Edit tour

Windows Analysis Report
https://decktop.us/LFzs8Q

Overview

General Information

Sample URL:	https://decktop.us/LFzs8Q
Analysis ID:	1484314

Detection

HTMLPhisher, Tycoon2FA

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish10

Yara detected Tycoon 2FA PaaS

HTML page contains suspicious base64 encoded javascript

Phishing site detected (based on image similarity)

Phishing site or detected (based on various text indicators)

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

Invalid T&C link found

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 3012 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://decktop.us/LFzs8Q MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 4268 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1988,i,14439112051146858894,12483337357495976748,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
20.5.pages.csv	JoeSecurity_Tycoon2FA	Yara detected Tycoon 2FA PaaS	Joe Security
29.8.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://uxl.ciaberibu.com/GKKMCFKGPXPZIYILPAWUJWAIGCXQCRP3s6maxipinn839nqhpimzy61psidslqowka?YPLZNFSMYHRVYRQFOAVISRGYGFSBHZfnbnywqyic8ps2t8orzsuno9rh8at4zi	LLM: Score: 9 brands: Microsoft Reasons: The URL 'https://uxl.ciaberibu.com/GKKMCFKGPXPZIYILPAWUJWAIGCXQCRP3s6maxipinn839nqhpimzy61psidslqowka?YPLZNFSMYHRVYRQFOAVISRGYGFSBHZfnbnywqyic8ps2t8orzsuno9rh8at4zi' is highly suspicious. It does not match the legitimate domain 'microsoft.com' associated with Microsoft. The URL structure is complex and contains random strings, which is a common tactic used in phishing attacks. The webpage displays a prominent login form asking for email, phone, or Skype credentials, which is another common phishing tactic. There is no CAPTCHA present, which is often used in legitimate sites to prevent automated attacks. The presence of social engineering techniques, such as mimicking the Microsoft login page, further indicates that this is a phishing site. DOM: 29.8.pages.csv
Source: https://uxl.ciaberibu.com/GKKMCFKGPXPZIYILPAWUJWAIGCXQCRP3s6maxipinn839nqhpimzy61psidslqowka?YPLZNFSMYHRVYRQFOAVISRGYGFSBHZfnbnywqyic8ps2t8orzsuno9rh8at4zi	LLM: Score: 10 Reasons: The domain 'uxl.ciaberibu.com' is not associated with Microsoft, and the design is simple and minimalistic, but the domain is unusual and does not appear to be a legitimate Microsoft login page. The webpage appears to be a phishing attempt using Microsoft's branding to trick users into providing their login information. DOM: 29.8.pages.csv

Yara detected HtmlPhish10

Source: Yara match

File source: 29.8.pages.csv, type: HTML

Yara detected Tycoon 2FA PaaS

Source: Yara match

File source: 20.5.pages.csv, type: HTML

HTML page contains suspicious base64 encoded javascript

Source: https://uxl.ciaberibu.com/8knW2ib/

HTTP Parser: Base64 decoded: <script>

Phishing site detected (based on image similarity)