Edit tour

Windows Analysis Report
Payment for outstanding statements.pdf

Overview

General Information

Sample name:	Payment for outstanding statements.pdf
Analysis ID:	1541264
MD5:	a5d7da4103bc402b68dba0491c3ec37c
SHA1:	0536e797ffbc1f882a3747d82414d0f7f3150fa2
SHA256:	2d28ccad7cf653d5f1934e74b79500a4fbe929e3bdb7a6e63a8402218235f510
Infos:

Detection

HTMLPhisher

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish10

AI detected landing page (webpage, office document or email)

Phishing site detected (based on image similarity)

Connects to many different domains

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

Javascript checks online IP of machine

None HTTPS page querying sensitive user data (password, username or email)

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

Acrobat.exe (PID: 5532 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Payment for outstanding statements.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3008 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6316 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1596 --field-trial-handle=1556,i,6588904074887627152,11996025997396640476,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7940 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://tmpsend.com/Qn3Ro8hM MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8120 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1880,i,3264797018011576500,12175545572724770719,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Downloads\STATEMENT.HTML.crdownload	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
C:\Users\user\Downloads\STATEMENT.HTML.crdownload	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTML

Source	Rule	Description	Author	Strings
4.31.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish10

Source: Yara match	File source: 4.31.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\Downloads\STATEMENT.HTML.crdownload, type: DROPPED

Phishing site detected (based on image similarity)

Source: file:///C:/Users/user/Downloads/STATEMENT.HTML

Matcher: Found strong image similarity, brand: MICROSOFT

Source: file:///C:/Users/user/Downloads/STATEMENT.HTML

HTTP Parser: Number of links: 0

Source: file:///C:/Users/user/Downloads/STATEMENT.HTML

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://tmpsend.com/Qn3Ro8hM

HTTP Parser: Base64 decoded: [null,null,null,3]

Source: file:///C:/Users/user/Downloads/STATEMENT.HTML

HTTP Parser: Title: Our Organisation Fax Portal.xls does not match URL

Source: https://tmpsend.com/assets/js/cookieconsent.min.js

HTTP Parser: !function(e){if(!e.hasinitialised){var t={escaperegexp:function(e){return e.replace(/[\-\[\]\/\{\}\*\+\?\.\\\^\$\|]/g,"\\$&")},hasclass:function(e,t){var i=" ";return 1===e.nodetype&&(i+e.classname+i).replace(/[\n\t]/g,i).indexof(i+t+i)>=0},addclass:function(e,t){e.classname+=" "+t},removeclass:function(e,t){var i=new regexp("\\b"+this.escaperegexp(t)+"\\b");e.classname=e.classname.replace(i,"")},interpolatestring:function(e,t){var i=/{{([a-z][a-z0-9\-_]*)}}/gi;return e.replace(i,function(e){return t(arguments[1])||""})},getcookie:function(e){var t="; "+document.cookie,i=t.split("; "+e+"=");return i.length<2?void 0:i.pop().split(";").shift()},setcookie:function(e,t,i,n,o,s){var r=new date;r.setdate(r.getdate()+(i||365));var a=[e+"="+t,"expires="+r.toutcstring(),"path="+(o||"/")];n&&a.push("domain="+n),s&&a.push("secure"),document.cookie=a.join(";")},deepextend:function(e,t){for(var i in t)t.hasownproperty(i)&&(i in e&&this.isplainobject(e[i])&&this.isplainobject(t[i])?this.deepextend(e[i],t[i]):e[i]=t[i])...

Source: https://tmpsend.com/Qn3Ro8hM	HTTP Parser: No favicon
Source: https://tmpsend.com/Qn3Ro8hM	HTTP Parser: No favicon
Source: https://tmpsend.com/Qn3Ro8hM	HTTP Parser: No favicon
Source: https://tmpsend.com/Qn3Ro8hM	HTTP Parser: No favicon
Source: https://tmpsend.com/Qn3Ro8hM	HTTP Parser: No favicon
Source: https://tmpsend.com/Qn3Ro8hM	HTTP Parser: No favicon
Source: https://tmpsend.com/Qn3Ro8hM	HTTP Parser: No favicon
Source: https://tmpsend.com/Qn3Ro8hM	HTTP Parser: No favicon
Source: https://tmpsend.com/Qn3Ro8hM	HTTP Parser: No favicon
Source: https://tmpsend.com/Qn3Ro8hM	HTTP Parser: No favicon
Source: https://tmpsend.com/thank-you?d=Qn3Ro8hM	HTTP Parser: No favicon
Source: https://tmpsend.com/thank-you?d=Qn3Ro8hM	HTTP Parser: No favicon
Source: https://tmpsend.com/thank-you?d=Qn3Ro8hM	HTTP Parser: No favicon
Source: https://tmpsend.com/thank-you?d=Qn3Ro8hM	HTTP Parser: No favicon
Source: https://tmpsend.com/thank-you?d=Qn3Ro8hM	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/STATEMENT.HTML	HTTP Parser: No favicon

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184
Source: unknown	TCP traffic detected without corresponding DNS query: 144.76.38.184

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: platform-api.sharethis.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: buttons-config.sharethis.com
Source: global traffic	DNS traffic detected: DNS query: l.sharethis.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: count-server.sharethis.com
Source: global traffic	DNS traffic detected: DNS query: platform-cdn.sharethis.com
Source: global traffic	DNS traffic detected: DNS query: t.sharethis.com
Source: global traffic	DNS traffic detected: DNS query: bcp.crwdcntrl.net
Source: global traffic	DNS traffic detected: DNS query: fundingchoicesmessages.google.com
Source: global traffic	DNS traffic detected: DNS query: sync.sharethis.com
Source: global traffic	DNS traffic detected: DNS query: loadus.exelator.com
Source: global traffic	DNS traffic detected: DNS query: match.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: ps.eyeota.net
Source: global traffic	DNS traffic detected: DNS query: ml314.com
Source: global traffic	DNS traffic detected: DNS query: cms.analytics.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: idsync.rlcdn.com
Source: global traffic	DNS traffic detected: DNS query: ad.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: s0.2mdn.net
Source: global traffic	DNS traffic detected: DNS query: ups.analytics.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: dclk-match.dotomi.com
Source: global traffic	DNS traffic detected: DNS query: sync-tm.everesttech.net
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: ums.acuityplatform.com
Source: global traffic	DNS traffic detected: DNS query: dis.criteo.com
Source: global traffic	DNS traffic detected: DNS query: sync.srv.stackadapt.com
Source: global traffic	DNS traffic detected: DNS query: sync.teads.tv
Source: global traffic	DNS traffic detected: DNS query: cm.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: dsum-sec.casalemedia.com
Source: global traffic	DNS traffic detected: DNS query: ib.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: widget.us.criteo.com
Source: global traffic	DNS traffic detected: DNS query: ep1.adtrafficquality.google
Source: global traffic	DNS traffic detected: DNS query: segments.company-target.com
Source: global traffic	DNS traffic detected: DNS query: px.owneriq.net
Source: global traffic	DNS traffic detected: DNS query: i.liadm.com
Source: global traffic	DNS traffic detected: DNS query: ep2.adtrafficquality.google
Source: global traffic	DNS traffic detected: DNS query: thrtle.com
Source: global traffic	DNS traffic detected: DNS query: loadm.exelator.com
Source: global traffic	DNS traffic detected: DNS query: match.prod.bidr.io
Source: global traffic	DNS traffic detected: DNS query: ws.rqtrk.eu
Source: global traffic	DNS traffic detected: DNS query: pixel.tapad.com
Source: global traffic	DNS traffic detected: DNS query: ce.lijit.com
Source: global traffic	DNS traffic detected: DNS query: id5-sync.com
Source: global traffic	DNS traffic detected: DNS query: aa.agkn.com
Source: global traffic	DNS traffic detected: DNS query: pixel.onaudience.com
Source: global traffic	DNS traffic detected: DNS query: image6.pubmatic.com
Source: global traffic	DNS traffic detected: DNS query: sync.ipredictive.com
Source: global traffic	DNS traffic detected: DNS query: eus-api.ccgateway.net
Source: global traffic	DNS traffic detected: DNS query: dpm.demdex.net
Source: global traffic	DNS traffic detected: DNS query: map.go.affec.tv
Source: global traffic	DNS traffic detected: DNS query: ib.mookie1.com
Source: global traffic	DNS traffic detected: DNS query: api5137.d41.co
Source: global traffic	DNS traffic detected: DNS query: id.rlcdn.com
Source: global traffic	DNS traffic detected: DNS query: match.360yield.com
Source: global traffic	DNS traffic detected: DNS query: stags.bluekai.com
Source: global traffic	DNS traffic detected: DNS query: global.ib-ibi.com
Source: global traffic	DNS traffic detected: DNS query: d.turn.com
Source: global traffic	DNS traffic detected: DNS query: secure.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: pixel.mathtag.com
Source: global traffic	DNS traffic detected: DNS query: pixel-sync.sitescout.com
Source: global traffic	DNS traffic detected: DNS query: us-u.openx.net
Source: global traffic	DNS traffic detected: DNS query: audience.synocdn.com
Source: global traffic	DNS traffic detected: DNS query: c.cintnetworks.com
Source: global traffic	DNS traffic detected: DNS query: um.simpli.fi
Source: global traffic	DNS traffic detected: DNS query: tr.blismedia.com
Source: global traffic	DNS traffic detected: DNS query: pr-bh.ybp.yahoo.com

Source: Payment for outstanding statements.pdf	Initial sample: https://tmpsend.com/Qn3Ro8hM
Source: Payment for outstanding statements.pdf	Initial sample: https://tmpsend.com/qn3ro8hm

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Payment for outstanding statements.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1596 --field-trial-handle=1556,i,6588904074887627152,11996025997396640476,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1596 --field-trial-handle=1556,i,6588904074887627152,11996025997396640476,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 64223C6CD2BCB40BA9C31DFA48C7A1BA
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://tmpsend.com/Qn3Ro8hM
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1880,i,3264797018011576500,12175545572724770719,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://tmpsend.com/Qn3Ro8hM
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1880,i,3264797018011576500,12175545572724770719,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Payment for outstanding statements.pdf	Initial sample: PDF keyword /JS count = 0
Source: Payment for outstanding statements.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: PDF document	LLM: Page contains button: 'ACCESS PAYMENT DETAILS HERE' Source: 'PDF document'
Source: PDF document	LLM: PDF document contains prominent button: 'access payment details here'

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Name	IP	Active	Malicious	Reputation
um.simpli.fi	35.204.158.49	true	false	unknown
tr.blismedia.com	34.96.105.8	true	false	unknown
segments.company-target.com	18.245.86.7	true	false	unknown
id5-sync.com	141.95.33.120	true	false	unknown
ws.rqtrk.eu	57.129.18.105	true	false	unknown
vici-asg-prod-alb-2112236320.us-east-1.elb.amazonaws.com	34.203.84.108	true	false	unknown
d-ams1.turn.com	46.228.164.13	true	false	unknown
httplogserver-lb.global.unified-prod.sharethis.net	18.195.70.32	true	false	unknown
cdnjs.cloudflare.com	104.17.25.14	true	false	unknown
platform-api.sharethis.com	3.160.150.46	true	false	unknown
cm.g.doubleclick.net	142.250.186.98	true	false	unknown
idaas-ext.cph.liveintent.com	3.86.122.147	true	false	unknown
ds-pr-bh.ybp.gysm.yahoodns.net	18.203.177.239	true	false	unknown
www.google.com	216.58.206.36	true	false	unknown
dcs-ups.g03.yahoodns.net	87.248.119.251	true	false	unknown
id.rlcdn.com	35.244.174.68	true	false	unknown
bcp.crwdcntrl.net	108.128.89.118	true	false	unknown
match.adsrvr.org	3.33.220.150	true	false	unknown
d2znr2yi078d75.cloudfront.net	65.9.66.81	true	false	unknown
match.prod.bidr.io	34.241.33.46	true	false	unknown
us-u.openx.net	34.98.64.218	true	false	unknown
ActivationEdge-activation-1631408035.eu-central-1.elb.amazonaws.com	35.157.170.10	true	false	unknown
ep2.adtrafficquality.google	142.250.185.129	true	false	unknown
pixel.onaudience.com	54.38.113.8	true	false	unknown
pixel-sync.sitescout.com	34.36.216.150	true	false	unknown
euw-ice.360yield.com	52.31.86.79	true	false	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
googleads.g.doubleclick.net	142.250.186.130	true	false	unknown
www3.l.google.com	142.250.185.142	true	false	unknown
d1ogq2f3ibpb2g.cloudfront.net	18.245.60.113	true	false	unknown
ext-lb-aws-prod.ccgateway.net	52.91.215.149	true	false	unknown
ml314.com	34.117.77.79	true	false	unknown
s0.2mdn.net	142.250.186.102	true	false	unknown
widget.us5.vip.prod.criteo.com	74.119.117.16	true	false	unknown
pixel-origin.mathtag.com	74.121.140.211	true	false	unknown
pugm-amsfpairbc.pubmnet.com	198.47.127.19	true	false	unknown
ps.eyeota.net	3.124.210.90	true	false	unknown
idsync.rlcdn.com	35.244.174.68	true	false	unknown
widget.nl3.vip.prod.criteo.com	178.250.1.9	true	false	unknown
m.ib-ibi.com	69.169.85.7	true	false	unknown
sync.srv.stackadapt.com	107.20.167.149	true	false	unknown
dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	52.208.241.210	true	false	unknown
thrtle.com	54.205.223.36	true	false	unknown
pixel.tapad.com	34.111.113.62	true	false	unknown
raptor-prd-ew1-alb-2127381300.eu-west-1.elb.amazonaws.com	52.51.10.62	true	false	unknown
sync.ipredictive.com	107.21.226.44	true	false	unknown
ep1.adtrafficquality.google	216.58.206.66	true	false	unknown
ad.doubleclick.net	142.250.186.38	true	false	unknown
ums.acuityplatform.com	154.59.122.79	true	false	unknown
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.19	true	false	unknown
map.go.affec.tv	52.49.180.15	true	false	unknown
global.ib-ibi.com	69.169.85.6	true	false	unknown
dsum-sec.casalemedia.com	172.64.151.101	true	false	unknown
d3oiwf0xhhk8m1.cloudfront.net	143.204.98.56	true	false	unknown
count-server.sharethis.com	13.32.121.81	true	false	unknown
load-euw1.exelator.com	34.254.143.3	true	false	unknown
ib.anycast.adnxs.com	185.89.210.20	true	false	unknown
buttons-config.sharethis.com	unknown	unknown	false	unknown
px.owneriq.net	unknown	unknown	false	unknown
secure.adnxs.com	unknown	unknown	false	unknown
ib.mookie1.com	unknown	unknown	false	unknown
platform-cdn.sharethis.com	unknown	unknown	false	unknown
audience.synocdn.com	unknown	unknown	false	unknown
dis.criteo.com	unknown	unknown	false	unknown
widget.us.criteo.com	unknown	unknown	false	unknown
x1.i.lencr.org	unknown	unknown	false	unknown
ce.lijit.com	unknown	unknown	false	unknown
px.ads.linkedin.com	unknown	unknown	false	unknown
d.turn.com	unknown	unknown	false	unknown
cms.analytics.yahoo.com	unknown	unknown	false	unknown
stags.bluekai.com	unknown	unknown	false	unknown
c.cintnetworks.com	unknown	unknown	false	unknown
dclk-match.dotomi.com	unknown	unknown	false	unknown
sync-tm.everesttech.net	unknown	unknown	false	unknown
sync.teads.tv	unknown	unknown	false	unknown
pixel.mathtag.com	unknown	unknown	false	unknown
sync.sharethis.com	unknown	unknown	false	unknown
cdn.jsdelivr.net	unknown	unknown	false	unknown
t.sharethis.com	unknown	unknown	false	unknown
image6.pubmatic.com	unknown	unknown	false	unknown
ups.analytics.yahoo.com	unknown	unknown	false	unknown
fundingchoicesmessages.google.com	unknown	unknown	false	unknown
loadus.exelator.com	unknown	unknown	false	unknown
eus-api.ccgateway.net	unknown	unknown	false	unknown
aa.agkn.com	unknown	unknown	false	unknown
dpm.demdex.net	unknown	unknown	false	unknown
pr-bh.ybp.yahoo.com	unknown	unknown	false	unknown
i.liadm.com	unknown	unknown	false	unknown
api5137.d41.co	unknown	unknown	false	unknown
l.sharethis.com	unknown	unknown	false	unknown
ib.adnxs.com	unknown	unknown	false	unknown
match.360yield.com	unknown	unknown	false	unknown
loadm.exelator.com	unknown	unknown	false	unknown

Name	Malicious	Reputation
https://tmpsend.com/Qn3Ro8hM#google_vignette	false	unknown
file:///C:/Users/user/Downloads/STATEMENT.HTML	true	unknown
https://tmpsend.com/Qn3Ro8hM	false	unknown
https://tmpsend.com/thank-you?d=Qn3Ro8hM	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.67	unknown	United States	15169	GOOGLEUS	false
144.76.38.184	unknown	Germany	24940	HETZNER-ASDE	false
18.245.60.113	d1ogq2f3ibpb2g.cloudfront.net	United States	16509	AMAZON-02US	false
142.250.185.225	unknown	United States	15169	GOOGLEUS	false
52.91.215.149	ext-lb-aws-prod.ccgateway.net	United States	14618	AMAZON-AESUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
65.9.66.100	unknown	United States	16509	AMAZON-02US	false
52.49.180.15	map.go.affec.tv	United States	16509	AMAZON-02US	false
3.124.210.90	ps.eyeota.net	United States	16509	AMAZON-02US	false
185.89.210.20	ib.anycast.adnxs.com	Germany	29990	ASN-APPNEXUS	false
142.250.186.70	unknown	United States	15169	GOOGLEUS	false
37.252.171.52	unknown	European Union	29990	ASN-APPNEXUS	false
34.254.143.3	load-euw1.exelator.com	United States	16509	AMAZON-02US	false
23.22.254.206	unknown	United States	14618	AMAZON-AESUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
104.18.186.31	unknown	United States	13335	CLOUDFLARENETUS	false
216.58.206.40	unknown	United States	15169	GOOGLEUS	false
35.157.170.10	ActivationEdge-activation-1631408035.eu-central-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
172.217.18.4	unknown	United States	15169	GOOGLEUS	false
13.32.121.81	count-server.sharethis.com	United States	16509	AMAZON-02US	false
107.21.226.44	sync.ipredictive.com	United States	14618	AMAZON-AESUS	false
172.217.18.2	unknown	United States	15169	GOOGLEUS	false
65.9.66.81	d2znr2yi078d75.cloudfront.net	United States	16509	AMAZON-02US	false
54.72.108.116	unknown	United States	16509	AMAZON-02US	false
3.70.125.227	unknown	United States	16509	AMAZON-02US	false
3.160.150.14	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.194	unknown	United States	15169	GOOGLEUS	false
142.250.185.195	unknown	United States	15169	GOOGLEUS	false
64.58.232.180	unknown	United States	13649	ASN-VINSUS	false
35.244.174.68	id.rlcdn.com	United States	15169	GOOGLEUS	false
34.203.84.108	vici-asg-prod-alb-2112236320.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
69.169.85.6	global.ib-ibi.com	United States	29838	AMCUS	false
69.169.85.7	m.ib-ibi.com	United States	29838	AMCUS	false
141.95.98.64	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
142.250.186.130	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
151.101.2.49	unknown	United States	54113	FASTLYUS	false
216.58.206.33	unknown	United States	15169	GOOGLEUS	false
52.208.241.210	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
142.250.115.84	unknown	United States	15169	GOOGLEUS	false
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false
3.86.122.147	idaas-ext.cph.liveintent.com	United States	14618	AMAZON-AESUS	false
87.248.119.251	dcs-ups.g03.yahoodns.net	United Kingdom	203220	YAHOO-DEBDE	false
46.228.164.13	d-ams1.turn.com	United Kingdom	56396	TURNGB	false
3.160.150.46	platform-api.sharethis.com	United States	16509	AMAZON-02US	false
142.250.186.134	unknown	United States	15169	GOOGLEUS	false
23.32.185.35	unknown	United States	16625	AKAMAI-ASUS	false
104.17.24.14	unknown	United States	13335	CLOUDFLARENETUS	false
178.250.1.9	widget.nl3.vip.prod.criteo.com	France	44788	ASN-CRITEO-EUROPEFR	false
18.203.177.239	ds-pr-bh.ybp.gysm.yahoodns.net	United States	16509	AMAZON-02US	false
34.36.216.150	pixel-sync.sitescout.com	United States	2686	ATGS-MMD-ASUS	false
2.16.164.97	unknown	European Union	20940	AKAMAI-ASN1EU	false
63.215.202.169	unknown	United States	41041	VCLK-EU-SE	false
142.250.186.129	unknown	United States	15169	GOOGLEUS	false
141.95.33.120	id5-sync.com	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
172.217.16.130	unknown	United States	15169	GOOGLEUS	false
107.20.167.149	sync.srv.stackadapt.com	United States	14618	AMAZON-AESUS	false
142.250.186.65	unknown	United States	15169	GOOGLEUS	false
37.252.171.21	unknown	European Union	29990	ASN-APPNEXUS	false
184.28.88.176	unknown	United States	16625	AKAMAI-ASUS	false
35.204.158.49	um.simpli.fi	United States	15169	GOOGLEUS	false
3.120.44.189	unknown	United States	16509	AMAZON-02US	false
2.23.197.190	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
142.250.185.142	www3.l.google.com	United States	15169	GOOGLEUS	false
143.204.98.51	unknown	United States	16509	AMAZON-02US	false
143.204.98.56	d3oiwf0xhhk8m1.cloudfront.net	United States	16509	AMAZON-02US	false
95.101.111.156	unknown	European Union	12956	TELEFONICATELXIUSES	false
34.241.33.46	match.prod.bidr.io	United States	16509	AMAZON-02US	false
142.250.186.110	unknown	United States	15169	GOOGLEUS	false
108.128.89.118	bcp.crwdcntrl.net	United States	16509	AMAZON-02US	false
142.250.184.226	unknown	United States	15169	GOOGLEUS	false
95.101.111.153	unknown	European Union	12956	TELEFONICATELXIUSES	false
34.117.77.79	ml314.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
142.250.185.66	unknown	United States	15169	GOOGLEUS	false
3.33.220.150	match.adsrvr.org	United States	8987	AMAZONEXPANSIONGB	false
142.250.186.38	ad.doubleclick.net	United States	15169	GOOGLEUS	false
54.205.223.36	thrtle.com	United States	14618	AMAZON-AESUS	false
142.250.184.194	unknown	United States	15169	GOOGLEUS	false
13.107.42.14	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.23.197.184	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
51.144.7.192	unknown	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
198.47.127.19	pugm-amsfpairbc.pubmnet.com	United States	62713	AS-PUBMATICUS	false
142.250.186.102	s0.2mdn.net	United States	15169	GOOGLEUS	false
172.217.16.195	unknown	United States	15169	GOOGLEUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.217.16.198	unknown	United States	15169	GOOGLEUS	false
52.51.10.62	raptor-prd-ew1-alb-2127381300.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
142.250.185.129	ep2.adtrafficquality.google	United States	15169	GOOGLEUS	false
172.217.23.106	unknown	United States	15169	GOOGLEUS	false
104.102.48.115	unknown	United States	16625	AKAMAI-ASUS	false
172.64.151.101	dsum-sec.casalemedia.com	United States	13335	CLOUDFLARENETUS	false
154.59.122.79	ums.acuityplatform.com	United States	174	COGENT-174US	false
18.195.70.32	httplogserver-lb.global.unified-prod.sharethis.net	United States	16509	AMAZON-02US	false
54.38.113.8	pixel.onaudience.com	France	16276	OVHFR	false
142.250.186.99	unknown	United States	15169	GOOGLEUS	false
34.96.105.8	tr.blismedia.com	United States	15169	GOOGLEUS	false
142.250.186.98	cm.g.doubleclick.net	United States	15169	GOOGLEUS	false
52.31.86.79	euw-ice.360yield.com	United States	16509	AMAZON-02US	false
74.119.117.16	widget.us5.vip.prod.criteo.com	United States	19750	AS-CRITEOUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541264
Start date and time:	2024-10-24 16:27:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	Payment for outstanding statements.pdf
Detection:	MAL
Classification:	mal56.phis.winPDF@41/114@213/471
Cookbook Comments:	Found application associated with file extension: .pdf

Input	Output
URL: PDF document Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "ACCESS PAYMENT DETAILS HERE", "prominent_button_name": "ACCESS PAYMENT DETAILS HERE", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: PDF document Model: claude-3-haiku-20240307	```json { "brands": [ "Investec" ] }
	```json { "brands": [ "Investec" ] }
URL: https://tmpsend.com/Qn3Ro8hM Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "STATEMENT.HTML", "prominent_button_name": "Download Now", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://tmpsend.com/Qn3Ro8hM Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "STATEMENT.HTML", "prominent_button_name": "Download Now", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://tmpsend.com/Qn3Ro8hM Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "STATEMENT.HTML", "prominent_button_name": "Download Now", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://tmpsend.com/Qn3Ro8hM Model: claude-3-haiku-20240307	```json { "brands": [ "TMP SEND" ] }
	```json { "brands": [ "TMP SEND" ] }
URL: https://tmpsend.com/Qn3Ro8hM Model: claude-3-haiku-20240307	```json { "brands": [ "TMP SEND" ] }
	```json { "brands": [ "TMP SEND" ] }
URL: https://tmpsend.com/Qn3Ro8hM Model: claude-3-haiku-20240307	```json { "brands": [ "TMP SEND" ] }
	```json { "brands": [ "TMP SEND" ] }
URL: https://tmpsend.com/Qn3Ro8hM Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "STATEMENT.HTML", "prominent_button_name": "Download Now", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://tmpsend.com/Qn3Ro8hM Model: claude-3-haiku-20240307	```json { "brands": [ "TMP SEND" ] }
	```json { "brands": [ "TMP SEND" ] }
URL: https://tmpsend.com/Qn3Ro8hM Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "STATEMENT.HTML", "prominent_button_name": "Download Now", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://tmpsend.com/Qn3Ro8hM Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "STATEMENT.HTML", "prominent_button_name": "Download Now", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://tmpsend.com/Qn3Ro8hM Model: claude-3-haiku-20240307	```json { "brands": [ "TMP SEND" ] }
	```json { "brands": [ "TMP SEND" ] }
URL: https://tmpsend.com/Qn3Ro8hM Model: claude-3-haiku-20240307	```json { "brands": [ "TMP SEND" ] }
	```json { "brands": [ "TMP SEND" ] }
URL: https://tmpsend.com/Qn3Ro8hM#google_vignette Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Build Powerful Automations", "prominent_button_name": "Get started Now", "text_input_field_labels": [ "Job Application Form" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://tmpsend.com/thank-you?d=Qn3Ro8hM Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Click here if your download did not start after 10 seconds", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://tmpsend.com/Qn3Ro8hM#google_vignette Model: claude-3-haiku-20240307	```json { "brands": [ "Jotform" ] }
	```json { "brands": [ "Jotform" ] }
URL: https://tmpsend.com/thank-you?d=Qn3Ro8hM Model: claude-3-haiku-20240307	```json { "brands": [ "TMP SEND" ] }
	```json { "brands": [ "TMP SEND" ] }

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.16537002169794
Encrypted:	false
SSDEEP:
MD5:	582B697C658C2466ACD614499E97581D
SHA1:	2881681A35B7EFC84A25E3FA35A918F2D30FE9E8
SHA-256:	CDBB82DE8F41EB6FE45CE6F907E62663CBCAD9E7C2B0C1FC0C1F616E4B04C9ED
SHA-512:	7DC3E421ABA44BE051511A95FCC50B0B67C6A232FB2A1F0EDD06CB27886E92AC63D0C8C7C16A6200F35379D94FE1A4483B13BC602CCEC9556F206284253F6CE7
Malicious:	false
Reputation:	unknown
Preview:	2024/10/24-10:28:08.068 1894 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/24-10:28:08.071 1894 Recovering log #3.2024/10/24-10:28:08.071 1894 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 13:29:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.985973451388953
Encrypted:	false
SSDEEP:
MD5:	4ED330B345559BB0DF5F9F2E2CA8178A
SHA1:	C76BCD11C9022D1D58E425D60CEB892FE4B5C757
SHA-256:	8E3E22E7F01063753F6C0F4A4028944FEC331E93B73803743A5F3697186B0F87
SHA-512:	29DD24D37570CF297D4351194010AE2ED4CB644018C73E087D5587F52C0F484E0EB689FC3DEDEDD9294549DEBB47564EB4A96833B1E46A02FB51EC65097C1050
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....[@..!&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IXYws....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY.s....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY.s....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY.s..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXY.s...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............M-......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	PDF document, version 1.4, 1 pages (zip deflate encoded)
Entropy (8bit):	7.012842474895897
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Payment for outstanding statements.pdf
File size:	10'853 bytes
MD5:	a5d7da4103bc402b68dba0491c3ec37c
SHA1:	0536e797ffbc1f882a3747d82414d0f7f3150fa2
SHA256:	2d28ccad7cf653d5f1934e74b79500a4fbe929e3bdb7a6e63a8402218235f510
SHA512:	de61716e80f7e1024e626bf83ae267155d97e0e1099a61f3c70285805b0d398433210ad4cfccc2e8e2d0bd2dc3ddebd05e185846a0352cae2f4f39692dcca167
SSDEEP:	192:HV+5IQwb+Ta562mihwb59VidsPq+BqA+MLgLbhnrVSh3:HV+5IQwqTaw2miCFL2UqW+MLgLbhrVc3
TLSH:	8F22E868E626899DF812C531A03A3358C3AD729BDDCC34EF0D648F61A545C64AF12EF7
File Content Preview:	%PDF-1.4.%.....4 0 obj.<</ca 1/BM/Normal>>.endobj.3 0 obj.<</G3 4 0 R>>.endobj.7 0 obj.<</Type/XObject/Subtype/Image/Width 1/Height 1/ColorSpace/DeviceGray/BitsPerComponent 8/Filter/FlateDecode/Length 9>>stream.x.c.......endstream.endobj.6 0 obj.<</Type/X

General
Header:	%PDF-1.4
Total Entropy:	7.012842
Total Bytes:	10853
Stream Entropy:	7.208295
Stream Bytes:	7030
Entropy outside Streams:	4.983166
Bytes outside Streams:	3823
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	37
endobj	37
stream	24
endstream	24
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Payment for outstanding statements.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\406a590a-3cbc-46b7-b1e3-0663d2d0fba7.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6e8ed726-b7e5-4048-a343-fcaaad8dcb4e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF59be8c.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241024142811Z-164.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7024

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

C:\Users\user\AppData\Local\Temp\MSI8b152.LOG

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-24 10-28-09-552.log

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

C:\Users\user\AppData\Local\Temp\acrocef_low\3109707d-5752-492f-b373-4381d9a550c5.tmp

C:\Users\user\AppData\Local\Temp\acrocef_low\517eff85-954f-462b-9537-2625e1fe8012.tmp

C:\Users\user\AppData\Local\Temp\acrocef_low\b8b42461-4347-47e6-a984-312bcd3194bf.tmp

C:\Users\user\AppData\Local\Temp\acrocef_low\d84af530-6488-4637-a8b5-b4b8870a05bc.tmp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Downloads\STATEMENT.HTML (copy)

Windows Analysis Report
Payment for outstanding statements.pdf

ID	DHASH	MD5
7	0000000000000000	17b3e19593efeb4c09a755092de9d245
6	0000000000000000	73acd0b4a2391d4bbd9765aca5db19dc
8	2001601313401100	1b077c71d59eb302c2d2042a12ad1c77

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre