Analysis Report https://saadellefurniture.com.au/CD/out/

Overview

General Information

Sample URL:	https://saadellefurniture.com.au/CD/out/
Analysis ID:	321371
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish_10

Phishing site detected (based on logo template match)

HTML body contains low number of good links

HTML title does not match URL

Suspicious form URL found

Classification

Signatures

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://saadellefurniture.com.au/CD/out/	Avira URL Cloud: detection malicious, Label: phishing
Source: https://saadellefurniture.com.au/CD/out/	SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering
Source: https://saadellefurniture.com.au/CD/out/	UrlScan: detection malicious, Label: phishing brand: office 365	Perma Link

Antivirus detection for URL or domain

Source: https://saadellefurniture.com.au/CD/out/Root	Avira URL Cloud: Label: phishing
Source: https://saadellefurniture.com.au/CD/out/r	Avira URL Cloud: Label: phishing

Multi AV Scanner detection for submitted file

Source: https://saadellefurniture.com.au/CD/out/

Virustotal: Detection: 12%

Perma Link

Phishing:

Phishing site detected (based on favicon image match)

Source: https://saadellefurniture.com.au/CD/out/

Matcher: Template: office matched with high similarity

Yara detected HtmlPhish_10

Source: Yara match

File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\out[1].htm, type: DROPPED

Phishing site detected (based on logo template match)

Source: https://saadellefurniture.com.au/CD/out/

Matcher: Template: office matched

HTML body contains low number of good links

Source: https://saadellefurniture.com.au/CD/out/	HTTP Parser: Number of links: 0
Source: https://saadellefurniture.com.au/CD/out/	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://saadellefurniture.com.au/CD/out/	HTTP Parser: Title: Author guidelines \| Adobe Developer Connection does not match URL
Source: https://saadellefurniture.com.au/CD/out/	HTTP Parser: Title: Author guidelines \| Adobe Developer Connection does not match URL

Suspicious form URL found

Source: https://saadellefurniture.com.au/CD/out/	HTTP Parser: Form action: spin.php
Source: https://saadellefurniture.com.au/CD/out/	HTTP Parser: Form action: spin.php

Source: https://saadellefurniture.com.au/CD/out/	HTTP Parser: No <meta name="author".. found
Source: https://saadellefurniture.com.au/CD/out/	HTTP Parser: No <meta name="author".. found

Source: https://saadellefurniture.com.au/CD/out/	HTTP Parser: No <meta name="copyright".. found
Source: https://saadellefurniture.com.au/CD/out/	HTTP Parser: No <meta name="copyright".. found

Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xc3080ecc,0x01d6bfe6</date><accdate>0xc3080ecc,0x01d6bfe6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xc3080ecc,0x01d6bfe6</date><accdate>0xc3080ecc,0x01d6bfe6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xc313faad,0x01d6bfe6</date><accdate>0xc313faad,0x01d6bfe6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xc313faad,0x01d6bfe6</date><accdate>0xc313faad,0x01d6bfe6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xc3165cf1,0x01d6bfe6</date><accdate>0xc3165cf1,0x01d6bfe6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xc3165cf1,0x01d6bfe6</date><accdate>0xc3165cf1,0x01d6bfe6</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: saadellefurniture.com.au

Source: msapplication.xml.1.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.1.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.1.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.1.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.1.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.1.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.1.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.1.dr	String found in binary or memory: http://www.youtube.com/
Source: imagestore.dat.2.dr, out[1].htm.2.dr	String found in binary or memory: https://blobs.officehome.msocdn.com/images/content/images/favicon-8f211ea639.ico
Source: imagestore.dat.2.dr	String found in binary or memory: https://blobs.officehome.msocdn.com/images/content/images/favicon-8f211ea639.ico~
Source: bootstrap.min[1].js.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: {EBA39548-2BD9-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://saadellefurniture.com.au/CD/out/
Source: {EBA39548-2BD9-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://saadellefurniture.com.au/CD/out/Root
Source: {EBA39548-2BD9-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://saadellefurniture.com.au/CD/out/r

Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: classification engine

Classification label: mal84.phis.win@3/24@3/1

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFC77F6256E9585D6C.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5664 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5664 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.241.117.173	unknown	United States		46606	UNIFIEDLAYER-AS-1US	false

Contacted Domains

Name	IP	Active
saadellefurniture.com.au	162.241.117.173	true
ocsp-cluster2.globalsign.cloud	104.18.24.243	true
blobs.officehome.msocdn.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://saadellefurniture.com.au/CD/out/	true		unknown

ID:	321371
Product:	CloudBasic
Start time:	01:13:27
Start date:	21.11.2020
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EBA39546-2BD9-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	BD1FDD1456B2642A60F874B36BEB2FF5	C57A5DEB310F65A9365565E3515F5C89F24C10AE	17472731CE3506BB0C1780B2DF01A6566F4476BECC0FBFB959532FED6B9AA171
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{EBA39548-2BD9-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	E9F2E5E8A0F6509D938220198A991940	AD3063D8C6DF0948AE4189A7A72B4992A231BE66	C02DC162CD99D631CAB17A7163750B174E92D96986A167E01800518C5246C3BF
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{EBA39549-2BD9-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	12652301920AA10895674BA5D156CBA3	1486CECAB779469C04CEC02B1D78E9A551982C1D	6C4C28ACC893D2A1AFB8933FDFB2A8588186E6E5CB4127848A4CF55DCC2EAA50
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	568EA48C9B34994E1F5C3178DCEC4F6E	E12E3CED6852DB4897475560F1DBB499DF921772	837D5AB5FE04B7D7F457DE5C2D1792933285FAE6573F345DEBFF3D7E3708A22A
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	3F15AEEE1AB6FC3EA2B76D9626C74FE0	568C2928097CDDD71E7189AD841F03DA0ABBC862	ED496B4E06A91E1023EF62970708E2F12205672B3F376B435DE56B8C1568BC92
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	06A2D1EA6BACA04EF3B8F1CA07C7010A	BEB42DE578050A7F2E55B96387B4ABBBB60F2B20	BC0FD3BC3F0D26E75809C76F9481AF93B0B79DEAA42E882CD2884F55034A62F0
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	07DAEAA7A3C7256F006351F8F2BCF876	BF87CD5EBBFF3D2197DA9A696AB91ACBA3B88EDD	0B86BACA6F0A36846F46E636F12425730FFBA255EA0ECC8875074E60928035A5
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	17BE4F3DCF153CF0CE17584238B83571	E9D2BD430E992C1B6FEF56EA98CC8079ACACB08C	F312F2A68316D0DED97FB672BD837E56D8384CAE72904F829446ACB99310E326
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	58BB69DFBF7E8D0CC12783BE7DBA1B35	41AD7388DC5A99276FFB6E46A6A5AF57F982EAB3	E813ADB2DC29928C4E2612A3C3C4C327FF51F2EF753E2782816BD6677C503663
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	38D0363F0681C3AF7125847B47E54440	0E6599C5BB1A054180D1DC0032CB722FC8D5A266	F672515CF87A0866412E27C30DEEC9375660B4239408CFF60F8CA92C5A29B5D9
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	7B518E3356F146D7D134685DDFF71F09	9B10810740907633BA757A46D315924A3E217F12	6D4A1F6D8C43D3B26E3E1ED2364C1D240C9BA3D5E264AE27A61D22D5B59C7030
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	78544B63D67B6391FD7076595BB8471F	3C0A01DF22BA3BC27A086F5A09F8AB67911891D5	DBB61291346F9211DBE23402DEE0E80072533E1CBE586E9BBF4054F165F30243
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat	data	D678B38B983A42025763F2EF306746D1	D351625BA1060D7F5DA2D1AD9CE53487744B8FAB	13FBB024CC1D2D385D68804C3FEB69C392053223BA1DECFB0C375B662AEBF19D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\b1[1].png	PNG image data, 1366 x 713, 8-bit/color RGB, non-interlaced	221F1B47706E59AFA183C2EABD2F46FA	85DC2F21D5AB8995AAFCB8CF5073576B7E6B795F	9187B61BDAC935DB4802213CD484AFD512311D83E8E4F6BCF25490876F9A03BC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\gtts[1].png	PNG image data, 126 x 33, 8-bit/color RGBA, non-interlaced	08C4AFF479C7BB4F2ED1196FED987AFA	6271DCB76E3770BC042C42648C2ED7C01DF7D465	41701EE84CF726B06BB9E42CAC655F9D70C15D2BA035ED284FEE2B107EB26AA0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\index[1].css	ASCII text	4AA204ADC63F0DCAB29E0E25712BBE04	36BB88C39A1F155AAFBD7DF6BCF192F53BF20640	59D75627E2B362B0B1B03DDD4A1E7B872CFE0A39B52212946D65B95AD31819D2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\jquery.min[1].js	ASCII text, with very long lines	A09E13EE94D51C524B7E2A728C7D4039	0DC32DB4AA9C5F03F3B38C47D883DBD4FED13AAE	160A426FF2894252CD7CEBBDD6D6B7DA8FCD319C65B70468F10B6690C45D02EF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\bootstrap.min[1].js	ASCII text, with very long lines	3D8308804264C5B751F6E54734C46897	369A832EF7F8A57E9B59B84B181FDB4FC9125050	909AE563EB34F7E4285A3A643AB5D7C21C5E6A80F3F455B949AC45F08D0389B4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\b2[1].png	PNG image data, 1366 x 667, 8-bit/color RGBA, non-interlaced	98CDF39C01C32BD8BDE12E7985E23B83	C1D5CE9F5523F28672A62F1F384D7F383F71324D	12D366CED4F852E21D9906EB98607F52F83F92EFF82F14E1E0627DEFD122DA02
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\favicon-8f211ea639[1].ico	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	8F211EA639E8777ABEB1AB7A8871580C	D6427CE52782D6B07118817E71A7E5192CA72F8C	E588BDE3EB80B349B069BCBB10520E49F9AA6F38001CE651F396269DE3499549
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\out[1].htm	HTML document, ASCII text	DCE85642F553ED964AF1508B935BF976	78AAF4E0DBBF8C13262A0B2AD82DCC74AE6E2061	2760EBF417E5F8AC51D695E16ABC511AC9D29B974D2489FBC48075346BF75A04
C:\Users\user\AppData\Local\Temp\~DF516D3168A2AAE316.TMP	data	049D3A5E3EB8581B4DC8C990D8DFA634	1A7EC67728A1E84B8AA769F85A45FE4594AED933	599527B951D42B1C94AEBFD5761425FEB83974D5D1982E801E9E9D56F7001E11
C:\Users\user\AppData\Local\Temp\~DFC77F6256E9585D6C.TMP	data	878913E18099498EB3A6BD3116C6183D	2A3CD8A6D17A78D455A0AF6F080387A2794FEF29	BE86BC73BBD2BF88D7B6BDCA5BD419C017FBED01B33E1E72788DDF91905FE4BF
C:\Users\user\AppData\Local\Temp\~DFF48997DE35ED65AC.TMP	data	E3A7752EC187AE2B6815DE9C81C86012	F64FE7F8927174771B4AAB05B8C04C3D367F01DA	66A11AFA011CB083C01265634B62A6D7369BB93AFB78CDA4480C7BA808596BE9

Analysis Report https://saadellefurniture.com.au/CD/out/

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Phishing:

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs