Edit tour

Windows Analysis Report
https://2kio0wi0iat.freewebhostmost.com

Overview

General Information

Sample URL:	https://2kio0wi0iat.freewebhostmost.com
Analysis ID:	1559188
Infos:

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Yara detected HtmlPhish10

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1748 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1816 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1600,i,14401817870070512048,14617872419609768012,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6336 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://2kio0wi0iat.freewebhostmost.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_72	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTML

Source	Rule	Description	Author
0.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
0.2.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
0.1.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Suricata Signatures

ET PHISHING Generic Multibrand NewInjection Phishing Landing Template

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T09:38:57.617692+0100	2032514	2	Possible Social Engineering Attempted	34.88.191.235	443	192.168.2.4	49736	TCP

ETPRO PHISHING Possible Successful Generic Phish July 28

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T09:39:09.912235+0100	2812237	1	Successful Credential Theft Detected	192.168.2.4	49766	188.127.230.32	443	TCP
2024-11-20T09:39:21.308758+0100	2812237	1	Successful Credential Theft Detected	192.168.2.4	49773	188.127.230.32	443	TCP
2024-11-20T09:39:30.244360+0100	2812237	1	Successful Credential Theft Detected	192.168.2.4	49774	188.127.230.32	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://2kio0wi0iat.freewebhostmost.com	Avira URL Cloud: detection malicious, Label: phishing
Source: https://2kio0wi0iat.freewebhostmost.com	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://2kio0wi0iat.freewebhostmost.com/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://2kio0wi0iat.freewebhostmost.com/css/hover.css	Avira URL Cloud: Label: phishing

Phishing

AI detected phishing page

Source: https://2kio0wi0iat.freewebhostmost.com/	Joe Sandbox AI: Score: 9 Reasons: The brand 'Webmail' is a generic term and not associated with a specific well-known domain., The URL '2kio0wi0iat.freewebhostmost.com' does not match any known legitimate domain for a webmail service., The domain 'freewebhostmost.com' suggests a free hosting service, which is often used for phishing., The subdomain '2kio0wi0iat' is random and suspicious, indicating a potential phishing attempt., The presence of input fields for 'Email address' and 'Password' on a non-legitimate domain is a common phishing tactic. DOM: 0.0.pages.csv
Source: https://2kio0wi0iat.freewebhostmost.com/	Joe Sandbox AI: Score: 9 Reasons: The URL '2kio0wi0iat.freewebhostmost.com' does not match the legitimate domain for 'Webmail'., The domain 'freewebhostmost.com' is a generic hosting provider, which is often used for phishing., The subdomain '2kio0wi0iat' is nonsensical and does not relate to 'Webmail'., The presence of input fields for 'Email address' and 'Password' on a non-legitimate domain is suspicious., The brand 'Webmail' is known, but the URL does not match any known legitimate domain for this brand. DOM: 0.1.pages.csv
Source: https://2kio0wi0iat.freewebhostmost.com/	Joe Sandbox AI: Score: 9 Reasons: The URL '2kio0wi0iat.freewebhostmost.com' does not match the legitimate domain for 'Webmail'., The domain 'freewebhostmost.com' is a generic hosting provider, which is often used for phishing., The subdomain '2kio0wi0iat' is random and does not relate to 'Webmail', which is suspicious., The brand 'Webmail' is a known service, but the URL does not reflect any official domain associated with it., Presence of input fields for 'Email address' and 'Password' on a non-legitimate domain is a common phishing tactic. DOM: 0.2.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_72, type: DROPPED