Analysis Report #Ud83d#Udce9-peter.nash.htm

Overview

General Information

Sample Name: #Ud83d#Udce9-peter.nash.htm
Analysis ID: 432756
MD5: 8c6df9b0709674ba479f63d75b3a2cb6
SHA1: 734aef9ae6219e97ea02bdd13bce9a31c1327b14
SHA256: ab8c991ac026e2cf24f0c012a09174da7fdc75604c626883c964add719bd1c9e
Infos:

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 52
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected HtmlPhish44
Obfuscated HTML file found
HTML body contains low number of good links
HTML title does not match URL
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
None HTTPS page querying sensitive user data (password, username or email)

Classification

Phishing:

barindex
Yara detected HtmlPhish44
Source: Yara match File source: #Ud83d#Udce9-peter.nash.htm, type: SAMPLE
HTML body contains low number of good links
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm HTTP Parser: Number of links: 0
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm HTTP Parser: Number of links: 0
HTML title does not match URL
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm HTTP Parser: Title: Undelivered email local access does not match URL
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm HTTP Parser: Title: Undelivered email local access does not match URL
None HTTPS page querying sensitive user data (password, username or email)
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.3:49721 version: TLS 1.2

Networking:

barindex
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.18.11.207 104.18.11.207
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c
Source: global traffic HTTP traffic detected: GET /bground.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: gravitfy.comConnection: Keep-Alive
Source: msapplication.xml0.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x9f4ff2ee,0x01d75e5f</date><accdate>0x9f4ff2ee,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x9f4ff2ee,0x01d75e5f</date><accdate>0x9f4ff2ee,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x9f60a35c,0x01d75e5f</date><accdate>0x9f60a35c,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x9f60a35c,0x01d75e5f</date><accdate>0x9f60a35c,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x9f60a35c,0x01d75e5f</date><accdate>0x9f60a35c,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x9f60a35c,0x01d75e5f</date><accdate>0x9f60a35c,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: unknown DNS traffic detected: queries for: maxcdn.bootstrapcdn.com
Source: font-awesome.min[1].css.3.dr String found in binary or memory: http://fontawesome.io
Source: font-awesome.min[1].css.3.dr String found in binary or memory: http://fontawesome.io/license
Source: bootstrap.min[1].css.3.dr String found in binary or memory: http://getbootstrap.com)
Source: msapplication.xml.1.dr String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.1.dr String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.1.dr String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.1.dr String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.1.dr String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.1.dr String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.1.dr String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.1.dr String found in binary or memory: http://www.youtube.com/
Source: css[1].css.3.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxM.woff)
Source: css[1].css.3.dr String found in binary or memory: https://fonts.gstatic.com/s/varelaround/v13/w8gdH283Tvk__Lua32TysjIfp8uJ.woff)
Source: bootstrap.min[1].css.3.dr String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.3:49721 version: TLS 1.2
Source: classification engine Classification label: mal52.phis.evad.winHTM@3/23@2/2
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DFF818C42C07F5AA3B.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3728 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3728 CREDAT:17410 /prefetch:2 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior

Data Obfuscation:

barindex
Obfuscated HTML file found
Source: #Ud83d#Udce9-peter.nash.htm Initial file: Did not found title: "Undelivered email local access" in HTML/HTM content
Source: #Ud83d#Udce9-peter.nash.htm Initial file: Did not found title: "Undelivered email local access" in HTML/HTM content
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 432756 Sample: #Ud83d#Udce9-peter.nash.htm Startdate: 10/06/2021 Architecture: WINDOWS Score: 52 15 Yara detected HtmlPhish44 2->15 17 Obfuscated HTML file found 2->17 6 iexplore.exe 2 86 2->6         started        process3 process4 8 iexplore.exe 1 41 6->8         started        dnsIp5 11 gravitfy.com 185.61.154.34, 49727, 49729, 80 NAMECHEAP-NETUS United Kingdom 8->11 13 maxcdn.bootstrapcdn.com 104.18.11.207, 443, 49721, 49723 CLOUDFLARENETUS United States 8->13
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.18.11.207
 maxcdn.bootstrapcdn.com United States
13335 CLOUDFLARENETUS false
185.61.154.34
 gravitfy.com United Kingdom
22612 NAMECHEAP-NETUS false

Contacted Domains

Name IP Active
maxcdn.bootstrapcdn.com 104.18.11.207 true
gravitfy.com 185.61.154.34 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm true
    		low
    http://gravitfy.com/bground.png false
    • Avira URL Cloud: safe
    		 unknown