Windows Analysis Report
https://fix-to-all-issues-review-verifications-o-form-a-submit-a.vercel.app/

Overview

General Information

Sample URL: https://fix-to-all-issues-review-verifications-o-form-a-submit-a.vercel.app/
Analysis ID: 1447758
Infos:

Detection

HTMLPhisher
Score: 72
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

AI detected phishing page
Antivirus / Scanner detection for submitted sample
Phishing site detected (based on favicon image match)
Yara detected HtmlPhish29
Detected clear text password fields (password is not hidden)
Detected non-DNS traffic on DNS port
Stores files to the Windows start menu directory

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: https://fix-to-all-issues-review-verifications-o-form-a-submit-a.vercel.app/ SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing
barindex
AI detected phishing page
Source: https://fix-to-all-issues-review-verifications-o-form-a-submit-a.vercel.app/ LLM: Score: 9 brands: Facebook Reasons: The URL is highly suspicious and does not match the legitimate domain name for Facebook. The domain name 'fix-to-all-issues-review-verifications-o-form-a-submit-a.vercel.app' is not associated with Facebook. The page contains a login form asking for sensitive information (c_user, xs, password), which is a common tactic in phishing attacks. The use of a video and urgent language to prompt users to enter their credentials is a social engineering technique. Therefore, this site is very likely a phishing site. DOM: 0.0.pages.csv
Phishing site detected (based on favicon image match)
Source: https://fix-to-all-issues-review-verifications-o-form-a-submit-a.vercel.app/ Matcher: Template: facebook matched with high similarity
Yara detected HtmlPhish29
Source: Yara match File source: 0.0.pages.csv, type: HTML
Source: Yara match File source: dropped/chromecache_73, type: DROPPED
Detected clear text password fields (password is not hidden)
Source: https://fix-to-all-issues-review-verifications-o-form-a-submit-a.vercel.app/ HTTP Parser: <input type="text"... for password input
Source: unknown HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49727 version: TLS 1.2
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.5:49736 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.5:49717 -> 1.1.1.1:53
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: fix-to-all-issues-review-verifications-o-form-a-submit-a.vercel.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /originals/97/95/69/979569a2dedd37573974ceebc05b4a4e.png HTTP/1.1Host: i.pinimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://fix-to-all-issues-review-verifications-o-form-a-submit-a.vercel.app/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /originals/97/95/69/979569a2dedd37573974ceebc05b4a4e.png HTTP/1.1Host: i.pinimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /detailed%20video.mp4 HTTP/1.1Host: detailed-video-29b30.web.appConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept-Encoding: identity;q=1, *;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: videoReferer: https://fix-to-all-issues-review-verifications-o-form-a-submit-a.vercel.app/Accept-Language: en-US,en;q=0.9Range: bytes=0-
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic DNS traffic detected: DNS query: fix-to-all-issues-review-verifications-o-form-a-submit-a.vercel.app
Source: global traffic DNS traffic detected: DNS query: cdn.glitch.global
Source: global traffic DNS traffic detected: DNS query: i.pinimg.com
Source: global traffic DNS traffic detected: DNS query: detailed-video-29b30.web.app
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: chromecache_77.2.dr String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: chromecache_73.2.dr String found in binary or memory: https://cdn.glitch.global/d08141de-e7af-45a5-916b-2f09d06ac286/Facebook_Logo_2023.png?v=171242190349
Source: chromecache_73.2.dr String found in binary or memory: https://cdn.glitch.global/d08141de-e7af-45a5-916b-2f09d06ac286/Meta-Logo.png?v=1712422024289
Source: chromecache_73.2.dr String found in binary or memory: https://cdn.glitch.global/d08141de-e7af-45a5-916b-2f09d06ac286/search-icon-lob.png?v=1712422050841
Source: chromecache_73.2.dr String found in binary or memory: https://detailed-video-29b30.web.app/detailed%20video.mp4
Source: chromecache_73.2.dr String found in binary or memory: https://i.pinimg.com/originals/97/95/69/979569a2dedd37573974ceebc05b4a4e.png
Source: chromecache_73.2.dr String found in binary or memory: https://submit-form.com/arq7jVR36
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: classification engine Classification label: mal72.phis.win@16/24@14/7
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=2024,i,17167237763697312852,16245197724835844245,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://fix-to-all-issues-review-verifications-o-form-a-submit-a.vercel.app/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=2024,i,17167237763697312852,16245197724835844245,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Google Drive.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1447758 URL: https://fix-to-all-issues-r... Startdate: 27/05/2024 Architecture: WINDOWS Score: 72 26 Antivirus / Scanner detection for submitted sample 2->26 28 Phishing site detected (based on favicon image match) 2->28 30 AI detected phishing page 2->30 32 Yara detected HtmlPhish29 2->32 6 chrome.exe 9 2->6         started        9 chrome.exe 2->9         started        process3 dnsIp4 14 192.168.2.5, 443, 49286, 49703 unknown unknown 6->14 16 192.168.2.6 unknown unknown 6->16 18 239.255.255.250 unknown Reserved 6->18 11 chrome.exe 6->11         started        process5 dnsIp6 20 fix-to-all-issues-review-verifications-o-form-a-submit-a.vercel.app 76.76.21.22, 443, 49709, 49710 AMAZON-02US United States 11->20 22 dualstack.pinterest.map.fastly.net 146.75.120.84, 443, 49712, 49720 SCCGOVUS Sweden 11->22 24 5 other IPs or domains 11->24
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
146.75.120.84
 dualstack.pinterest.map.fastly.net Sweden
30051 SCCGOVUS false
199.36.158.100
 detailed-video-29b30.web.app United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
142.250.184.228
 www.google.com United States
15169 GOOGLEUS false
76.76.21.22
 fix-to-all-issues-review-verifications-o-form-a-submit-a.vercel.app United States
16509 AMAZON-02US true

Private

IP
192.168.2.6
192.168.2.5

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.214.172 true
fix-to-all-issues-review-verifications-o-form-a-submit-a.vercel.app 76.76.21.22 true
dualstack.pinterest.map.fastly.net 146.75.120.84 true
www.google.com 142.250.184.228 true
detailed-video-29b30.web.app 199.36.158.100 true
fp2e7a.wpc.phicdn.net 192.229.221.95 true
windowsupdatebg.s.llnwi.net 87.248.204.0 true
cdn.glitch.global unknown unknown
i.pinimg.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://detailed-video-29b30.web.app/detailed%20video.mp4 false
  • Avira URL Cloud: safe
 unknown
https://fix-to-all-issues-review-verifications-o-form-a-submit-a.vercel.app/ true
    		unknown
    https://i.pinimg.com/originals/97/95/69/979569a2dedd37573974ceebc05b4a4e.png false
    • Avira URL Cloud: safe
    		 unknown