Edit tour
Windows
Analysis Report
Agreement 19-77329-05-Jun-2024.eml
Overview
General Information
| Sample name: | Agreement 19-77329-05-Jun-2024.eml |
| Analysis ID: | 1453324 |
| MD5: | a0741165b7596d66db4ebeaa108d932f |
| SHA1: | e5ccdca6398999af5d82cc338e4a379320db6311 |
| SHA256: | 48b80b42429ddf195a78de54732c62e39fcb27eb1a00bd3eb5e2e65aed02eb26 |
| Infos: |  |
 | |
Detection
HTMLPhisher
| Score: | 84 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
AI detected phishing page
Antivirus detection for URL or domain
Yara detected HtmlPhish10
HTML page contains suspicious base64 encoded javascript
Phishing site detected (based on image similarity)
Phishing site detected (based on logo match)
Phishing site or detected (based on various text indicators)
Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)
Detected suspicious crossdomain redirect
HTML body contains low number of good links
HTML body contains password input but no form action
HTML page contains hidden URLs or javascript code
HTML title does not match URL
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Invalid T&C link found
JA3 SSL client fingerprint seen in connection with other malware
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores files to the Windows start menu directory
Classification
- System is w10x64_ra
OUTLOOK.EXE (PID: 2724 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\OUTLO OK.EXE" /e ml "C:\Use rs\user\De sktop\Agre ement 19-7 7329-05-Ju n-2024.eml " MD5: 91A5292942864110ED734005B7E005C0) 
ai.exe (PID: 6356 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \root\vfs\ ProgramFil esCommonX6 4\Microsof t Shared\O ffice16\ai .exe" "220 6D38F-8379 -41CC-8999 -9CD866D49 630" "CB6D BF32-E42E- 46B1-88CE- 5361CAFC22 85" "2724" "C:\Progr am Files ( x86)\Micro soft Offic e\Root\Off ice16\OUTL OOK.EXE" " WordCombin edFloatieL reOnline.o nnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD) 
chrome.exe (PID: 3552 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t https:// protectlin k.security -mail.net/ ?url=https %3A%2F%2Fw ww.atjehup date.com/y z56h0%23kd raughn%2Ba ppliedpoly merics.com &token=pRZ 8OsFqaJAmm %2FHiZO0RH 7B95HtiQiG KdCPYBRKNn FR8ja5vM9e MfVTsBwToC 8wndTiHWIV NG0%2FuawL a4thhC3j%2 B29YSELhtY ddpgvxMiDB D1sYgPyw5K 4zKSUk%3D MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 5380 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2168 --fi eld-trial- handle=190 0,i,554109 9417880943 884,381330 4480603664 33,262144 --disable- features=O ptimizatio nGuideMode lDownloadi ng,Optimiz ationHints ,Optimizat ionHintsFe tching,Opt imizationT argetPredi ction /pre fetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_HtmlPhish_10 | Yara detected HtmlPhish_10 | Joe Security | ||
| JoeSecurity_HtmlPhish_10 | Yara detected HtmlPhish_10 | Joe Security |
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
Phishing | |
|---|
| Source: | LLM: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | HTTP Parser: | ||
| Source: | Matcher: | ||
| Source: | Matcher: | ||
| Source: | Matcher: | ||
| Source: | OCR Text: | ||
| Source: | OCR Text: | ||
| Source: | HTTP Parser: | ||