Edit tour

# Windows Analysis Report http://dlg.thermoval.mx/vn/mic%20(1)/mic/?e=amxnQGRsZy5kaw==

## Overview

### General Information

 Sample URL: http://dlg.thermoval.mx/vn/mic%20(1)/mic/?e=amxnQGRsZy5kaw== Analysis ID: 736954 Infos:

### Detection

 Score: 64 Range: 0 - 100 Whitelisted: false Confidence: 100%

### Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain

### Classification

• System is w10x64
• chrome.exe (PID: 3712 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "http://dlg.thermoval.mx/vn/mic%20(1)/mic/?e=amxnQGRsZy5kaw== MD5: 0FEC2748F363150DC54C1CAFFB1A9408)
• cleanup
No configs have been found
SourceRuleDescriptionAuthorStrings
No Sigma rule has matched
No Snort rule has matched

### AV Detection

 Source: http://dlg.thermoval.mx/vn/mic%20(1)/mic/?e=amxnQGRsZy5kaw== SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering
 Source: http://dlg.thermoval.mx/vn/mic%20(1)/mic/main/ SlashNext: Label: Credential Stealing type: Phishing & Social Engineering

### Phishing

 Source: Yara match File source: 30138.0.pages.csv, type: HTML Source: Yara match File source: 71540.2.pages.csv, type: HTML
 Source: unknown DNS traffic detected: queries for: accounts.google.com
 Source: unknown Network traffic detected: HTTP traffic on port 49698 -> 443 Source: unknown Network traffic detected: HTTP traffic on port 49699 -> 443 Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49699 Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49698 Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443 Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443 Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443 Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443 Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443 Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707 Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705 Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443 Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749 Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715 Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703 Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
 Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 03 Nov 2022 11:29:53 GMTServer: ApacheContent-Length: 315Keep-Alive: timeout=5, max=97Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: 404 Not Found

Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.

 Source: unknown HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
 Source: classification engine Classification label: mal64.phis.win@25/0@6/8