Edit tour

Windows Analysis Report
https://ey-notification-priority-fb-mail.netlify.app/

Overview

General Information

Sample URL:	https://ey-notification-priority-fb-mail.netlify.app/
Analysis ID:	1456956
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Phishing site detected (based on favicon image match)

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded SVGs detected

HTML body with high number of embedded images detected

HTML title does not match URL

HTTP GET or POST without a user agent

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5996 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1560 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=2040,i,8914330647225413775,4356582199797426071,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3504 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ey-notification-priority-fb-mail.netlify.app/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://ey-notification-priority-fb-mail.netlify.app/	Avira URL Cloud: detection malicious, Label: phishing
Source: https://ey-notification-priority-fb-mail.netlify.app/	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://ey-notification-priority-fb-mail.netlify.app/script.js	Avira URL Cloud: Label: phishing
Source: https://ey-notification-priority-fb-mail.netlify.app/style.css	Avira URL Cloud: Label: phishing

Phishing

AI detected phishing page

Source: https://ey-notification-priority-fb-mail.netlify.app	LLM: Score: 9 brands: Meta Reasons: The URL 'https://ey-notification-priority-fb-mail.netlify.app' is highly suspicious. It uses a subdomain on 'netlify.app', which is a free hosting service often used by attackers to host phishing sites. The domain name does not match the legitimate domain for Meta, which is 'meta.com'. The webpage mimics the Meta brand and includes a form asking for sensitive information such as business email, page name, owner of the page, email address, and phone number, which is a common tactic in phishing attacks. The presence of these elements, along with the suspicious domain, strongly indicates that this is a phishing site. DOM: 0.0.pages.csv
Source: https://ey-notification-priority-fb-mail.netlify.app	LLM: Score: 9 brands: Meta Reasons: The URL 'https://ey-notification-priority-fb-mail.netlify.app' is highly suspicious. It uses a subdomain on 'netlify.app', which is a free hosting service often used for phishing sites. The domain name does not match the legitimate domain 'meta.com' associated with the brand Meta. The page contains a login form asking for sensitive information such as business email, page name, owner of the page, email address, and phone number, which is a common tactic in phishing attacks. The page also uses social engineering techniques by creating a sense of urgency and fear with a message about violating community standards. There is no CAPTCHA, which is often used on legitimate sites to prevent automated abuse. The combination of these factors strongly indicates that this is a phishing site. DOM: 0.2.pages.csv

Phishing site detected (based on favicon image match)