Windows Analysis Report
https://www.evernote.com/shard/s443/sh/16f13b8c-02ff-0a26-4836-50c84b9d360b/0d9feaf1d42defc3a56edc7c078ed34b

Overview

General Information

Sample URL: https://www.evernote.com/shard/s443/sh/16f13b8c-02ff-0a26-4836-50c84b9d360b/0d9feaf1d42defc3a56edc7c078ed34b
Analysis ID: 756134

Detection

HTMLPhisher
Score: 52
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected HtmlPhish10
Phishing site detected (based on image similarity)
HTML body contains low number of good links
Invalid T&C link found
None HTTPS page querying sensitive user data (password, username or email)
No HTML title found

Classification

Phishing

barindex
Source: Yara match File source: 35583.3.pages.csv, type: HTML
Source: file:///C:/Users/alfredo/Downloads/message%20html.html Matcher: Found strong image similarity, brand: Microsoft image: 35583.3.img.1.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
Source: file:///C:/Users/alfredo/Downloads/message%20html.html Matcher: Found strong image similarity, brand: Microsoft image: 67460.4.img.1.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
Source: file:///C:/Users/alfredo/Downloads/message%20html.html Matcher: Found strong image similarity, brand: Microsoft image: 35583.3.img.1.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
Source: file:///C:/Users/alfredo/Downloads/message%20html.html Matcher: Found strong image similarity, brand: Microsoft image: 67460.4.img.1.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
Source: file:///C:/Users/alfredo/Downloads/message%20html.html Matcher: Found strong image similarity, brand: Microsoft image: 35583.3.img.1.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
Source: file:///C:/Users/alfredo/Downloads/message%20html.html Matcher: Found strong image similarity, brand: Microsoft image: 67460.4.img.1.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
Source: file:///C:/Users/alfredo/Downloads/message%20html.html Matcher: Found strong image similarity, brand: Microsoft image: 35583.3.img.1.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
Source: file:///C:/Users/alfredo/Downloads/message%20html.html Matcher: Found strong image similarity, brand: Microsoft image: 67460.4.img.1.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
Source: file:///C:/Users/alfredo/Downloads/message%20html.html Matcher: Found strong image similarity, brand: Microsoft image: 35583.3.img.1.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
Source: file:///C:/Users/alfredo/Downloads/message%20html.html Matcher: Found strong image similarity, brand: Microsoft image: 67460.4.img.1.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
Source: file:///C:/Users/alfredo/Downloads/message%20html.html Matcher: Found strong image similarity, brand: Microsoft image: 35583.3.img.1.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
Source: file:///C:/Users/alfredo/Downloads/message%20html.html Matcher: Found strong image similarity, brand: Microsoft image: 67460.4.img.1.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
Source: file:///C:/Users/alfredo/Downloads/message%20html.html Matcher: Found strong image similarity, brand: Microsoft image: 35583.3.img.1.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
Source: file:///C:/Users/alfredo/Downloads/message%20html.html Matcher: Found strong image similarity, brand: Microsoft image: 67460.4.img.1.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
Source: file:///C:/Users/alfredo/Downloads/message%20html.html Matcher: Found strong image similarity, brand: Microsoft image: 35583.3.img.1.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
Source: file:///C:/Users/alfredo/Downloads/message%20html.html Matcher: Found strong image similarity, brand: Microsoft image: 67460.4.img.1.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
Source: file:///C:/Users/alfredo/Downloads/message%20html.html Matcher: Found strong image similarity, brand: Microsoft image: 35583.3.img.1.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
Source: file:///C:/Users/alfredo/Downloads/message%20html.html Matcher: Found strong image similarity, brand: Microsoft image: 67460.4.img.1.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
Source: file:///C:/Users/alfredo/Downloads/message%20html.html Matcher: Found strong image similarity, brand: Microsoft image: 35583.3.img.1.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
Source: file:///C:/Users/alfredo/Downloads/message%20html.html Matcher: Found strong image similarity, brand: Microsoft image: 67460.4.img.1.gfk.csv EF884BDEDEF280DF97A4C5604058D8DB
Source: file:///C:/Users/alfredo/Downloads/message%20html.html HTTP Parser: Number of links: 1
Source: file:///C:/Users/alfredo/Downloads/message%20html.html HTTP Parser: Number of links: 1
Source: file:///C:/Users/alfredo/Downloads/message%20html.html HTTP Parser: Invalid link: Privacy & Cookies
Source: file:///C:/Users/alfredo/Downloads/message%20html.html HTTP Parser: Invalid link: Privacy & Cookies
Source: file:///C:/Users/alfredo/Downloads/message%20html.html HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/alfredo/Downloads/message%20html.html HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/alfredo/Downloads/message%20html.html HTTP Parser: HTML title missing
Source: file:///C:/Users/alfredo/Downloads/message%20html.html HTTP Parser: HTML title missing
Source: file:///C:/Users/alfredo/Downloads/message%20html.html HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/alfredo/Downloads/message%20html.html HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/alfredo/Downloads/message%20html.html HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/alfredo/Downloads/message%20html.html HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\GoogleUpdater
Source: unknown HTTPS traffic detected: 35.190.3.250:443 -> 192.168.2.3:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.108.153:443 -> 192.168.2.3:49769 version: TLS 1.2
Source: unknown DNS traffic detected: queries for: accounts.google.com
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 198.54.119.160
Source: unknown TCP traffic detected without corresponding DNS query: 198.54.119.160
Source: unknown TCP traffic detected without corresponding DNS query: 198.54.119.160
Source: unknown TCP traffic detected without corresponding DNS query: 198.54.119.160
Source: unknown TCP traffic detected without corresponding DNS query: 198.54.119.160
Source: unknown TCP traffic detected without corresponding DNS query: 198.54.119.160
Source: unknown TCP traffic detected without corresponding DNS query: 198.54.119.160
Source: unknown TCP traffic detected without corresponding DNS query: 198.54.119.160
Source: unknown TCP traffic detected without corresponding DNS query: 198.54.119.160
Source: unknown TCP traffic detected without corresponding DNS query: 198.54.119.160
Source: unknown TCP traffic detected without corresponding DNS query: 198.54.119.160
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.74.195
Source: unknown HTTPS traffic detected: 35.190.3.250:443 -> 192.168.2.3:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.108.153:443 -> 192.168.2.3:49769 version: TLS 1.2
Source: classification engine Classification label: mal52.phis.win@33/3@15/209
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.evernote.com/shard/s443/sh/16f13b8c-02ff-0a26-4836-50c84b9d360b/0d9feaf1d42defc3a56edc7c078ed34b
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1876,i,5793143598287430493,15367685435829181166,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1876,i,5793143598287430493,15367685435829181166,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Program Files\Google\GoogleUpdater
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\alfredo\Downloads\b72f04df-137b-4b17-9464-6169414c94f2.tmp
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\GoogleUpdater
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs