Edit tour
Windows
Analysis Report
http://links.notification.intuit.com/ls/click?upn=u001.Hu9nToJLxsJSQR8ZHWn8Ib7JikYF6PNXv5VK-2BAfeSpVHPRNy-2BFDtJ-2BhNUfKXTverofrKjvXVKH4ba5KbTX-2BS4cJKy7Enmy8u6eh2CdWGxyzuDXSNuhEOHexkioQw-2FudfiL8pwtrGO-2B-2FODNZxf5mnErvLFWshyylCmWqSzM0qU3joTnNOavJWT7bqoCisg6MZz-2B3Zt4FmVIMpI8pLotOGqfSbkFmZdhA1qOrgG
Overview
General Information
| Sample URL: | http://links.notification.intuit.com/ls/click?upn=u001.Hu9nToJLxsJSQR8ZHWn8Ib7JikYF6PNXv5VK-2BAfeSpVHPRNy-2BFDtJ-2BhNUfKXTverofrKjvXVKH4ba5KbTX-2BS4cJKy7Enmy8u6eh2CdWGxyzuDXSNuhEOHexkioQw-2FudfiL8pwtr |
| Analysis ID: | 1420457 |
| Infos: | |
 | |
Detection
| Score: | 48 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Found HTTP page in a blob
HTML page contains suspicious base64 encoded javascript
Found iframes
HTML body contains low number of good links
HTML body contains password input but no form action
HTML page contains hidden URLs or javascript code
HTML title does not match URL
Phishing site detected (based on OCR NLP Model)
Classification
- System is w10x64
chrome.exe (PID: 1800 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed "about :blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 4076 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2296 --fi eld-trial- handle=223 2,i,363983 5633722853 273,134167 0136394068 3433,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 6316 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=57 20 --field -trial-han dle=2232,i ,363983563 3722853273 ,134167013 6394068343 3,262144 - -disable-f eatures=Op timization GuideModel Downloadin g,Optimiza tionHints, Optimizati onHintsFet ching,Opti mizationTa rgetPredic tion /pref etch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7044 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=5812 --f ield-trial -handle=22 32,i,36398 3563372285 3273,13416 7013639406 83433,2621 44 --disab le-feature s=Optimiza tionGuideM odelDownlo ading,Opti mizationHi nts,Optimi zationHint sFetching, Optimizati onTargetPr ediction / prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- chrome.exe (PID: 6392 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" "htt p://links. notificati on.intuit. com/ls/cli ck?upn=u00 1.Hu9nToJL xsJSQR8ZHW n8Ib7JikYF 6PNXv5VK-2 BAfeSpVHPR Ny-2BFDtJ- 2BhNUfKXTv erofrKjvXV KH4ba5KbTX -2BS4cJKy7 Enmy8u6eh2 CdWGxyzuDX SNuhEOHexk ioQw-2Fudf iL8pwtrGO- 2B-2FODNZx f5mnErvLFW shyylCmWqS zM0qU3joTn NOavJWT7bq oCisg6MZz- 2B3Zt4FmVI MpI8pLotOG qfSbkFmZdh A1qOrgG3wn W67VV3oEMh LKhMYcq1Lw wyP9HHMD_f 256X-2B29O CVUNc78JDD Z6vR6pvYF2 aSvVZx3xKD TYHd649XbW 4fzDlnYfEW s3sNN0SOUy tsbxR9GfeK qEcpWxYrr8 wIVTx1d8dh rjuwVmUMCL pDkceKVHme dFYHurY11f IfRlBnLBIl C1g2GaERMv 7J6N-2FRjD buRO2F-2Fa 0wlmoSlnbW huva5QRt0U 7oKGauae6m D3oeeRAL7C gByTOojyoP MxVieq0Xzt WD-2FFws1q nocc8ysEbW HVe7h5cbe0 mb9I4o7TZJ 9y1sRcrONm aWsiXaH8rp JCz-2FFzR- 2FH-2FLfBQ UQf3BHA895 9dPPmxy4vs -2BXGpRO-2 FA89yQZuEO sLF5Ve4Thp Gd7i-2FHDB FstBP5OwLa 4I-2Bmqe9c U-2FlDfDhM xvpNl1drZt WLAVLAAsxO RGJ-2FMws9 1eb-2BlsMM f3BdGZ4rnX q0CB2F8nU7 h65gSacYlv DZ-2Bh-2F7 YGh-2BKHX2 I8KhI-2Bze tL6vuth9F- 2BMgYCWF63 o6SRNs8lR9 bIomQLbcFU Cao1-2FuRz 7DBaQgE9uh EU-2BWW3qn v8wA7O3oi7 Q86P0xxrrO xPkveWmEzO 64T1i8S3q0 r-2Fb866XR YFT3LS-2BJ ECAYWBH-2B fiZBIPTlDo XDyDKJz8TL rBQ9dOPGXw BNERkC8Eyy bAwzTQ7-2F Nmxd8wsw9C WKA1lky3sw BOAynYwukh CC-2BDFv3o Uk9l3bbJyK 9r8G2lPfAM B6r5Jv7wvP rCow3X-2B8 Z-2B9JIDVe 7YbcMb3hHl DrSWwrq8hC euEJy5qYiJ I1c-2FUFwC JYVG6nhicD 5AHC8tzB7o F9MeoP0k-2 FanlkQYV6B iVqPcFjDMM yLnw93qnFp iCyaFfcuMi g2uI8J5WAP cmjDiCuItV 6KRwWys9M0 AC1m5EN467 rzuo0uXJUI 5jU7gFx8Sw PNX63kPN7x PmFSGsHBL4 VsqBWcrFQm eufMjfDE7A oDvqIY5U-3 D" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
Phishing |   |
|---|
| Source: | DOM page: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||