Analysis Report https://oatiscozxmocxixc-forgiving-hartebeest-rp.eu-gb.cf.appdomain.cloud/?bbre=ozx9sozoizx

Overview

General Information

Sample URL: https://oatiscozxmocxixc-forgiving-hartebeest-rp.eu-gb.cf.appdomain.cloud/?bbre=ozx9sozoizx
Analysis ID: 383587
Infos:

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 76
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Phishing site detected (based on shot template match)
Yara detected HtmlPhish35
Yara detected HtmlPhish7
Phishing site detected (based on logo template match)
HTML body contains low number of good links
HTML title does not match URL

Classification

AV Detection:

barindex
Antivirus / Scanner detection for submitted sample
Source: https://oatiscozxmocxixc-forgiving-hartebeest-rp.eu-gb.cf.appdomain.cloud/?bbre=ozx9sozoizx SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

barindex
Phishing site detected (based on shot template match)
Source: https://oatiscozxmocxixc-forgiving-hartebeest-rp.eu-gb.cf.appdomain.cloud/IMbIKmY6wJR6PKqGfAl4r68s4lvvdAxwICxvCSb-!&rAPxuRftLHjmUJQ53bNep8c910SX@&!nesAZoRK7avLqNt4kC1BI6fprWTG9!&@-wH3tLEh1pB4QIRpJAP0G0wJoQ0CZCyfbeF4IJ9a9pxYWfXsbeK9st00bcyBn52qom5K9Wc7VHiiU2vLuXDr0L7eC5kVipLU-E2Z0uWk5RhioTcvVa20EhMfBBwfZrJGgkJuDZa1wNXFIewx194cA5RUZLsAVEpc4V0c3TfErzm/UDwEAUMBX1nKLaeNB6cr8phbspTfaFnoYfqoQ3WiiSggkuKFq24Kw8NSxc9pBMnYnk Matcher: Template: generic matched
Yara detected HtmlPhish35
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\QXTFJG8V.htm, type: DROPPED
Yara detected HtmlPhish7
Source: Yara match File source: 899552.pages.csv, type: HTML
Phishing site detected (based on logo template match)
Source: https://oatiscozxmocxixc-forgiving-hartebeest-rp.eu-gb.cf.appdomain.cloud/IMbIKmY6wJR6PKqGfAl4r68s4lvvdAxwICxvCSb-!&rAPxuRftLHjmUJQ53bNep8c910SX@&!nesAZoRK7avLqNt4kC1BI6fprWTG9!&@-wH3tLEh1pB4QIRpJAP0G0wJoQ0CZCyfbeF4IJ9a9pxYWfXsbeK9st00bcyBn52qom5K9Wc7VHiiU2vLuXDr0L7eC5kVipLU-E2Z0uWk5RhioTcvVa20EhMfBBwfZrJGgkJuDZa1wNXFIewx194cA5RUZLsAVEpc4V0c3TfErzm/UDwEAUMBX1nKLaeNB6cr8phbspTfaFnoYfqoQ3WiiSggkuKFq24Kw8NSxc9pBMnYnk Matcher: Template: dropbox matched
HTML body contains low number of good links
Source: https://oatiscozxmocxixc-forgiving-hartebeest-rp.eu-gb.cf.appdomain.cloud/IMbIKmY6wJR6PKqGfAl4r68s4lvvdAxwICxvCSb-!&rAPxuRftLHjmUJQ53bNep8c910SX@&!nesAZoRK7avLqNt4kC1BI6fprWTG9!&@-wH3tLEh1pB4QIRpJAP0G0wJoQ0CZCyfbeF4IJ9a9pxYWfXsbeK9st00bcyBn52qom5K9Wc7VHiiU2vLuXDr0L7eC5kVipLU-E2Z0uWk5RhioTcvVa20EhMfBBwfZrJGgkJuDZa1wNXFIewx194cA5RUZLsAVEpc4V0c3TfErzm/UDwEAUMBX1nKLaeNB6cr8phbspTfaFnoYfqoQ3WiiSggkuKFq24Kw8NSxc9pBMnYnk HTTP Parser: Number of links: 0
Source: https://oatiscozxmocxixc-forgiving-hartebeest-rp.eu-gb.cf.appdomain.cloud/IMbIKmY6wJR6PKqGfAl4r68s4lvvdAxwICxvCSb-!&rAPxuRftLHjmUJQ53bNep8c910SX@&!nesAZoRK7avLqNt4kC1BI6fprWTG9!&@-wH3tLEh1pB4QIRpJAP0G0wJoQ0CZCyfbeF4IJ9a9pxYWfXsbeK9st00bcyBn52qom5K9Wc7VHiiU2vLuXDr0L7eC5kVipLU-E2Z0uWk5RhioTcvVa20EhMfBBwfZrJGgkJuDZa1wNXFIewx194cA5RUZLsAVEpc4V0c3TfErzm/UDwEAUMBX1nKLaeNB6cr8phbspTfaFnoYfqoQ3WiiSggkuKFq24Kw8NSxc9pBMnYnk HTTP Parser: Number of links: 0
HTML title does not match URL
Source: https://oatiscozxmocxixc-forgiving-hartebeest-rp.eu-gb.cf.appdomain.cloud/IMbIKmY6wJR6PKqGfAl4r68s4lvvdAxwICxvCSb-!&rAPxuRftLHjmUJQ53bNep8c910SX@&!nesAZoRK7avLqNt4kC1BI6fprWTG9!&@-wH3tLEh1pB4QIRpJAP0G0wJoQ0CZCyfbeF4IJ9a9pxYWfXsbeK9st00bcyBn52qom5K9Wc7VHiiU2vLuXDr0L7eC5kVipLU-E2Z0uWk5RhioTcvVa20EhMfBBwfZrJGgkJuDZa1wNXFIewx194cA5RUZLsAVEpc4V0c3TfErzm/UDwEAUMBX1nKLaeNB6cr8phbspTfaFnoYfqoQ3WiiSggkuKFq24Kw8NSxc9pBMnYnk HTTP Parser: Title: Login Download Dropbox does not match URL
Source: https://oatiscozxmocxixc-forgiving-hartebeest-rp.eu-gb.cf.appdomain.cloud/IMbIKmY6wJR6PKqGfAl4r68s4lvvdAxwICxvCSb-!&rAPxuRftLHjmUJQ53bNep8c910SX@&!nesAZoRK7avLqNt4kC1BI6fprWTG9!&@-wH3tLEh1pB4QIRpJAP0G0wJoQ0CZCyfbeF4IJ9a9pxYWfXsbeK9st00bcyBn52qom5K9Wc7VHiiU2vLuXDr0L7eC5kVipLU-E2Z0uWk5RhioTcvVa20EhMfBBwfZrJGgkJuDZa1wNXFIewx194cA5RUZLsAVEpc4V0c3TfErzm/UDwEAUMBX1nKLaeNB6cr8phbspTfaFnoYfqoQ3WiiSggkuKFq24Kw8NSxc9pBMnYnk HTTP Parser: Title: Login Download Dropbox does not match URL
Source: https://oatiscozxmocxixc-forgiving-hartebeest-rp.eu-gb.cf.appdomain.cloud/IMbIKmY6wJR6PKqGfAl4r68s4lvvdAxwICxvCSb-!&rAPxuRftLHjmUJQ53bNep8c910SX@&!nesAZoRK7avLqNt4kC1BI6fprWTG9!&@-wH3tLEh1pB4QIRpJAP0G0wJoQ0CZCyfbeF4IJ9a9pxYWfXsbeK9st00bcyBn52qom5K9Wc7VHiiU2vLuXDr0L7eC5kVipLU-E2Z0uWk5RhioTcvVa20EhMfBBwfZrJGgkJuDZa1wNXFIewx194cA5RUZLsAVEpc4V0c3TfErzm/UDwEAUMBX1nKLaeNB6cr8phbspTfaFnoYfqoQ3WiiSggkuKFq24Kw8NSxc9pBMnYnk HTTP Parser: No <meta name="author".. found
Source: https://oatiscozxmocxixc-forgiving-hartebeest-rp.eu-gb.cf.appdomain.cloud/IMbIKmY6wJR6PKqGfAl4r68s4lvvdAxwICxvCSb-!&rAPxuRftLHjmUJQ53bNep8c910SX@&!nesAZoRK7avLqNt4kC1BI6fprWTG9!&@-wH3tLEh1pB4QIRpJAP0G0wJoQ0CZCyfbeF4IJ9a9pxYWfXsbeK9st00bcyBn52qom5K9Wc7VHiiU2vLuXDr0L7eC5kVipLU-E2Z0uWk5RhioTcvVa20EhMfBBwfZrJGgkJuDZa1wNXFIewx194cA5RUZLsAVEpc4V0c3TfErzm/UDwEAUMBX1nKLaeNB6cr8phbspTfaFnoYfqoQ3WiiSggkuKFq24Kw8NSxc9pBMnYnk HTTP Parser: No <meta name="author".. found
Source: https://oatiscozxmocxixc-forgiving-hartebeest-rp.eu-gb.cf.appdomain.cloud/IMbIKmY6wJR6PKqGfAl4r68s4lvvdAxwICxvCSb-!&rAPxuRftLHjmUJQ53bNep8c910SX@&!nesAZoRK7avLqNt4kC1BI6fprWTG9!&@-wH3tLEh1pB4QIRpJAP0G0wJoQ0CZCyfbeF4IJ9a9pxYWfXsbeK9st00bcyBn52qom5K9Wc7VHiiU2vLuXDr0L7eC5kVipLU-E2Z0uWk5RhioTcvVa20EhMfBBwfZrJGgkJuDZa1wNXFIewx194cA5RUZLsAVEpc4V0c3TfErzm/UDwEAUMBX1nKLaeNB6cr8phbspTfaFnoYfqoQ3WiiSggkuKFq24Kw8NSxc9pBMnYnk HTTP Parser: No <meta name="copyright".. found
Source: https://oatiscozxmocxixc-forgiving-hartebeest-rp.eu-gb.cf.appdomain.cloud/IMbIKmY6wJR6PKqGfAl4r68s4lvvdAxwICxvCSb-!&rAPxuRftLHjmUJQ53bNep8c910SX@&!nesAZoRK7avLqNt4kC1BI6fprWTG9!&@-wH3tLEh1pB4QIRpJAP0G0wJoQ0CZCyfbeF4IJ9a9pxYWfXsbeK9st00bcyBn52qom5K9Wc7VHiiU2vLuXDr0L7eC5kVipLU-E2Z0uWk5RhioTcvVa20EhMfBBwfZrJGgkJuDZa1wNXFIewx194cA5RUZLsAVEpc4V0c3TfErzm/UDwEAUMBX1nKLaeNB6cr8phbspTfaFnoYfqoQ3WiiSggkuKFq24Kw8NSxc9pBMnYnk HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 141.125.73.152:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown HTTPS traffic detected: 141.125.73.152:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.91.175:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.91.175:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.65.195:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.65.195:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.122.175:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.122.175:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown DNS traffic detected: queries for: oatiscozxmocxixc-forgiving-hartebeest-rp.eu-gb.cf.appdomain.cloud
Source: axios.min[1].js.2.dr String found in binary or memory: http://feross.org
Source: imagestore.dat.2.dr String found in binary or memory: https://cfl.dropboxstatic.com/static/images/favicon-vflUeLeeY.ico
Source: mobile-detect.min[1].js.2.dr String found in binary or memory: https://github.com/hgoebl/mobile-detect.js
Source: lodash.min[1].js.2.dr String found in binary or memory: https://npms.io/search?q=ponyfill.
Source: ~DF46F11D86398F6F3B.TMP.1.dr String found in binary or memory: https://oatiscozxmocxixc-forgiving-hartebeest-rp.eu-gb.cf.appdomain.cloud/?bbre=ozx9sozoizx
Source: ~DF46F11D86398F6F3B.TMP.1.dr String found in binary or memory: https://oatiscozxmocxixc-forgiving-hartebeest-rp.eu-gb.cf.appdomain.cloud/?bbre=ozx9sozoizxRLoading
Source: {71B94A98-9837-11EB-90E5-ECF4BB570DC9}.dat.1.dr String found in binary or memory: https://oatiscozxmocxixc-forgiving-hartebeest-rp.eu-gb.cf.appdomain.cloud/?bbre=ozx9sozoizxRoot
Source: {71B94A98-9837-11EB-90E5-ECF4BB570DC9}.dat.1.dr String found in binary or memory: https://oatiscozxmocxixc-forgiving-hartebeest-rp.eu-gb.cf.appdomain.cloud/?bbre=ozx9sozoizxxc-forgiv
Source: ~DF3FB2DE96AE92119F.TMP.1.dr String found in binary or memory: https://oatiscozxmocxixc-forgiving-hartebeest-rp.eu-gb.cf.appdomain.cloud/IMbIKmY6wJR6PKqGfAl4r68s4l
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown HTTPS traffic detected: 141.125.73.152:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown HTTPS traffic detected: 141.125.73.152:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.91.175:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.91.175:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.65.195:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.65.195:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.122.175:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.122.175:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: classification engine Classification label: mal76.phis.win@3/35@7/6
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{71B94A96-9837-11EB-90E5-ECF4BB570DC9}.dat Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DF5D5928BCF48E112D.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5420 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5420 CREDAT:17410 /prefetch:2 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior