Windows Analysis Report DHL Documents.html

Overview

General Information

Sample Name: DHL Documents.html
Analysis ID: 452310
MD5: 1a10cc572b13e1e3ac87aa5b828f361e
SHA1: 7d4b10eebfaab57f31c3284370c307fe87c1e226
SHA256: 9bbac023e088dd861025b79a10ec0f1ffa576c5ecba2d7ad8f5b3f3217b818cf
Infos:

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected HtmlPhish10
HTML body contains low number of good links
HTML title does not match URL
IP address seen in connection with other malware
None HTTPS page querying sensitive user data (password, username or email)
Suspicious form URL found

Classification

Phishing:

barindex
Yara detected HtmlPhish10
Source: Yara match File source: DHL Documents.html, type: SAMPLE
Source: Yara match File source: 21604.pages.csv, type: HTML
HTML body contains low number of good links
Source: file:///C:/Users/user/Desktop/DHL%20Documents.html HTTP Parser: Number of links: 0
Source: file:///C:/Users/user/Desktop/DHL%20Documents.html HTTP Parser: Number of links: 0
HTML title does not match URL
Source: file:///C:/Users/user/Desktop/DHL%20Documents.html HTTP Parser: Title: does not match URL
Source: file:///C:/Users/user/Desktop/DHL%20Documents.html HTTP Parser: Title: does not match URL
None HTTPS page querying sensitive user data (password, username or email)
Source: file:///C:/Users/user/Desktop/DHL%20Documents.html HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/DHL%20Documents.html HTTP Parser: Has password / email / username input fields
Suspicious form URL found
Source: file:///C:/Users/user/Desktop/DHL%20Documents.html HTTP Parser: Form action: https://grupoplexon.com/planos/home/09.php
Source: file:///C:/Users/user/Desktop/DHL%20Documents.html HTTP Parser: Form action: https://grupoplexon.com/planos/home/09.php
Source: file:///C:/Users/user/Desktop/DHL%20Documents.html HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/DHL%20Documents.html HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/DHL%20Documents.html HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/DHL%20Documents.html HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Jump to behavior

Networking:

barindex
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Source: Ruleset Data.1.dr String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Ruleset Data.1.dr String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: unknown DNS traffic detected: queries for: clients2.google.com
Source: cd4535b3-5a06-4cef-91f6-1b3410b8bba1.tmp.2.dr, 62d30865-a5ba-4a09-ab85-6edb44f17680.tmp.2.dr, manifest.json0.1.dr String found in binary or memory: https://accounts.google.com
Source: cd4535b3-5a06-4cef-91f6-1b3410b8bba1.tmp.2.dr, 62d30865-a5ba-4a09-ab85-6edb44f17680.tmp.2.dr, manifest.json0.1.dr String found in binary or memory: https://apis.google.com
Source: cd4535b3-5a06-4cef-91f6-1b3410b8bba1.tmp.2.dr, 62d30865-a5ba-4a09-ab85-6edb44f17680.tmp.2.dr String found in binary or memory: https://clients2.google.com
Source: manifest.json0.1.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: cd4535b3-5a06-4cef-91f6-1b3410b8bba1.tmp.2.dr, 62d30865-a5ba-4a09-ab85-6edb44f17680.tmp.2.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.1.dr String found in binary or memory: https://content.googleapis.com
Source: cd4535b3-5a06-4cef-91f6-1b3410b8bba1.tmp.2.dr, 62d30865-a5ba-4a09-ab85-6edb44f17680.tmp.2.dr, aa5d2781-a662-4b34-bc0b-610c6ec65c5e.tmp.2.dr, 5a145952-d5cf-4ba7-9348-d1ff5f06b0cd.tmp.2.dr String found in binary or memory: https://dns.google
Source: cd4535b3-5a06-4cef-91f6-1b3410b8bba1.tmp.2.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com
Source: DHL Documents.html String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcR71V2P5cb2iSWYyNiRfksSfd2nGwGEz5rfMg&usqp=CAU
Source: DHL Documents.html String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRl-dCivUVrm3P6-PH_hNHYCWuxCJBdtBCNFA&usqp=CAU
Source: manifest.json0.1.dr String found in binary or memory: https://feedback.googleusercontent.com
Source: 62d30865-a5ba-4a09-ab85-6edb44f17680.tmp.2.dr String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json0.1.dr String found in binary or memory: https://fonts.googleapis.com;
Source: cd4535b3-5a06-4cef-91f6-1b3410b8bba1.tmp.2.dr, 62d30865-a5ba-4a09-ab85-6edb44f17680.tmp.2.dr String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json0.1.dr String found in binary or memory: https://fonts.gstatic.com;
Source: DHL Documents.html, Current Session.1.dr String found in binary or memory: https://grupoplexon.com/planos/home/09.php
Source: manifest.json0.1.dr String found in binary or memory: https://hangouts.google.com/
Source: cd4535b3-5a06-4cef-91f6-1b3410b8bba1.tmp.2.dr, 62d30865-a5ba-4a09-ab85-6edb44f17680.tmp.2.dr String found in binary or memory: https://ogs.google.com
Source: manifest.json.1.dr String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: cd4535b3-5a06-4cef-91f6-1b3410b8bba1.tmp.2.dr, 62d30865-a5ba-4a09-ab85-6edb44f17680.tmp.2.dr String found in binary or memory: https://play.google.com
Source: cd4535b3-5a06-4cef-91f6-1b3410b8bba1.tmp.2.dr String found in binary or memory: https://r2---sn-h0jeln7e.gvt1.com
Source: cd4535b3-5a06-4cef-91f6-1b3410b8bba1.tmp.2.dr String found in binary or memory: https://redirector.gvt1.com
Source: manifest.json.1.dr String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: cd4535b3-5a06-4cef-91f6-1b3410b8bba1.tmp.2.dr, 62d30865-a5ba-4a09-ab85-6edb44f17680.tmp.2.dr String found in binary or memory: https://ssl.gstatic.com
Source: messages.json83.1.dr String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json83.1.dr String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: cd4535b3-5a06-4cef-91f6-1b3410b8bba1.tmp.2.dr, 62d30865-a5ba-4a09-ab85-6edb44f17680.tmp.2.dr, manifest.json0.1.dr String found in binary or memory: https://www.google.com
Source: manifest.json.1.dr String found in binary or memory: https://www.google.com/
Source: manifest.json0.1.dr String found in binary or memory: https://www.google.com;
Source: cd4535b3-5a06-4cef-91f6-1b3410b8bba1.tmp.2.dr, 62d30865-a5ba-4a09-ab85-6edb44f17680.tmp.2.dr String found in binary or memory: https://www.googleapis.com
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: cd4535b3-5a06-4cef-91f6-1b3410b8bba1.tmp.2.dr, 62d30865-a5ba-4a09-ab85-6edb44f17680.tmp.2.dr String found in binary or memory: https://www.gstatic.com
Source: manifest.json0.1.dr String found in binary or memory: https://www.gstatic.com;
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: classification engine Classification label: mal48.phis.winHTML@41/229@3/6
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-60F96137-734.pma Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\8264c5b6-358f-4968-a521-063e8d881faf.tmp Jump to behavior
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'C:\Users\user\Desktop\DHL Documents.html'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1544,14982751535075210194,15195143519103781389,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1760 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1544,14982751535075210194,15195143519103781389,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1760 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic Jump to behavior
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs