Loading ...

Play interactive tourEdit tour

Windows Analysis Report https://butlerbyers0-my.sharepoint.com/:b:/g/personal/asutherland_butlerbyers_com/EfIf6j4qKadNreVCKyNPdcgBhmXanuP3QiRYUkf9Z4DYeA?e=4%3aLonPjU&at=9

Overview

General Information

Sample URL:https://butlerbyers0-my.sharepoint.com/:b:/g/personal/asutherland_butlerbyers_com/EfIf6j4qKadNreVCKyNPdcgBhmXanuP3QiRYUkf9Z4DYeA?e=4%3aLonPjU&at=9
Analysis ID:552939
Infos:

Most interesting Screenshot:

Detection

HTMLPhisher
Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected HtmlPhish10
Phishing site detected (based on logo template match)
Phishing site detected (based on image similarity)
HTML body contains low number of good links
No HTML title found
Submit button contains javascript call

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 6944 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://butlerbyers0-my.sharepoint.com/:b:/g/personal/asutherland_butlerbyers_com/EfIf6j4qKadNreVCKyNPdcgBhmXanuP3QiRYUkf9Z4DYeA?e=4%3aLonPjU&at=9 MD5: C139654B5C1438A95B321BB01AD63EF6)
    • chrome.exe (PID: 7104 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,11733445520260933474,11389062821075509341,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1896 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

Phishing:

barindex
Yara detected HtmlPhish10Show sources
Source: Yara matchFile source: 36433.0.pages.csv, type: HTML
Phishing site detected (based on logo template match)Show sources
Source: https://butlerbyers0-my.sharepoint.com/:b:/g/personal/asutherland_butlerbyers_com/EfIf6j4qKadNreVCKyNPdcgBhmXanuP3QiRYUkf9Z4DYeA?e=4%3aLonPjU&at=9Matcher: Template: microsoft matched
Phishing site detected (based on image similarity)Show sources
Source: https://butlerbyers0-my.sharepoint.com/:b:/g/personal/asutherland_butlerbyers_com/EfIf6j4qKadNreVCKyNPdcgBhmXanuP3QiRYUkf9Z4DYeA?e=4%3aLonPjU&at=9Matcher: Found strong image similarity, brand: Microsoft image: 36433.0.img.1.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
Source: https://butlerbyers0-my.sharepoint.com/:b:/g/personal/asutherland_butlerbyers_com/EfIf6j4qKadNreVCKyNPdcgBhmXanuP3QiRYUkf9Z4DYeA?e=4%3aLonPjU&at=9HTTP Parser: Number of links: 0
Source: https://butlerbyers0-my.sharepoint.com/:b:/g/personal/asutherland_butlerbyers_com/EfIf6j4qKadNreVCKyNPdcgBhmXanuP3QiRYUkf9Z4DYeA?e=4%3aLonPjU&at=9HTTP Parser: Number of links: 0
Source: https://butlerbyers0-my.sharepoint.com/:b:/g/personal/asutherland_butlerbyers_com/EfIf6j4qKadNreVCKyNPdcgBhmXanuP3QiRYUkf9Z4DYeA?e=4%3aLonPjU&at=9HTTP Parser: HTML title missing
Source: https://butlerbyers0-my.sharepoint.com/:b:/g/personal/asutherland_butlerbyers_com/EfIf6j4qKadNreVCKyNPdcgBhmXanuP3QiRYUkf9Z4DYeA?e=4%3aLonPjU&at=9HTTP Parser: HTML title missing
Source: https://butlerbyers0-my.sharepoint.com/:b:/g/personal/asutherland_butlerbyers_com/EfIf6j4qKadNreVCKyNPdcgBhmXanuP3QiRYUkf9Z4DYeA?e=4%3aLonPjU&at=9HTTP Parser: On click: javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("btnSubmitEmail", "", true, "", "", false, true))
Source: https://butlerbyers0-my.sharepoint.com/:b:/g/personal/asutherland_butlerbyers_com/EfIf6j4qKadNreVCKyNPdcgBhmXanuP3QiRYUkf9Z4DYeA?e=4%3aLonPjU&at=9HTTP Parser: On click: javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("btnSubmitEmail", "", true, "", "", false, true))
Source: https://butlerbyers0-my.sharepoint.com/:b:/g/personal/asutherland_butlerbyers_com/EfIf6j4qKadNreVCKyNPdcgBhmXanuP3QiRYUkf9Z4DYeA?e=4%3aLonPjU&at=9HTTP Parser: No <meta name="author".. found
Source: https://butlerbyers0-my.sharepoint.com/:b:/g/personal/asutherland_butlerbyers_com/EfIf6j4qKadNreVCKyNPdcgBhmXanuP3QiRYUkf9Z4DYeA?e=4%3aLonPjU&at=9HTTP Parser: No <meta name="author".. found
Source: https://butlerbyers0-my.sharepoint.com/:b:/g/personal/asutherland_butlerbyers_com/EfIf6j4qKadNreVCKyNPdcgBhmXanuP3QiRYUkf9Z4DYeA?e=4%3aLonPjU&at=9HTTP Parser: No <meta name="copyright".. found
Source: https://butlerbyers0-my.sharepoint.com/:b:/g/personal/asutherland_butlerbyers_com/EfIf6j4qKadNreVCKyNPdcgBhmXanuP3QiRYUkf9Z4DYeA?e=4%3aLonPjU&at=9HTTP Parser: No <meta name="copyright".. found
Source: unknownDNS traffic detected: queries for: butlerbyers0-my.sharepoint.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49846 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
Source: global trafficHTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global trafficHTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: Ruleset Data.0.drString found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr, Ruleset Data.0.drString found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.0.drString found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)
Source: angular.js.0.drString found in binary or memory: http://angularjs.org
Source: angular.js.0.drString found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: mirroring_hangouts.js.0.drString found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.0.drString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.0.drString found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.0.drString found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: cc86c194-80fb-467a-9693-6577e5e1d808.tmp.1.dr, 25b0e8d5-cf27-45ef-aa87-890fee92464c.tmp.1.dr, manifest.json.0.drString found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.drString found in binary or memory: https://accounts.google.com/MergeSession
Source: cc86c194-80fb-467a-9693-6577e5e1d808.tmp.1.dr, 25b0e8d5-cf27-45ef-aa87-890fee92464c.tmp.1.dr, manifest.json.0.drString found in binary or memory: https://apis.google.com
Source: mirroring_common.js.0.drString found in binary or memory: https://apis.google.com/js/client.js
Source: 000003.log3.0.drString found in binary or memory: https://butlerbyers0-my.sharepoint.com/
Source: History.0.drString found in binary or memory: https://butlerbyers0-my.sharepoint.com/:b:/g/personal/asutherland_butlerbyers_com/EfIf6j4qKadNreVCKy
Source: data_1.1.drString found in binary or memory: https://butlerbyers0-my.sharepoint.com/ScriptResource.axd?d=HMLT-q6Z-I-56DVgw_AapYMOVOo7wjPURsMJ040c
Source: data_1.1.drString found in binary or memory: https://butlerbyers0-my.sharepoint.com/ScriptResource.axd?d=TqCa2ajwx3-jegRarYP9FiS-jTsQKhX7OpSAj8Bf
Source: data_1.1.drString found in binary or memory: https://butlerbyers0-my.sharepoint.com/ScriptResource.axd?d=tMb12HI_Rkty8heApjUyjgMO7HUvR4yMLOMq4kgU
Source: data_1.1.drString found in binary or memory: https://butlerbyers0-my.sharepoint.com/WebResource.axd?d=-NxefrrhDFASS5SooCL9FI0xMmx4BdoQogm_yX5O5ea
Source: data_1.1.dr, Favicons.0.drString found in binary or memory: https://butlerbyers0-my.sharepoint.com/_layouts/15/images/favicon.ico?rev=47
Source: data_1.1.drString found in binary or memory: https://butlerbyers0-my.sharepoint.com/_layouts/15/images/favicon.ico?rev=47CgkKBw30glciGgA=D
Source: data_1.1.drString found in binary or memory: https://butlerbyers0-my.sharepoint.com/_layouts/15/images/microsoft-logo.png
Source: Current Session.0.drString found in binary or memory: https://butlerbyers0-my.sharepoint.com/personal/asutherland_butlerbyers_com/_layouts/15/guestaccess.
Source: mirroring_common.js.0.drString found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: cc86c194-80fb-467a-9693-6577e5e1d808.tmp.1.dr, 25b0e8d5-cf27-45ef-aa87-890fee92464c.tmp.1.drString found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.0.dr, mirroring_cast_streaming.js.0.drString found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json1.0.dr, manifest.json.0.drString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: cc86c194-80fb-467a-9693-6577e5e1d808.tmp.1.dr, 25b0e8d5-cf27-45ef-aa87-890fee92464c.tmp.1.drString found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.0.drString found in binary or memory: https://clients6.google.com
Source: 25b0e8d5-cf27-45ef-aa87-890fee92464c.tmp.1.drString found in binary or memory: https://content-autofill.googleapis.com
Source: data_1.1.drString found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIUCdlL_48gq7ZEEgk
Source: manifest.json.0.drString found in binary or memory: https://content.googleapis.com
Source: mirroring_cast_streaming.js.0.dr, common.js.0.drString found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: LICENSE.txt.0.drString found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.drString found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: mirroring_hangouts.js.0.drString found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: Reporting and NEL.1.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external
Source: cc86c194-80fb-467a-9693-6577e5e1d808.tmp.1.dr, 0cffb7d5-7f34-4dbf-b091-756a629f1f2f.tmp.1.dr, 25b0e8d5-cf27-45ef-aa87-890fee92464c.tmp.1.dr, 037376f2-fcec-43e1-a4dd-8da356b9f62d.tmp.1.drString found in binary or memory: https://dns.google
Source: mirroring_common.js.0.drString found in binary or memory: https://docs.google.com
Source: LICENSE.txt.0.drString found in binary or memory: https://easylist.to/)
Source: manifest.json.0.drString found in binary or memory: https://feedback.googleusercontent.com
Source: cc86c194-80fb-467a-9693-6577e5e1d808.tmp.1.dr, 25b0e8d5-cf27-45ef-aa87-890fee92464c.tmp.1.drString found in binary or memory: https://fonts.googleapis.com
Source: manifest.json.0.drString found in binary or memory: https://fonts.googleapis.com;
Source: cc86c194-80fb-467a-9693-6577e5e1d808.tmp.1.dr, 25b0e8d5-cf27-45ef-aa87-890fee92464c.tmp.1.drString found in binary or memory: https://fonts.gstatic.com
Source: manifest.json.0.drString found in binary or memory: https://fonts.gstatic.com;
Source: material_css_min.css.0.dr, angular.js.0.drString found in binary or memory: https://github.com/angular/material
Source: LICENSE.txt.0.drString found in binary or memory: https://github.com/easylist)
Source: craw_window.js.0.dr, craw_background.js.0.drString found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.0.drString found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: mirroring_hangouts.js.0.drString found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json.0.drString found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.0.drString found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: mirroring_common.js.0.drString found in binary or memory: https://meet.google.com
Source: mirroring_hangouts.js.0.drString found in binary or memory: https://meetings.clients6.google.com
Source: data_1.1.drString found in binary or memory: https://modernb.akamai.odsp.cdn.office.net/files/odsp-web-prod_2021-12-31.001/spoguestaccess-6210136
Source: mirroring_common.js.0.drString found in binary or memory: https://networktraversal.googleapis.com/v1alpha
Source: cc86c194-80fb-467a-9693-6577e5e1d808.tmp.1.dr, 25b0e8d5-cf27-45ef-aa87-890fee92464c.tmp.1.drString found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json1.0.drString found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: cc86c194-80fb-467a-9693-6577e5e1d808.tmp.1.dr, 25b0e8d5-cf27-45ef-aa87-890fee92464c.tmp.1.drString found in binary or memory: https://play.google.com
Source: mirroring_hangouts.js.0.drString found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: mirroring_hangouts.js.0.drString found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: cc86c194-80fb-467a-9693-6577e5e1d808.tmp.1.drString found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: cc86c194-80fb-467a-9693-6577e5e1d808.tmp.1.dr, 25b0e8d5-cf27-45ef-aa87-890fee92464c.tmp.1.drString found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json1.0.drString found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: data_3.1.drString found in binary or memory: https://spo.nel.measure.office.net/api/report?tenantId=813f5d42-ec41-452d-abd1-d5d3f7fb5648&destinat
Source: data_1.1.drString found in binary or memory: https://spoppe-b.azureedge.net/files/fabric-cdn-prod_20211104.001/assets/item-types/32/pdf.png
Source: data_1.1.drString found in binary or memory: https://spoppe-b.azureedge.net/files/fabric-cdn-prod_20211104.001/assets/item-types/32/pdf.png9
Source: cc86c194-80fb-467a-9693-6577e5e1d808.tmp.1.dr, 25b0e8d5-cf27-45ef-aa87-890fee92464c.tmp.1.drString found in binary or memory: https://ssl.gstatic.com
Source: data_1.1.drString found in binary or memory: https://statica.akamai.odsp.cdn.office.net/bld/_layouts/15/16.0.22008.12008/require.js
Source: data_1.1.drString found in binary or memory: https://statica.akamai.odsp.cdn.office.net/bld/_layouts/15/16.0.22008.12008/require.jswq
Source: messages.json41.0.dr, messages.json15.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json29.0.dr, feedback.html.0.dr, messages.json23.0.dr, messages.json61.0.dr, messages.json62.0.dr, messages.json75.0.dr, messages.json59.0.dr, messages.json27.0.dr, messages.json79.0.dr, messages.json25.0.dr, messages.json44.0.dr, messages.json46.0.dr, messages.json74.0.dr, messages.json0.0.dr, messages.json14.0.dr, messages.json57.0.dr, messages.json76.0.dr, messages.json.0.dr, messages.json43.0.dr, messages.json28.0.dr, messages.json10.0.dr, messages.json9.0.dr, messages.json8.0.dr, messages.json78.0.dr, messages.json2.0.dr, messages.json60.0.dr, messages.json77.0.dr, messages.json11.0.dr, messages.json64.0.dr, messages.json6.0.dr, messages.json1.0.dr, messages.json30.0.dr, messages.json22.0.dr, messages.json58.0.dr, messages.json12.0.dr, messages.json4.0.dr, messages.json40.0.dr, messages.json45.0.dr, messages.json24.0.dr, messages.json65.0.dr, messages.json3.0.dr, messages.json13.0.dr, messages.json63.0.dr, messages.json47.0.dr, messages.json42.0.dr, messages.json21.0.drString found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json41.0.dr, messages.json15.0.dr, messages.json5.0.dr, messages.json7.0.dr, messages.json29.0.dr, feedback.html.0.dr, messages.json23.0.dr, messages.json61.0.dr, messages.json62.0.dr, messages.json75.0.dr, messages.json59.0.dr, messages.json27.0.dr, messages.json79.0.dr, messages.json25.0.dr, messages.json44.0.dr, messages.json46.0.dr, messages.json74.0.dr, messages.json0.0.dr, messages.json14.0.dr, messages.json57.0.dr, messages.json76.0.dr, messages.json.0.dr, messages.json43.0.dr, messages.json28.0.dr, messages.json10.0.dr, messages.json9.0.dr, messages.json8.0.dr, messages.json78.0.dr, messages.json2.0.dr, messages.json60.0.dr, messages.json77.0.dr, messages.json11.0.dr, messages.json64.0.dr, messages.json6.0.dr, messages.json1.0.dr, messages.json30.0.dr, messages.json22.0.dr, messages.json58.0.dr, messages.json12.0.dr, messages.json4.0.dr, messages.json40.0.dr, messages.json45.0.dr, messages.json24.0.dr, messages.json65.0.dr, messages.json3.0.dr, messages.json13.0.dr, messages.json63.0.dr, messages.json47.0.dr, messages.json42.0.dr, messages.json21.0.drString found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: craw_window.js.0.dr, craw_background.js.0.drString found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: cc86c194-80fb-467a-9693-6577e5e1d808.tmp.1.dr, 25b0e8d5-cf27-45ef-aa87-890fee92464c.tmp.1.dr, manifest.json.0.drString found in binary or memory: https://www.google.com
Source: manifest.json1.0.drString found in binary or memory: https://www.google.com/
Source: craw_window.js.0.drString found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.drString found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.drString found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.drString found in binary or memory: