Edit tour

Windows Analysis Report
https://intralinks.us.com/jallessI1Ae2APharrI1AsassoTxcz01coTxm

Overview

General Information

Sample URL:	https://intralinks.us.com/jallessI1Ae2APharrI1AsassoTxcz01coTxm
Analysis ID:	1483193
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish54

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Detected hidden input values containing email addresses (often used in phishing pages)

Detected suspicious crossdomain redirect

Found iframes

HTML body contains low number of good links

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7108 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://intralinks.us.com/jallessI1Ae2APharrI1AsassoTxcz01coTxm MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 504 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1968,i,1761986712752455495,15739589973027299212,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6828 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3320 --field-trial-handle=1968,i,1761986712752455495,15739589973027299212,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
3.8.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
5.15.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
5.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.4.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
5.9.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
5.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
5.8.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
Click to see the 2 entries

Suricata Signatures

ET ATTACK_RESPONSE Eval Hex Obfuscated JS Inbound - Source IP: 104.21.66.125 - Destination IP: 192.168.2.16

Timestamp:	2024-07-26T20:07:34.489854+0200
SID:	2054246
Source Port:	443
Destination Port:	49706
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 37.230.62.219 - Destination IP: 192.168.2.16

Timestamp:	2024-07-26T20:07:38.613986+0200
SID:	2012510
Source Port:	443
Destination Port:	49719
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Generic DDoS Kit Checkin (POST) M1 - Source IP: 192.168.2.16 - Destination IP: 104.21.66.125

Timestamp:	2024-07-26T20:07:35.712079+0200
SID:	2053842
Source Port:	49712
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 52.165.165.26 - Destination IP: 192.168.2.16

Timestamp:	2024-07-26T20:07:45.054421+0200
SID:	2022930
Source Port:	443
Destination Port:	49729
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 52.165.165.26 - Destination IP: 192.168.2.16

Timestamp:	2024-07-26T20:08:22.366290+0200
SID:	2022930
Source Port:	443
Destination Port:	49771
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary
• Boot Survival

Click to jump to signature section

Show All Signature Results

Phishing

Phishing site detected (based on favicon image match)

Source: https://lawthy.com	Matcher: Template: microsoft matched with high similarity
Source: https://adobesign.lawthy.com/?organisation=harrisassoc&amp=amFsbGVzc2llQGhhcnJpc2Fzc29jLmNvbQ==&sso_reload=true#/18?document=dxyhnldlcplnypt-18-&doc=97-16-dxyhnldlcplnypt	Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish54

Source: Yara match	File source: 3.8.id.script.csv, type: HTML
Source: Yara match	File source: 5.15.id.script.csv, type: HTML
Source: Yara match	File source: 5.5.pages.csv, type: HTML
Source: Yara match	File source: 3.4.pages.csv, type: HTML
Source: Yara match	File source: 5.9.pages.csv, type: HTML
Source: Yara match	File source: 5.7.pages.csv, type: HTML
Source: Yara match	File source: 5.8.pages.csv, type: HTML

Phishing site detected (based on image similarity)