Analysis Report test.html

Overview

General Information

Sample Name: test.html
Analysis ID: 404279
MD5: 0d80b3a43db9adf29fe973890a099230
SHA1: 2d5984c3f0f77273bc7c896a0be318000a790e06
SHA256: edd93d70b8455e9ac5462e8488ce717c7baea2960c6bfece09b7b5855b267ae5
Infos:

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 52
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected HtmlPhish10
Phishing site detected (based on logo template match)
HTML body contains low number of good links
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
No HTML title found
None HTTPS page querying sensitive user data (password, username or email)
Suspicious form URL found

Classification

Phishing:

barindex
Yara detected HtmlPhish10
Source: Yara match File source: test.html, type: SAMPLE
Phishing site detected (based on logo template match)
Source: file:///C:/Users/user/Desktop/test.html Matcher: Template: microsoft matched
HTML body contains low number of good links
Source: file:///C:/Users/user/Desktop/test.html HTTP Parser: Number of links: 0
Source: file:///C:/Users/user/Desktop/test.html HTTP Parser: Number of links: 0
No HTML title found
Source: file:///C:/Users/user/Desktop/test.html HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Desktop/test.html HTTP Parser: HTML title missing
None HTTPS page querying sensitive user data (password, username or email)
Source: file:///C:/Users/user/Desktop/test.html HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/test.html HTTP Parser: Has password / email / username input fields
Suspicious form URL found
Source: file:///C:/Users/user/Desktop/test.html HTTP Parser: Form action: https://ppdt.trisakti.ac.id/wp-content/time/5/login.php
Source: file:///C:/Users/user/Desktop/test.html HTTP Parser: Form action: https://ppdt.trisakti.ac.id/wp-content/time/5/login.php
Source: file:///C:/Users/user/Desktop/test.html HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/test.html HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/test.html HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/test.html HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Jump to behavior
Source: unknown HTTPS traffic detected: 162.125.66.15:443 -> 192.168.2.3:49718 version: TLS 1.2

Networking:

barindex
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 162.125.66.15 162.125.66.15
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: b32309a26951912be7dba376398abc3b
Source: Ruleset Data.0.dr String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Ruleset Data.0.dr String found in binary or memory: www.facebook.com/ad.*^ajaxpipe^ equals www.facebook.com (Facebook)
Source: Ruleset Data.0.dr String found in binary or memory: www.facebook.com/ad.*^ajaxpipe^>- equals www.facebook.com (Facebook)
Source: Ruleset Data.0.dr String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: unknown DNS traffic detected: queries for: dl.dropboxusercontent.com
Source: 3399a358-8acf-4c6e-9fb6-1f82a1649030.tmp.1.dr, manifest.json0.0.dr, 9b3bf54c-5910-42a0-910b-7d92f48775c5.tmp.1.dr String found in binary or memory: https://accounts.google.com
Source: 3399a358-8acf-4c6e-9fb6-1f82a1649030.tmp.1.dr, manifest.json0.0.dr, 9b3bf54c-5910-42a0-910b-7d92f48775c5.tmp.1.dr String found in binary or memory: https://apis.google.com
Source: 3399a358-8acf-4c6e-9fb6-1f82a1649030.tmp.1.dr, 9b3bf54c-5910-42a0-910b-7d92f48775c5.tmp.1.dr String found in binary or memory: https://clients2.google.com
Source: manifest.json1.0.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 3399a358-8acf-4c6e-9fb6-1f82a1649030.tmp.1.dr, 9b3bf54c-5910-42a0-910b-7d92f48775c5.tmp.1.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.0.dr String found in binary or memory: https://content.googleapis.com
Source: Reporting and NEL.1.dr String found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external
Source: 9b3bf54c-5910-42a0-910b-7d92f48775c5.tmp.1.dr String found in binary or memory: https://dl.dropboxusercontent.com
Source: 3399a358-8acf-4c6e-9fb6-1f82a1649030.tmp.1.dr, 9b3bf54c-5910-42a0-910b-7d92f48775c5.tmp.1.dr, 4a03e2b9-b11d-4d5c-be43-d5c958236abb.tmp.1.dr, 518a2c58-4a3d-4ff1-b9bc-f50618352008.tmp.1.dr String found in binary or memory: https://dns.google
Source: 9b3bf54c-5910-42a0-910b-7d92f48775c5.tmp.1.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com
Source: test.html String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn%3AANd9GcSAluhajE56aexBgNLyhO8o4gfUkxvz76QA2g&amp;usq
Source: manifest.json0.0.dr String found in binary or memory: https://feedback.googleusercontent.com
Source: 3399a358-8acf-4c6e-9fb6-1f82a1649030.tmp.1.dr String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json0.0.dr String found in binary or memory: https://fonts.googleapis.com;
Source: 3399a358-8acf-4c6e-9fb6-1f82a1649030.tmp.1.dr, 9b3bf54c-5910-42a0-910b-7d92f48775c5.tmp.1.dr String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json0.0.dr String found in binary or memory: https://fonts.gstatic.com;
Source: manifest.json0.0.dr String found in binary or memory: https://hangouts.google.com/
Source: 3399a358-8acf-4c6e-9fb6-1f82a1649030.tmp.1.dr, 9b3bf54c-5910-42a0-910b-7d92f48775c5.tmp.1.dr String found in binary or memory: https://ogs.google.com
Source: manifest.json1.0.dr String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 3399a358-8acf-4c6e-9fb6-1f82a1649030.tmp.1.dr, 9b3bf54c-5910-42a0-910b-7d92f48775c5.tmp.1.dr String found in binary or memory: https://play.google.com
Source: Current Session.0.dr String found in binary or memory: https://ppdt.trisakti.ac.id/wp-content/time/5/login.php
Source: 9b3bf54c-5910-42a0-910b-7d92f48775c5.tmp.1.dr String found in binary or memory: https://r7---sn-n02xgoxufvg3-2gbs.gvt1.com
Source: 9b3bf54c-5910-42a0-910b-7d92f48775c5.tmp.1.dr String found in binary or memory: https://redirector.gvt1.com
Source: manifest.json1.0.dr String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 3399a358-8acf-4c6e-9fb6-1f82a1649030.tmp.1.dr, 9b3bf54c-5910-42a0-910b-7d92f48775c5.tmp.1.dr String found in binary or memory: https://ssl.gstatic.com
Source: messages.json41.0.dr String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json41.0.dr String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: 3399a358-8acf-4c6e-9fb6-1f82a1649030.tmp.1.dr, manifest.json0.0.dr, 9b3bf54c-5910-42a0-910b-7d92f48775c5.tmp.1.dr String found in binary or memory: https://www.google.com
Source: manifest.json1.0.dr String found in binary or memory: https://www.google.com/
Source: manifest.json0.0.dr String found in binary or memory: https://www.google.com;
Source: 3399a358-8acf-4c6e-9fb6-1f82a1649030.tmp.1.dr, 9b3bf54c-5910-42a0-910b-7d92f48775c5.tmp.1.dr String found in binary or memory: https://www.googleapis.com
Source: manifest.json1.0.dr String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json1.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json1.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json1.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json1.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: 3399a358-8acf-4c6e-9fb6-1f82a1649030.tmp.1.dr, 9b3bf54c-5910-42a0-910b-7d92f48775c5.tmp.1.dr String found in binary or memory: https://www.gstatic.com
Source: manifest.json0.0.dr String found in binary or memory: https://www.gstatic.com;
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown HTTPS traffic detected: 162.125.66.15:443 -> 192.168.2.3:49718 version: TLS 1.2
Source: classification engine Classification label: mal52.phis.winHTML@43/239@2/6
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-60921F8C-554.pma Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\957d89ea-283c-4003-ad2f-a6b7b92fdf8d.tmp Jump to behavior
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized 'C:\Users\user\Desktop\test.html'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1628,16747573067059828566,6713175093340114276,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1688 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1628,16747573067059828566,6713175093340114276,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1688 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Jump to behavior
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 404279 Sample: test.html Startdate: 04/05/2021 Architecture: WINDOWS Score: 52 24 Yara detected HtmlPhish10 2->24 26 Phishing site detected (based on logo template match) 2->26 6 chrome.exe 15 501 2->6         started        process3 dnsIp4 12 192.168.2.1 unknown unknown 6->12 14 192.168.2.5 unknown unknown 6->14 16 239.255.255.250 unknown Reserved 6->16 9 chrome.exe 17 6->9         started        process5 dnsIp6 18 googlehosted.l.googleusercontent.com 216.58.212.129, 443, 49740 GOOGLEUS United States 9->18 20 edge-block-www-env.dropbox-dns.com 162.125.66.15, 443, 49718 DROPBOXUS United States 9->20 22 3 other IPs or domains 9->22
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
216.58.212.129
googlehosted.l.googleusercontent.com United States
15169 GOOGLEUS false
162.125.66.15
edge-block-www-env.dropbox-dns.com United States
19679 DROPBOXUS false
239.255.255.250
unknown Reserved
unknown unknown false

Private

IP
192.168.2.1
192.168.2.5
127.0.0.1

Contacted Domains

Name IP Active
edge-block-www-env.dropbox-dns.com 162.125.66.15 true
googlehosted.l.googleusercontent.com 216.58.212.129 true
clients2.googleusercontent.com unknown unknown
dl.dropboxusercontent.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
file:///C:/Users/user/Desktop/test.html true
    low