:10.384094+0100 | 2022112 | 1 | Exploit Kit Activity Detected | 192.168.2.17 | 50053 | 63.33.7.198 | 443 | TCP |
| 2025-02-25T18:09:17.521142+0100 | 2022112 | 1 | Exploit Kit Activity Detected | 192.168.2.17 | 50241 | 18.184.119.72 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
Phishing | |
|---|
| Source: |