Edit tour

Windows Analysis Report
https://hr.economictimes.indiatimes.com/etl.php?url=https://hr.economictimes.indiatimes.com/etl.php?url=//maansaa.com/new/auth//xp8tpwsulfhjn/%2F/YW5keS5ncmVmcmF0aEBrcHMuY29t

Overview

General Information

Sample URL:	https://hr.economictimes.indiatimes.com/etl.php?url=https://hr.economictimes.indiatimes.com/etl.php?url=//maansaa.com/new/auth//xp8tpwsulfhjn/%2F/YW5keS5ncmVmcmF0aEBrcHMuY29t
Analysis ID:	1466955
Infos:

Detection

HTMLPhisher

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Yara detected HtmlPhish10

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Phishing site detected (based on shot match)

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden URLs or javascript code

HTML title does not match URL

Invalid T&C link found

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 572 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1400 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2248,i,11952637479509226495,10468588811913034076,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3560 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://hr.economictimes.indiatimes.com/etl.php?url=https://hr.economictimes.indiatimes.com/etl.php?url=//maansaa.com/new/auth//xp8tpwsulfhjn/%2F/YW5keS5ncmVmcmF0aEBrcHMuY29t" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
3.6.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
3.7.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://hr.economictimes.indiatimes.com/etl.php?url=https://hr.economictimes.indiatimes.com/etl.php?url=//maansaa.com/new/auth//xp8tpwsulfhjn/%2F/YW5keS5ncmVmcmF0aEBrcHMuY29t

Avira URL Cloud: detection malicious, Label: phishing

Antivirus detection for URL or domain

Source: https://orlamin.intinhag.com/ekcn/?WMandy.grefrath@kps.com	Avira URL Cloud: Label: malware
Source: https://orlamin.intinhag.com/ekcn/	Avira URL Cloud: Label: malware

Phishing

AI detected phishing page

Source: https://orlamin.intinhag.com	LLM: Score: 9 brands: Microsoft Reasons: The URL 'https://orlamin.intinhag.com' does not match the legitimate domain name 'microsoft.com' associated with the brand Microsoft. The page prominently displays a login form, which is a common tactic used in phishing attacks to steal user credentials. The domain name appears suspicious and not related to Microsoft. The presence of a suspicious link ('Create one!') and the overall design mimicking a legitimate Microsoft login page are indicative of social engineering techniques. There is no CAPTCHA present, which is often used in legitimate sites to prevent automated attacks. Based on these observations, it is highly likely that this site is a phishing site. DOM: 3.6.pages.csv
Source: https://orlamin.intinhag.com	LLM: Score: 9 brands: Microsoft Reasons: The URL 'https://orlamin.intinhag.com' does not match the legitimate domain 'microsoft.com' associated with the brand Microsoft. The page shows a prominent login form asking for a password, which is a common phishing tactic. The domain name is suspicious and not related to Microsoft. The use of social engineering techniques is evident as the page mimics a legitimate Microsoft login page to deceive users into entering their credentials. DOM: 3.7.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 3.6.pages.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML

Phishing site detected (based on image similarity)