Analysis Report $108,459.00.shtml

Overview

General Information

Sample Name: $108,459.00.shtml (renamed file extension from shtml to html)
Analysis ID: 384937
MD5: 244f3030958bcfe1db9bb77edd6ecaf3
SHA1: 95ebb217144ec973ce3b9c0ebaa9b4fde83be41d
SHA256: fb2b7bf2039d05913895b5ec2ef8ea20ba02ebbc00e1596d7468074410525b2b
Infos:

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 64
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Yara detected HtmlPhish10
HTML body contains low number of good links
HTML title does not match URL
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
None HTTPS page querying sensitive user data (password, username or email)
Suspicious form URL found

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: https://cdshgvjs.ygto.com/leo/action.php Avira URL Cloud: Label: phishing
Source: https://mayhutsuahanoi.com/wp-admin/images/bg.png Avira URL Cloud: Label: phishing
Multi AV Scanner detection for domain / URL
Source: https://cdshgvjs.ygto.com/leo/action.php Virustotal: Detection: 10% Perma Link

Phishing:

barindex
Yara detected HtmlPhish10
Source: Yara match File source: $108,459.00.html, type: SAMPLE
Source: Yara match File source: 377142.pages.csv, type: HTML
HTML body contains low number of good links
Source: file:///C:/Users/user/Desktop/$108,459.00.html HTTP Parser: Number of links: 0
Source: file:///C:/Users/user/Desktop/$108,459.00.html HTTP Parser: Number of links: 0
HTML title does not match URL
Source: file:///C:/Users/user/Desktop/$108,459.00.html HTTP Parser: Title: login_popup does not match URL
Source: file:///C:/Users/user/Desktop/$108,459.00.html HTTP Parser: Title: login_popup does not match URL
None HTTPS page querying sensitive user data (password, username or email)
Source: file:///C:/Users/user/Desktop/$108,459.00.html HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/$108,459.00.html HTTP Parser: Has password / email / username input fields
Suspicious form URL found
Source: file:///C:/Users/user/Desktop/$108,459.00.html HTTP Parser: Form action: https://cdshgvjs.ygto.com/leo/action.php
Source: file:///C:/Users/user/Desktop/$108,459.00.html HTTP Parser: Form action: https://cdshgvjs.ygto.com/leo/action.php
Source: file:///C:/Users/user/Desktop/$108,459.00.html HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/$108,459.00.html HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/$108,459.00.html HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/$108,459.00.html HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 146.59.152.166:443 -> 192.168.2.3:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 146.59.152.166:443 -> 192.168.2.3:49707 version: TLS 1.2

Networking:

barindex
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 146.59.152.166 146.59.152.166
Source: Joe Sandbox View IP Address: 103.221.222.30 103.221.222.30
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c
Source: msapplication.xml0.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x7e9d5c75,0x01d72e44</date><accdate>0x7e9d5c75,0x01d72e44</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x7e9d5c75,0x01d72e44</date><accdate>0x7e9d5c75,0x01d72e44</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x7e9fbeda,0x01d72e44</date><accdate>0x7e9fbeda,0x01d72e44</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x7e9fbeda,0x01d72e44</date><accdate>0x7e9fbeda,0x01d72e44</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x7ea22123,0x01d72e44</date><accdate>0x7ea22123,0x01d72e44</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x7ea22123,0x01d72e44</date><accdate>0x7ea22123,0x01d72e44</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: unknown DNS traffic detected: queries for: i.ibb.co
Source: msapplication.xml.1.dr String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.1.dr String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.1.dr String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.1.dr String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.1.dr String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.1.dr String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.1.dr String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.1.dr String found in binary or memory: http://www.youtube.com/
Source: $108,459.00.html String found in binary or memory: https://cdshgvjs.ygto.com/leo/action.php
Source: $108,459.00.html String found in binary or memory: https://fonts.googleapis.com/css?family=Montserrat:100
Source: css[1].css.2.dr String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v15/JTUQjIg1_i6t8kCHKm45_QpRyS7g.woff)
Source: css[1].css.2.dr String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_ZpC3gnD-A.woff)
Source: css[1].css.2.dr String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_aZA3gnD-A.woff)
Source: css[1].css.2.dr String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_bZF3gnD-A.woff)
Source: css[1].css.2.dr String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_c5H3gnD-A.woff)
Source: css[1].css.2.dr String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_cJD3gnD-A.woff)
Source: css[1].css.2.dr String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_dJE3gnD-A.woff)
Source: css[1].css.2.dr String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v15/JTUSjIg1_i6t8kCHKm459WlhzQ.woff)
Source: $108,459.00.html String found in binary or memory: https://i.ibb.co/9nnrtWy/login02-popup.png
Source: $108,459.00.html String found in binary or memory: https://mayhutsuahanoi.com/wp-admin/images/bg.png
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown HTTPS traffic detected: 146.59.152.166:443 -> 192.168.2.3:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 146.59.152.166:443 -> 192.168.2.3:49707 version: TLS 1.2
Source: classification engine Classification label: mal64.phis.winHTML@3/25@2/2
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DFC8580DDF3DAC5A07.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4436 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4436 CREDAT:17410 /prefetch:2 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 384937 Sample: $108,459.00.shtml Startdate: 10/04/2021 Architecture: WINDOWS Score: 64 15 Multi AV Scanner detection for domain / URL 2->15 17 Antivirus detection for URL or domain 2->17 19 Yara detected HtmlPhish10 2->19 6 iexplore.exe 2 86 2->6         started        process3 process4 8 iexplore.exe 1 43 6->8         started        dnsIp5 11 i.ibb.co 146.59.152.166, 443, 49707, 49708 OVHFR Norway 8->11 13 mayhutsuahanoi.com 103.221.222.30, 443 FPT-AS-APTheCorporationforFinancingPromotingTechnolo Viet Nam 8->13
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
146.59.152.166
 i.ibb.co Norway
16276 OVHFR false
103.221.222.30
 mayhutsuahanoi.com Viet Nam
18403 FPT-AS-APTheCorporationforFinancingPromotingTechnolo false

Contacted Domains

Name IP Active
mayhutsuahanoi.com 103.221.222.30 true
i.ibb.co 146.59.152.166 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
file:///C:/Users/user/Desktop/$108,459.00.html true
    		low