Edit tour

Windows Analysis Report
https://urlz.fr/r7T9

Overview

General Information

Sample URL:	https://urlz.fr/r7T9
Analysis ID:	1468051
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML body with high number of embedded images detected

HTML title does not match URL

Suspicious form URL found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2800 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5040 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1944,i,5321103866798388156,13824389215326165543,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6116 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4780 --field-trial-handle=1944,i,5321103866798388156,13824389215326165543,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6396 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://urlz.fr/r7T9" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: urlz.fr	Virustotal: Detection: 5%			Perma Link
Source: jemi.so	Virustotal: Detection: 7%			Perma Link

Multi AV Scanner detection for submitted file

Source: https://urlz.fr/r7T9

Virustotal: Detection: 9%

Perma Link

Phishing

AI detected phishing page

Source: https://evsemchidul442.wpenginepowered.com

LLM: Score: 8 brands: NRGi Reasons: The URL 'https://evsemchidul442.wpenginepowered.com' is highly suspicious as it does not match the legitimate domain 'nrgi.dk' associated with the NRGi brand. The use of 'wpenginepowered.com' suggests it is hosted on a generic WordPress hosting platform, which is often used in phishing attacks. The webpage prominently features a login form requesting email and password, which is a common tactic in phishing sites. Additionally, the presence of a suspicious link ('Har du glemt din kode?') and the use of social engineering techniques to prompt users to enter sensitive information further indicate phishing. Therefore, based on these observations, the site is determined to be a phishing site. DOM: 1.1.pages.csv