Edit tour

Windows Analysis Report
http://pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev/auth_gen.html

Overview

Sample URL:	http://pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev/auth_gen.html
Analysis ID:	1527793
Tags:	openphish
Infos:

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Misleading page title found

Multi AV Scanner detection for submitted file

HTML page contains obfuscated javascript

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

Submit button contains javascript call

chrome.exe (PID: 5592 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 --field-trial-handle=2260,i,6487226296319151685,5742536961355802738,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6332 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev/auth_gen.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

⊘No configs have been found

⊘No yara matches

⊘No Sigma rule has matched

⊘No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

Source: http://pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev/auth_gen.html

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Source: http://pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev/auth_gen.html

Virustotal: Detection: 18%

Phishing

Source: https://pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev/auth_gen.html	LLM: Score: 9 Reasons: The brand 'DocuSign' is well-known and typically associated with the domain 'docusign.com'., The provided URL 'pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev' does not match the legitimate domain for DocuSign., The URL uses a domain extension '.dev', which is unusual for DocuSign and could indicate a phishing attempt., The presence of a password input field on a non-legitimate domain is suspicious and could be used for credential harvesting., The URL structure with a long alphanumeric string and the use of 'r2.dev' suggests it might be hosted on a cloud service, which is often used in phishing attempts. DOM: 0.0.pages.csv
Source: https://pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev/auth_gen.html	LLM: Score: 9 Reasons: The brand 'DocuSign' is well-known and typically associated with the domain 'docusign.com'., The provided URL 'pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev' does not match the legitimate domain for DocuSign., The URL uses a subdomain structure that is not typical for DocuSign, which usually operates under its own domain., The domain 'r2.dev' is not associated with DocuSign and could be a cloud or service provider, which is often used in phishing attempts., The presence of a password input field on a non-legitimate domain is a common phishing tactic to capture sensitive information. DOM: 0.1.pages.csv

Source: https://pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev/auth_gen.html	Page Title: DocuSign Login - Enter your password to sign in
Source: https://pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev/auth_gen.html	Page Title: DocuSign Login - Enter your password to sign in
Source: https://pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev/auth_gen.html	Page Title: DocuSign Login - Enter your password to sign in
Source: https://pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev/auth_gen.html	Page Title: DocuSign Login - Enter your password to sign in