Edit tour

Windows Analysis Report
http://khr.lfp.mybluehost.me/intesasanpaolo/web/login.php

Overview

Sample URL:	http://khr.lfp.mybluehost.me/intesasanpaolo/web/login.php
Analysis ID:	1637052
Infos:

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains low number of good links

HTML body with high number of embedded images detected

HTML body with high number of large embedded background images detected

HTML page contains hidden javascript code

HTML title does not match URL

Suspicious form URL found

chrome.exe (PID: 1728 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5604 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2040,i,15306968037729146942,14813096817986714848,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7044 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://khr.lfp.mybluehost.me/intesasanpaolo/web/login.php" MD5: E81F54E6C1129887AEA47E7D092680BF)

⊘No configs have been found

⊘No yara matches

⊘No Sigma rule has matched

⊘No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

Source: http://khr.lfp.mybluehost.me/intesasanpaolo/web/login.php

Avira URL Cloud: detection malicious, Label: phishing

Source: https://khr.lfp.mybluehost.me/favicon.ico

Avira URL Cloud: Label: phishing

Phishing

Source: https://khr.lfp.mybluehost.me/intesasanpaolo/web/login.php	Joe Sandbox AI: Score: 9 Reasons: The brand 'Intesa Sanpaolo' is a well-known Italian banking group., The legitimate domain for Intesa Sanpaolo is 'intesasanpaolo.com'., The URL 'khr.lfp.mybluehost.me' does not match the legitimate domain of Intesa Sanpaolo., The URL uses a subdomain of 'mybluehost.me', which is a hosting service, not directly associated with Intesa Sanpaolo., The presence of input fields like 'Codice Titolare' and 'PIN' is typical for phishing attempts targeting banking credentials., The use of a hosting service domain rather than the official bank domain is suspicious. DOM: 0.2.pages.csv
Source: https://khr.lfp.mybluehost.me/intesasanpaolo/web/login.php	Joe Sandbox AI: Score: 9 Reasons: The brand 'Intesa Sanpaolo' is a well-known Italian banking group., The legitimate domain for Intesa Sanpaolo is 'intesasanpaolo.com'., The URL 'khr.lfp.mybluehost.me' does not match the legitimate domain., The URL uses a subdomain of 'mybluehost.me', which is a hosting service, not directly associated with Intesa Sanpaolo., The presence of input fields like 'Codice Titolare' and 'PIN' is typical for phishing attempts targeting banking credentials., The URL structure and hosting service suggest a potential phishing attempt. DOM: 0.4.pages.csv