Analysis Report NCA Approval Letter.html

Overview

General Information

Sample Name: NCA Approval Letter.html
Analysis ID: 384811
MD5: 2afd53761ef2429d41a21b16067b27c0
SHA1: 608645dc128a0986dbf4b9779fa3c9dee89eff6e
SHA256: 6b432f5c38d2deb98fb938341cf8a9732555b4992c310a7edd010594fa723b13
Infos:

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Phishing site detected (based on shot template match)
Yara detected HtmlPhish7
HTML body contains low number of good links
HTML title does not match URL
None HTTPS page querying sensitive user data (password, username or email)

Classification

Phishing:

barindex
Phishing site detected (based on shot template match)
Source: file:///C:/Users/user/Desktop/NCA%20Approval%20Letter.html Matcher: Template: outlook matched
Yara detected HtmlPhish7
Source: Yara match File source: NCA Approval Letter.html, type: SAMPLE
Source: Yara match File source: 960781.pages.csv, type: HTML
HTML body contains low number of good links
Source: file:///C:/Users/user/Desktop/NCA%20Approval%20Letter.html HTTP Parser: Number of links: 0
Source: file:///C:/Users/user/Desktop/NCA%20Approval%20Letter.html HTTP Parser: Number of links: 0
HTML title does not match URL
Source: file:///C:/Users/user/Desktop/NCA%20Approval%20Letter.html HTTP Parser: Title: Box does not match URL
Source: file:///C:/Users/user/Desktop/NCA%20Approval%20Letter.html HTTP Parser: Title: Box does not match URL
None HTTPS page querying sensitive user data (password, username or email)
Source: file:///C:/Users/user/Desktop/NCA%20Approval%20Letter.html HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/NCA%20Approval%20Letter.html HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/NCA%20Approval%20Letter.html HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/NCA%20Approval%20Letter.html HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/NCA%20Approval%20Letter.html HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/NCA%20Approval%20Letter.html HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: msapplication.xml0.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x66359dde,0x01d72d76</date><accdate>0x66359dde,0x01d72d76</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x66359dde,0x01d72d76</date><accdate>0x66359dde,0x01d72d76</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x663a6282,0x01d72d76</date><accdate>0x663a6282,0x01d72d76</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x663a6282,0x01d72d76</date><accdate>0x663a6282,0x01d72d76</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x663cc4bd,0x01d72d76</date><accdate>0x663cc4bd,0x01d72d76</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x663cc4bd,0x01d72d76</date><accdate>0x663cc4bd,0x01d72d76</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: NCA Approval Letter.html String found in binary or memory: http://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js
Source: NCA Approval Letter.html String found in binary or memory: http://fonts.googleapis.com/css?family=Roboto:100
Source: msapplication.xml.1.dr String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.1.dr String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.1.dr String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.1.dr String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.1.dr String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.1.dr String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.1.dr String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.1.dr String found in binary or memory: http://www.youtube.com/
Source: css[1].css.2.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOkCnqEu92Fr1MmgVxIIzQ.woff)
Source: css[1].css.2.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmEU9fBBc-.woff)
Source: css[1].css.2.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmSU5fBBc-.woff)
Source: css[1].css.2.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc-.woff)
Source: css[1].css.2.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmYUtfBBc-.woff)
Source: css[1].css.2.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxM.woff)
Source: NCA Approval Letter.html String found in binary or memory: https://islandweddingsofhawaii.com/bin/ds/
Source: classification engine Classification label: mal56.phis.winHTML@3/23@0/1
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{90D684E2-9969-11EB-90EB-ECF4BBEA1588}.dat Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DFD54D0D56F24D12CD.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6552 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6552 CREDAT:17410 /prefetch:2 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 384811 Sample: NCA Approval Letter.html Startdate: 09/04/2021 Architecture: WINDOWS Score: 56 13 Phishing site detected (based on shot template match) 2->13 15 Yara detected HtmlPhish7 2->15 6 iexplore.exe 1 76 2->6         started        process3 dnsIp4 11 192.168.2.1 unknown unknown 6->11 9 iexplore.exe 6 41 6->9         started        process5
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious

Private
IP
192.168.2.1

Contacted URLs

Name Malicious Antivirus Detection Reputation
file:///C:/Users/user/Desktop/NCA%20Approval%20Letter.html true
    		low