Windows Analysis Report
RemittanceCopy389.html

• HCA enabled
• EGA enabled
• AMSI enabled

• Successful, ratio: 100%
• Number of executed functions: 0
• Number of non-executed functions: 0

• Found application associated with file extension: .html

{"loginform": true,"urgency": false,"captcha": false,"reasons": ["The title of the webpage, 'Sign in to Best Productivity Provider!', explicitly mentions the need to sign in, indicating the presence of a login form.","The text, 'Microsoft Sign in to continue to Out&k tracy.durrance@mainstreetcbf.com', contains the phrase 'Sign in' and refers to a specific email address, suggesting that the user is required to sign in to continue, which confirms the presence of a login form."]}

{"loginform": true,"urgency": false,"captcha": false,"reasons": ["The webpage has a title 'Sign in to Best Productivity Provider!' which explicitly requests sensitive information such as a username and password.","The text 'Try another, or get a new Microsoft account.' suggests the creation of a new account, implying the presence of a login form."]}

```json{  "phishing_score": 9,  "brands": "Microsoft",  "phishing": true,  "suspicious_domain": true,  "has_prominent_loginform": true,  "has_captcha": false,  "setechniques": true,  "has_suspicious_link": true,  "legitmate_domain": "microsoft.com",  "reasons": "The URL 'file:///C:/Users/user/Desktop/RemittanceCopy389.html' is a local file path, which is highly suspicious and not typical for legitimate websites. The page mimics a Microsoft login page, which is a common target for phishing attacks. The email domain 'mainstreetcbf.com' does not match the legitimate Microsoft domain. The presence of a prominent login form and the use of social engineering techniques to mimic a legitimate brand further indicate that this is a phishing attempt."}

```json{  "phishing_score": 9,  "brands": "Microsoft",  "phishing": true,  "suspicious_domain": true,  "has_prominent_loginform": true,  "has_captcha": false,  "setechniques": true,  "has_suspicious_link": true,  "legitmate_domain": "microsoft.com",  "reasons": "The URL 'file:///C:/Users/user/Desktop/RemittanceCopy389.html#' is a local file path, which is highly suspicious for a legitimate login page. Legitimate Microsoft login pages would be hosted on the 'microsoft.com' domain. The image shows a login form that closely resembles Microsoft's login page, which is a common social engineering technique used in phishing attacks. Additionally, the presence of a prominent login form and a suspicious link ('Can't access your account?') further indicate phishing. Therefore, this site is highly likely to be a phishing site."}