Windows Analysis Report
paystub_11_24_2022.html

Overview

General Information

Sample Name: paystub_11_24_2022.html
Analysis ID: 756209
MD5: e1892a15eb3e631a1092656d70b4d153
SHA1: bb4fedcb1a78f24312d38b38614c67f3da01abe6
SHA256: 3a038932b8fca36ec5b47950e9d903c746b2430e313ccbec2e94a0919353077b

Detection

HTMLPhisher
Score: 64
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected HtmlPhish10
Yara detected HtmlPhish54
HTML document with suspicious title
Phishing site detected (based on image similarity)
None HTTPS page querying sensitive user data (password, username or email)
No HTML title found

Classification

Phishing
barindex
Yara detected HtmlPhish10
Source: Yara match File source: 84922.0.pages.csv, type: HTML
Yara detected HtmlPhish54
Source: Yara match File source: 84922.0.pages.csv, type: HTML
Phishing site detected (based on image similarity)
Source: file:///C:/Users/eyup/Desktop/paystub_11_24_2022.html Matcher: Found strong image similarity, brand: Microsoft image: 84922.0.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: file:///C:/Users/eyup/Desktop/paystub_11_24_2022.html Matcher: Found strong image similarity, brand: Microsoft image: 84922.0.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: file:///C:/Users/eyup/Desktop/paystub_11_24_2022.html Matcher: Found strong image similarity, brand: Microsoft image: 80632.3.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: file:///C:/Users/eyup/Desktop/paystub_11_24_2022.html Matcher: Found strong image similarity, brand: Microsoft image: 84922.0.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: file:///C:/Users/eyup/Desktop/paystub_11_24_2022.html Matcher: Found strong image similarity, brand: Microsoft image: 80632.3.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: file:///C:/Users/eyup/Desktop/paystub_11_24_2022.html Matcher: Found strong image similarity, brand: Microsoft image: 84922.0.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: file:///C:/Users/eyup/Desktop/paystub_11_24_2022.html Matcher: Found strong image similarity, brand: Microsoft image: 80632.3.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: file:///C:/Users/eyup/Desktop/paystub_11_24_2022.html Matcher: Found strong image similarity, brand: Microsoft image: 84922.0.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: file:///C:/Users/eyup/Desktop/paystub_11_24_2022.html Matcher: Found strong image similarity, brand: Microsoft image: 80632.3.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: file:///C:/Users/eyup/Desktop/paystub_11_24_2022.html Matcher: Found strong image similarity, brand: Microsoft image: 84922.0.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
Source: file:///C:/Users/eyup/Desktop/paystub_11_24_2022.html Matcher: Found strong image similarity, brand: Microsoft image: 80632.3.img.1.gfk.csv EE5C8D9FB6248C938FD0DC19370E90BD
None HTTPS page querying sensitive user data (password, username or email)
Source: file:///C:/Users/eyup/Desktop/paystub_11_24_2022.html HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/eyup/Desktop/paystub_11_24_2022.html HTTP Parser: Has password / email / username input fields
No HTML title found
Source: file:///C:/Users/eyup/Desktop/paystub_11_24_2022.html HTTP Parser: HTML title missing
Source: file:///C:/Users/eyup/Desktop/paystub_11_24_2022.html HTTP Parser: HTML title missing
Source: file:///C:/Users/eyup/Desktop/paystub_11_24_2022.html HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/eyup/Desktop/paystub_11_24_2022.html HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/eyup/Desktop/paystub_11_24_2022.html HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/eyup/Desktop/paystub_11_24_2022.html HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\GoogleUpdater
Source: unknown HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.2:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 152.199.23.72:443 -> 192.168.2.2:49745 version: TLS 1.2
Source: unknown DNS traffic detected: queries for: accounts.google.com
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.100
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.100
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.100
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.100
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.100
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.100
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.186.100
Source: unknown HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.2:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 152.199.23.72:443 -> 192.168.2.2:49745 version: TLS 1.2

System Summary
barindex
HTML document with suspicious title
Source: file:///C:/Users/eyup/Desktop/paystub_11_24_2022.html Tab title: Sign in to your account
Source: classification engine Classification label: mal64.phis.winHTML@23/0@11/91
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\eyup\Desktop\paystub_11_24_2022.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1804,i,15675935499722441086,6223138009730746946,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1804,i,15675935499722441086,6223138009730746946,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Program Files\Google\GoogleUpdater
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Directory created: C:\Program Files\Google\GoogleUpdater
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.186.35
 unknown United States
15169 GOOGLEUS false
142.250.185.206
 clients.l.google.com United States
15169 GOOGLEUS false
34.104.35.123
 unknown United States
15169 GOOGLEUS false
152.199.23.72
 cs1025.wpc.upsiloncdn.net United States
15133 EDGECASTUS false
13.107.227.45
 part-0017.t-0009.fbs1-t-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
142.250.186.173
 accounts.google.com United States
15169 GOOGLEUS false
198.54.115.74
 asturesharpointfile.com United States
22612 NAMECHEAP-NETUS false
104.16.85.20
 unknown United States
13335 CLOUDFLARENETUS false
239.255.255.250
 unknown Reserved
unknown unknown false
192.229.221.185
 cs1227.wpc.alphacdn.net United States
15133 EDGECASTUS false
68.65.122.77
 advancelevelsset.com United States
22612 NAMECHEAP-NETUS false
69.16.175.10
 unknown United States
20446 HIGHWINDS3US false
142.250.186.100
 unknown United States
15169 GOOGLEUS false
152.199.23.37
 cs1100.wpc.omegacdn.net United States
15133 EDGECASTUS false
172.217.16.132
 www.google.com United States
15169 GOOGLEUS false
142.250.186.99
 unknown United States
15169 GOOGLEUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
cs1100.wpc.omegacdn.net 152.199.23.37 true
accounts.google.com 142.250.186.173 true
part-0017.t-0009.fbs1-t-msedge.net 13.107.227.45 true
cs1227.wpc.alphacdn.net 192.229.221.185 true
www.google.com 172.217.16.132 true
clients.l.google.com 142.250.185.206 true
asturesharpointfile.com 198.54.115.74 true
cs1025.wpc.upsiloncdn.net 152.199.23.72 true
advancelevelsset.com 68.65.122.77 true
aadcdn.msauthimages.net unknown unknown
clients2.google.com unknown unknown
code.jquery.com unknown unknown
cdn.jsdelivr.net unknown unknown
aadcdn.msftauth.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
file:///C:/Users/eyup/Desktop/paystub_11_24_2022.html true
    		low