Create Interactive Tour

Windows Analysis Report
) wavr3e.htm

Overview

General Information

Sample name:	) wavr3e.htm renamed because original name is a hash value
Original sample name:	call_mp3audio-_________-VMsgTranscript8884505590_2024-11-04_183A153A50(Duncan.Brock Hi good day this is) wavr3e.htm
Analysis ID:	1551634
MD5:	7649e5e4e684b8a410ec369c688aec8c
SHA1:	725a4419a208e7c4f651500a0fa9f4c9d0ae90a1
SHA256:	c563b82a6a65a6e763cd496df68f00457be2cb4d68d8ffac020314b0d1dc44e0
Infos:

Detection

HtmlDropper, HTMLPhisher

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

HTML file submission requesting Cloudflare captcha challenge

Yara detected Html Dropper

Yara detected HtmlPhish10

Yara detected Phisher

HTML page contains hidden email address

HTML page contains obfuscated javascript

Phishing site detected (based on favicon image match)

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

Invalid 'sign-in options' or 'sign-up' link found

Invalid T&C link found

JA3 SSL client fingerprint seen in connection with other malware

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4440 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\) wavr3e.htm" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5168 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2092,i,16869196994209990568,8296178005416664831,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_107	JoeSecurity_Phisher_2	Yara detected Phisher	Joe Security

HTML

Source	Rule	Description	Author
4.6.pages.csv	JoeSecurity_HtmlDropper_3	Yara detected Html Dropper	Joe Security
4.6.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
4.5.pages.csv	JoeSecurity_HtmlDropper_3	Yara detected Html Dropper	Joe Security
4.5.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T22:12:01.077393+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.5	49724	TCP
2024-11-07T22:12:41.485396+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.5	49953	TCP

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary
• Data Obfuscation
• Boot Survival

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://voicemailmsgcenterw7310.shareviewdirect.com/&redirect=0317b9542e28ede2231bb24d93efa631402fe613main&uid=f253efe302d32ab264a76e0ce65be769672d2d6e58b3b#ORHVuY2FuLkJyb2NrQGN5YmcuY29t	LLM: Score: 8 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'voicemailmsgcenterw7310.shareviewdirect.com' does not match the legitimate domain for Microsoft., The domain 'shareviewdirect.com' is not commonly associated with Microsoft., The subdomain 'voicemailmsgcenterw7310' is unusual and could be used to mislead users., The presence of a subdomain and unrelated domain name increases the likelihood of phishing. DOM: 4.5.pages.csv
Source: https://voicemailmsgcenterw7310.shareviewdirect.com/&redirect=0317b9542e28ede2231bb24d93efa631402fe613main&uid=f253efe302d32ab264a76e0ce65be769672d2d6e58b3b#ORHVuY2FuLkJyb2NrQGN5YmcuY29t	LLM: Score: 8 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'voicemailmsgcenterw7310.shareviewdirect.com' does not match the legitimate domain for Microsoft., The domain 'shareviewdirect.com' is not commonly associated with Microsoft., The subdomain 'voicemailmsgcenterw7310' appears suspicious and unrelated to Microsoft's typical services., The presence of a subdomain and unusual domain name suggests potential phishing. DOM: 4.6.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 4.6.pages.csv, type: HTML
Source: Yara match	File source: 4.5.pages.csv, type: HTML

Yara detected Phisher

Source: Yara match

File source: dropped/chromecache_107, type: DROPPED

HTML page contains hidden email address

Source: https://pmii-raise.com/pmii/uploads/wo/iot-01-2024-00067/pbcmc.php

HTTP Parser: Duncan.Brock@cybg.com

HTML page contains obfuscated javascript