Edit tour

Windows Analysis Report
https://rebrand.ly/1bbw71e

Overview

General Information

Sample URL:	https://rebrand.ly/1bbw71e
Analysis ID:	1636572
Infos:

Detection

HTMLPhisher, Mamba2FA

Score:	80
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Found malware configuration

Yara detected HtmlPhish10

Yara detected Mamba 2FA PaaS

AI detected suspicious Javascript

HTML page contains suspicious onload / onerror event

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

Invalid 'forgot password' link found

Invalid T&C link found

No HTML title found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5980 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 2548 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2568,i,2545336972236693245,3193731686240170861,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2452 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6976 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://rebrand.ly/1bbw71e" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Malware Configuration

Threatname: Mamba2FA

{"sv": "o365_1_voice", "rand": "UUVHRXA=", "uid": "USER20022025U03022010"}

Yara Signatures

HTML

Source	Rule	Description	Author
0.1.pages.csv	JoeSecurity_Mamba2FA	Yara detected Mamba 2FA PaaS	Joe Security
0.1.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
0.3.pages.csv	JoeSecurity_Mamba2FA	Yara detected Mamba 2FA PaaS	Joe Security
0.3.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
0.2.pages.csv	JoeSecurity_Mamba2FA	Yara detected Mamba 2FA PaaS	Joe Security
0.2.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
Click to see the 1 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.0.pages.csv

Malware Configuration Extractor: Mamba2FA {"sv": "o365_1_voice", "rand": "UUVHRXA=", "uid": "USER20022025U03022010"}

Phishing

AI detected phishing page

Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'safecapitalfx.com' does not match the legitimate domain for Microsoft., The domain 'safecapitalfx.com' does not contain any elements that suggest a connection to Microsoft., The presence of input fields such as 'Email, phone or Skype' is common in phishing attempts targeting Microsoft services., The domain name 'safecapitalfx.com' appears unrelated to Microsoft and could be used to deceive users. DOM: 0.2.pages.csv
Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The URL 'safecapitalfx.com' does not match the legitimate domain 'microsoft.com'., The domain 'safecapitalfx.com' does not have any known association with Microsoft., The presence of input fields such as 'Email, phone or Skype' is typical for Microsoft services, but the domain does not match., The URL 'safecapitalfx.com' contains no direct reference to Microsoft, which is suspicious. DOM: 0.3.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.3.pages.csv, type: HTML
Source: Yara match	File source: 0.2.pages.csv, type: HTML

Yara detected Mamba 2FA PaaS

Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.3.pages.csv, type: HTML
Source: Yara match	File source: 0.2.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.0..script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJ... The script uses the 'Function' constructor to execute dynamic code, which is a high-risk indicator of potential malicious behavior. This allows for the execution of arbitrary JavaScript, which could be used to perform harmful actions.

HTML page contains suspicious onload / onerror event