Analysis Report https://jaquel988.s3.eu-de.cloud-object-storage.appdomain.cloud/holistically/index.html

Overview

General Information

Sample URL: https://jaquel988.s3.eu-de.cloud-object-storage.appdomain.cloud/holistically/index.html
Analysis ID: 433184
Infos:

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 72
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for domain / URL
Phishing site detected (based on favicon image match)
Yara detected HtmlPhish7

Classification

AV Detection:

barindex
Antivirus / Scanner detection for submitted sample
Source: https://jaquel988.s3.eu-de.cloud-object-storage.appdomain.cloud/holistically/index.html SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering
Multi AV Scanner detection for domain / URL
Source: smtpro101.com Virustotal: Detection: 5% Perma Link

Phishing:

barindex
Phishing site detected (based on favicon image match)
Source: https://jaquel988.s3.eu-de.cloud-object-storage.appdomain.cloud/holistically/index.html Matcher: Template: onedrive matched with high similarity
Yara detected HtmlPhish7
Source: Yara match File source: 76766.pages.csv, type: HTML
Source: unknown HTTPS traffic detected: 172.67.194.129:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.194.129:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown DNS traffic detected: queries for: jaquel988.s3.eu-de.cloud-object-storage.appdomain.cloud
Source: Reporting and NEL.1.dr String found in binary or memory: https://a.nel.cloudflare.com/report/v2?s=WgkK74zAsYgn0ikBitP2OgZwHHWZppespt61o2KelwjuCBOEEWQbvU3zF9w
Source: manifest.json0.0.dr, fb36ddf4-9218-41a4-9778-19476656abb7.tmp.1.dr String found in binary or memory: https://accounts.google.com
Source: d34a7ddafe08574e_0.0.dr String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
Source: manifest.json0.0.dr, fb36ddf4-9218-41a4-9778-19476656abb7.tmp.1.dr String found in binary or memory: https://apis.google.com
Source: d34a7ddafe08574e_0.0.dr String found in binary or memory: https://appdomain.cloud/W
Source: fb36ddf4-9218-41a4-9778-19476656abb7.tmp.1.dr String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: fb36ddf4-9218-41a4-9778-19476656abb7.tmp.1.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.0.dr String found in binary or memory: https://content.googleapis.com
Source: Reporting and NEL.1.dr String found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external
Source: c5d7b48d-775d-45b2-aad0-ba077f073956.tmp.1.dr, 1860bc56-ebc4-4c83-bf7e-d48ef1d210a8.tmp.1.dr, fb36ddf4-9218-41a4-9778-19476656abb7.tmp.1.dr String found in binary or memory: https://dns.google
Source: manifest.json0.0.dr String found in binary or memory: https://feedback.googleusercontent.com
Source: fb36ddf4-9218-41a4-9778-19476656abb7.tmp.1.dr String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json0.0.dr String found in binary or memory: https://fonts.googleapis.com;
Source: fb36ddf4-9218-41a4-9778-19476656abb7.tmp.1.dr String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json0.0.dr String found in binary or memory: https://fonts.gstatic.com;
Source: manifest.json0.0.dr String found in binary or memory: https://hangouts.google.com/
Source: Current Session.0.dr, Favicons.0.dr String found in binary or memory: https://jaquel988.s3.eu-de.cloud-object-storage.appdomain.cloud/holistically/index.html
Source: History Provider Cache.0.dr String found in binary or memory: https://jaquel988.s3.eu-de.cloud-object-storage.appdomain.cloud/holistically/index.html2
Source: History.0.dr String found in binary or memory: https://jaquel988.s3.eu-de.cloud-object-storage.appdomain.cloud/holistically/index.htmlDocument
Source: History.0.dr String found in binary or memory: https://jaquel988.s3.eu-de.cloud-object-storage.appdomain.cloud/holistically/index.htmlDocument/#
Source: fb36ddf4-9218-41a4-9778-19476656abb7.tmp.1.dr String found in binary or memory: https://ogs.google.com
Source: Favicons.0.dr String found in binary or memory: https://p.sfx.ms/images/favicon.ico
Source: manifest.json.0.dr String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: fb36ddf4-9218-41a4-9778-19476656abb7.tmp.1.dr String found in binary or memory: https://play.google.com
Source: fb36ddf4-9218-41a4-9778-19476656abb7.tmp.1.dr String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: fb36ddf4-9218-41a4-9778-19476656abb7.tmp.1.dr String found in binary or memory: https://redirector.gvt1.com
Source: manifest.json.0.dr String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: fb36ddf4-9218-41a4-9778-19476656abb7.tmp.1.dr String found in binary or memory: https://ssl.gstatic.com
Source: messages.json41.0.dr String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json41.0.dr String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: manifest.json0.0.dr, fb36ddf4-9218-41a4-9778-19476656abb7.tmp.1.dr String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr String found in binary or memory: https://www.google.com/
Source: manifest.json0.0.dr String found in binary or memory: https://www.google.com;
Source: fb36ddf4-9218-41a4-9778-19476656abb7.tmp.1.dr String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: fb36ddf4-9218-41a4-9778-19476656abb7.tmp.1.dr String found in binary or memory: https://www.gstatic.com
Source: manifest.json0.0.dr String found in binary or memory: https://www.gstatic.com;
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown HTTPS traffic detected: 172.67.194.129:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.194.129:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: classification engine Classification label: mal72.phis.win@28/165@6/6
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-60C33A54-1A68.pma Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\fcee178f-1175-4cd9-9861-d4896a6f469c.tmp Jump to behavior
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'https://jaquel988.s3.eu-de.cloud-object-storage.appdomain.cloud/holistically/index.html'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1548,17066045450230554925,12969004561117471689,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1756 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1548,17066045450230554925,12969004561117471689,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1756 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 433184 URL: https://jaquel988.s3.eu-de.... Startdate: 11/06/2021 Architecture: WINDOWS Score: 72 13 smtpro101.com 2->13 15 p.sfx.ms 2->15 27 Multi AV Scanner detection for domain / URL 2->27 29 Antivirus / Scanner detection for submitted sample 2->29 31 Phishing site detected (based on favicon image match) 2->31 33 Yara detected HtmlPhish7 2->33 7 chrome.exe 14 384 2->7         started        signatures3 process4 dnsIp5 17 192.168.2.1 unknown unknown 7->17 19 239.255.255.250 unknown Reserved 7->19 10 chrome.exe 18 7->10         started        process6 dnsIp7 21 smtpro101.com 172.67.194.129, 443, 49736, 49737 CLOUDFLARENETUS United States 10->21 23 s3.eu-de.cloud-object-storage.appdomain.cloud 158.177.118.97, 443, 49733 SOFTLAYERUS United States 10->23 25 5 other IPs or domains 10->25
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.180.225
 googlehosted.l.googleusercontent.com United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
158.177.118.97
 s3.eu-de.cloud-object-storage.appdomain.cloud United States
36351 SOFTLAYERUS false
172.67.194.129
 smtpro101.com United States
13335 CLOUDFLARENETUS true

Private
IP
192.168.2.1
127.0.0.1

Contacted Domains

Name IP Active
smtpro101.com 172.67.194.129 true
s3.eu-de.cloud-object-storage.appdomain.cloud 158.177.118.97 true
googlehosted.l.googleusercontent.com 142.250.180.225 true
clients2.googleusercontent.com unknown unknown
jaquel988.s3.eu-de.cloud-object-storage.appdomain.cloud unknown unknown
p.sfx.ms unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://jaquel988.s3.eu-de.cloud-object-storage.appdomain.cloud/holistically/index.html true
    		unknown