Play interactive tourEdit tour
Analysis Report https://cmrinsure-my.sharepoint.com/:b:/g/personal/seccles_cmrinsurance_com/EXDgzrrmhc1GnNui_DLzzBkBEUB0mDlJ3B08lrE-XQmbmg?e=4%3avE67Ot&at=9
Overview
General Information
Detection
HTMLPhisher
Score: | 56 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Yara detected HtmlPhish_10
Phishing site detected (based on image similarity)
Phishing site detected (based on logo template match)
HTML body contains low number of good links
HTML title does not match URL
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Submit button contains javascript call
Classification
Startup |
---|
|
Malware Configuration |
---|
No configs have been found |
---|
Yara Overview |
---|
Dropped Files |
---|
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_HtmlPhish_10 | Yara detected HtmlPhish_10 | Joe Security |
Sigma Overview |
---|
No Sigma rule has matched |
---|
Signature Overview |
---|
Click to jump to signature section
Show All Signature Results
Phishing: |
---|
Yara detected HtmlPhish_10 | Show sources |
Source: | File source: |
Phishing site detected (based on image similarity) | Show sources |
Source: | Matcher: | Jump to dropped file |
Phishing site detected (based on logo template match) | Show sources |
Source: | Matcher: |
Source: | HTTP Parser: | ||
Source: | HTTP Parser: |
Source: | HTTP Parser: | ||
Source: | HTTP Parser: |
Source: | HTTP Parser: | ||
Source: | HTTP Parser: |
Source: | HTTP Parser: | ||
Source: | HTTP Parser: |
Source: | HTTP Parser: | ||
Source: | HTTP Parser: |
Source: | File opened: | Jump to behavior |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | Binary string: | ||
Source: | Binary string: |
Source: | String found in binary or memory: |