Edit tour

Windows Analysis Report
https://stoorm5.activehosted.com/content/PNNm1e/2024/11/29/296d9a00-ab7c-413b-8445-d50603229893.pdf

Overview

General Information

Sample URL:	https://stoorm5.activehosted.com/content/PNNm1e/2024/11/29/296d9a00-ab7c-413b-8445-d50603229893.pdf
Analysis ID:	1565237
Infos:

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Yara detected HtmlPhish54

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

Drops files with a non-matching file extension (content does not match file extension)

Form action URLs do not match main URL

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6808 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7024 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1836,i,13295155886250382179,1626783798969175353,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6516 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://stoorm5.activehosted.com/content/PNNm1e/2024/11/29/296d9a00-ab7c-413b-8445-d50603229893.pdf" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
3.14.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://stoorm5.activehosted.com/content/PNNm1e/2024/11/29/296d9a00-ab7c-413b-8445-d50603229893.pdf

SlashNext: detection malicious, Label: BadObject:Multi/RogueDocument type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://guizgaren.za.com/fonts/ionicons/fonts/d.php

Avira URL Cloud: Label: malware

Phishing

Yara detected HtmlPhish54

Source: Yara match

File source: 3.14.pages.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: file:///C:/Users/user/Downloads/downloaded.pdf	Joe Sandbox AI: Page contains button: 'VISUALIZZARE IL DOCUMENTO CONDIVISO' Source: '1.1.pages.csv'
Source: file:///C:/Users/user/Downloads/downloaded.pdf	Joe Sandbox AI: Page contains button: 'VISUALIZZARE IL DOCUMENTO CONDIVISO' Source: '1.3.pages.csv'
Source: file:///C:/Users/user/Downloads/downloaded.pdf	Joe Sandbox AI: Page contains button: 'VISUALIZZARE IL DOCUMENTO CONDIVISO' Source: '1.2.pages.csv'

AI detected suspicious Javascript

Source: 2.11.i.script.csv

Joe Sandbox AI: Detected suspicious JavaScript: High-risk script showing clear malicious intent: 1) Sends credentials to suspicious domain 'guizgaren.za.com' (+3 points), 2) Implements fake login functionality with credential harvesting (+3 points), 3) Redirects to Microsoft error page as misdirection (+2 points), 4) Suspicious domain with unusual structure (+1 point). Classic phishing behavior attempting to steal user credentials.