Loading... Additional Content is being loaded

Windows Analysis Report
https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-

Overview

General Information

Sample URL:	https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-
Analysis ID:	1565424
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Signatures

Phishing

AI detected phishing page

Source: https://clienti.documentipostali.it/#/auth/login

Joe Sandbox AI: Score: 8 Reasons: The brand 'Posta Power' is not directly associated with a well-known brand, but it suggests a connection to postal services., The URL 'clienti.documentipostali.it' does not match the legitimate domain 'poste.it' which is associated with Italian postal services., The use of 'documentipostali' in the URL could be an attempt to mimic a legitimate postal service, but it is not a recognized domain for the Italian postal service., The presence of input fields for 'Username o Email' and 'Password' is typical for phishing sites attempting to capture login credentials., The domain structure and naming suggest a potential phishing attempt due to the lack of direct association with a known postal service domain. DOM: 1.2.pages.csv

HTML body contains low number of good links

Source: https://clienti.documentipostali.it/#/auth/login

HTTP Parser: Number of links: 0

HTML body contains password input but no form action

Source: https://clienti.documentipostali.it/#/auth/login

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML title does not match URL

Source: https://clienti.documentipostali.it/#/auth/login

HTTP Parser: Title: Area Riservata does not match URL

Source: https://clienti.documentipostali.it/#/auth/login

HTTP Parser: <input type="password" .../> found

Source: https://clienti.documentipostali.it/#/auth/login

HTTP Parser: No <meta name="author".. found

Source: https://clienti.documentipostali.it/#/auth/login

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 2.18.84.141:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.84.141:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49729 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=rTR6RmCbOAnzY89&MD=ulrTV65+ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=rTR6RmCbOAnzY89&MD=ulrTV65+ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: clienti.documentipostali.it
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: chromecache_88.1.dr, chromecache_91.1.dr	String found in binary or memory: http://ckeditor.com/license
Source: chromecache_88.1.dr, chromecache_91.1.dr	String found in binary or memory: http://docs.ckeditor.com/#
Source: chromecache_99.1.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_99.1.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_99.1.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_99.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown	HTTPS traffic detected: 2.18.84.141:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.84.141:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49729 version: TLS 1.2

Source: classification engine

Classification label: mal48.phis.win@17/41@10/3

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1984,i,5921322794692936453,13394560815386798242,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1984,i,5921322794692936453,13394560815386798242,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk			Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved		unknown	unknown	false
142.250.181.100	www.google.com	United States		15169	GOOGLEUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
www.google.com	142.250.181.100	true
clienti.documentipostali.it	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://clienti.documentipostali.it/#/auth/login	true		unknown
https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-	false		unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 29 17:50:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	72191FA5AEAACBAB6D43888D3517DFA1	0130152DED733C9184DDA9BF3462FC24C28595D9	09DC8DE9305B19CE5092EC4A2E49FFF390D5A20FF6BE88F4699151B1F2F3B3E6
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 29 17:50:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	78266BFBBCD553C62526CC0C039DD9F8	07D86995E326F3EB99093C0EFEC1D1E3F143C201	05C79116DF2A1F551ED6358E3EDF2904D1C22264BF86CE90173823B1BC4F5817
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	34BC2AB49B0911B97CE37CB082703B74	018A6D199377D90C98CA4B7F22C9FF55EC7581C3	5339B262C96BC5929CEB83A95701B58E0F3CA37894A63FF806D21643AC21FB39
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 29 17:50:25 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6B0231928AFEF7C44030A3901512163F	8FA3E6010CEBBB937986C69A6123B7A1CA3C45F6	5727CBC5F0AEB5CF87193EA461684ADEF0BBD3C8F4C5E1894EF88B768C5512B8
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 29 17:50:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	95F2BDC94F96586E9A3785E3048FF13B	9569D7C55BAB7877C6FF08EDEFAC73DD42D1BDC1	D4F3E501752A936D19F1E78569AE6631002D706E7174AF3F3B34B1BF3AA8B2BC
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 29 17:50:25 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	B3AB1F39E104D9361DA6CCF5779E3F50	AE233A0272697BD1E9E3FDE93B775E8C72813246	6E10C4D1A05211B0E35456C50D11358E56BA941691091B4BAC3A77285EAC0AD6
Chrome Cache Entry: 100	PNG image data, 273 x 99, 8-bit/color RGBA, non-interlaced	A140DD5F5ABFC73DAE889BC54E652307	FD5F1CD8B655E304957499D3ED4AA710ADA6E889	F5E64F0716F37F7EB6047FE316B9122298131397ED432E37430E6840D9AE31D3
Chrome Cache Entry: 101	ASCII text, with very long lines (18186), with no line terminators	4AF7FB8BECB9066CACEA91607565D4B4	845599C8EF70A6474BBCC3A5D7C1501864D67040	B52C437C5202D3BB56DB87861E0036F2BE5A3DB60C09538721226BAFBE672626
Chrome Cache Entry: 102	PNG image data, 200 x 101, 8-bit/color RGBA, non-interlaced	0BADD54567EED69194012EB3563BF5A2	C13AC4F542D59AE383CBAF14F84BBCDB0E0B7F1A	D17E65F75CAFD47381684748EFE94F76740FA89715BEAE4DAD641BFC4A3778EF
Chrome Cache Entry: 103	ASCII text, with no line terminators	9E640795B0B58CC31FF1C92C6E0F63B8	56434F166E913EA6EB2C02D52C3627E403817FFA	86941DF7C560010C86170EA4E86B5EA9B4CA6A53E5FE707F2FC364D636CCE4CE
Chrome Cache Entry: 104	ASCII text, with very long lines (65536), with no line terminators	EC8693218652EB63746991AB69BF8B0C	77E94133692E7EEC55D12C3F818347A5F2126DBE	D0AF086A8C5E6225FA293FF29DEB8962429B4CF14118F01749FAD20CAD20821A
Chrome Cache Entry: 105	Unicode text, UTF-8 text, with very long lines (65534), with no line terminators	E623A2273BEEE3628D0CAD6A27B36679	9E2498F1608CCA5876D7B0D4C421801976C18B1B	0B7C9AE53BD20B1BBF611014375CA6C56A92DFBC17DC5138AA7D89BD3F278C51
Chrome Cache Entry: 84	ASCII text, with very long lines (2480), with no line terminators	E1F8C6D48DB7B8B44064B3B36CDE9419	9E275DF684746DB37B5B1003940B7DBBECA84B08	71C83798EE393360F3FA5145330EE125006619D22FB8150B3A74524001DDC887
Chrome Cache Entry: 85	ASCII text, with very long lines (2480), with no line terminators	E1F8C6D48DB7B8B44064B3B36CDE9419	9E275DF684746DB37B5B1003940B7DBBECA84B08	71C83798EE393360F3FA5145330EE125006619D22FB8150B3A74524001DDC887
Chrome Cache Entry: 86	ASCII text, with very long lines (18186), with no line terminators	4AF7FB8BECB9066CACEA91607565D4B4	845599C8EF70A6474BBCC3A5D7C1501864D67040	B52C437C5202D3BB56DB87861E0036F2BE5A3DB60C09538721226BAFBE672626
Chrome Cache Entry: 87	ASCII text, with very long lines (65536), with no line terminators	EC8693218652EB63746991AB69BF8B0C	77E94133692E7EEC55D12C3F818347A5F2126DBE	D0AF086A8C5E6225FA293FF29DEB8962429B4CF14118F01749FAD20CAD20821A
Chrome Cache Entry: 88	Unicode text, UTF-8 (with BOM) text, with very long lines (586), with CRLF line terminators	93E4DC60F36F27E1CA1E92DBE2D053AE	C7590E07EC1C807C83696302430F5B6CBA996079	A175D72510AAE95FDFACF4CB57CE941D0BBD6F8484A685B5A53D18131141F54A
Chrome Cache Entry: 89	Web Open Font Format (Version 2), TrueType, length 77160, version 4.459	AF7AE505A9EED503F8B8E6982036873E	D6F48CBA7D076FB6F2FD6BA993A75B9DC1ECBF0C	2ADEFCBC041E7D18FCF2D417879DC5A09997AA64D675B7A3C4B6CE33DA13F3FE
Chrome Cache Entry: 90	PNG image data, 273 x 99, 8-bit/color RGBA, non-interlaced	A140DD5F5ABFC73DAE889BC54E652307	FD5F1CD8B655E304957499D3ED4AA710ADA6E889	F5E64F0716F37F7EB6047FE316B9122298131397ED432E37430E6840D9AE31D3
Chrome Cache Entry: 91	Unicode text, UTF-8 (with BOM) text, with very long lines (586), with CRLF line terminators	93E4DC60F36F27E1CA1E92DBE2D053AE	C7590E07EC1C807C83696302430F5B6CBA996079	A175D72510AAE95FDFACF4CB57CE941D0BBD6F8484A685B5A53D18131141F54A
Chrome Cache Entry: 92	PNG image data, 200 x 101, 8-bit/color RGBA, non-interlaced	0BADD54567EED69194012EB3563BF5A2	C13AC4F542D59AE383CBAF14F84BBCDB0E0B7F1A	D17E65F75CAFD47381684748EFE94F76740FA89715BEAE4DAD641BFC4A3778EF
Chrome Cache Entry: 93	ASCII text, with very long lines (37691), with no line terminators	C837705EF9A204A61A33A8F95F160F29	1FEBD6E44FBCBE64E6669E279047F74C4DA39056	75D9366961E3275C0A261A9A74C7C0620E6A294E553E39A0F08E03B196BD68C4
Chrome Cache Entry: 94	ASCII text, with very long lines (65536), with no line terminators	581848FDC5CAA1AB32D67CB840F2F842	646E2759C34C23BBA1F3B6B2304158398FA8D6F5	7651FF4EEB70656711E366D932C5E5E22E55A1903CC6754396F29CEA24D7C092
Chrome Cache Entry: 95	HTML document, ASCII text, with very long lines (664), with CRLF, LF line terminators	FF3EB0AD6CB62EF97448DD5A0EDE34F0	87FCECD32D6B6B55310BDAA34522AC48F7369D21	FD631D8736561483555D10F64FD2135A3456C83E28EA50B06B3EF1B51F63D9D2
Chrome Cache Entry: 96	Unicode text, UTF-8 text, with very long lines (65534), with no line terminators	E623A2273BEEE3628D0CAD6A27B36679	9E2498F1608CCA5876D7B0D4C421801976C18B1B	0B7C9AE53BD20B1BBF611014375CA6C56A92DFBC17DC5138AA7D89BD3F278C51
Chrome Cache Entry: 97	ASCII text, with very long lines (65536), with no line terminators	581848FDC5CAA1AB32D67CB840F2F842	646E2759C34C23BBA1F3B6B2304158398FA8D6F5	7651FF4EEB70656711E366D932C5E5E22E55A1903CC6754396F29CEA24D7C092
Chrome Cache Entry: 98	ASCII text, with very long lines (37691), with no line terminators	C837705EF9A204A61A33A8F95F160F29	1FEBD6E44FBCBE64E6669E279047F74C4DA39056	75D9366961E3275C0A261A9A74C7C0620E6A294E553E39A0F08E03B196BD68C4
Chrome Cache Entry: 99	Unicode text, UTF-8 text, with very long lines (64006)	9AF0F8F894216123EBE128FDC5393CFE	6E5DBE860CE4D750422069AC674F1035C4D5D6D7	BC62A40CFEE9AE4F22E1AE3731EE539DC51F83D4B9590F75C5C911BA59468332

Phishing

AI detected phishing page

Source: https://clienti.documentipostali.it/#/auth/login

Joe Sandbox AI: Score: 8 Reasons: The brand 'Posta Power' is not directly associated with a well-known brand, but it suggests a connection to postal services., The URL 'clienti.documentipostali.it' does not match the legitimate domain 'poste.it' which is associated with Italian postal services., The use of 'documentipostali' in the URL could be an attempt to mimic a legitimate postal service, but it is not a recognized domain for the Italian postal service., The presence of input fields for 'Username o Email' and 'Password' is typical for phishing sites attempting to capture login credentials., The domain structure and naming suggest a potential phishing attempt due to the lack of direct association with a known postal service domain. DOM: 1.2.pages.csv

HTML body contains low number of good links

Source: https://clienti.documentipostali.it/#/auth/login

HTTP Parser: Number of links: 0

HTML body contains password input but no form action

Source: https://clienti.documentipostali.it/#/auth/login

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML title does not match URL

Source: https://clienti.documentipostali.it/#/auth/login

HTTP Parser: Title: Area Riservata does not match URL

Source: https://clienti.documentipostali.it/#/auth/login

HTTP Parser: <input type="password" .../> found

Source: https://clienti.documentipostali.it/#/auth/login

HTTP Parser: No <meta name="author".. found

Source: https://clienti.documentipostali.it/#/auth/login

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 2.18.84.141:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.84.141:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49729 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=rTR6RmCbOAnzY89&MD=ulrTV65+ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=rTR6RmCbOAnzY89&MD=ulrTV65+ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: clienti.documentipostali.it
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: chromecache_88.1.dr, chromecache_91.1.dr	String found in binary or memory: http://ckeditor.com/license
Source: chromecache_88.1.dr, chromecache_91.1.dr	String found in binary or memory: http://docs.ckeditor.com/#
Source: chromecache_99.1.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_99.1.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_99.1.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_99.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown	HTTPS traffic detected: 2.18.84.141:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.84.141:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49729 version: TLS 1.2

Source: classification engine

Classification label: mal48.phis.win@17/41@10/3

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1984,i,5921322794692936453,13394560815386798242,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1984,i,5921322794692936453,13394560815386798242,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk			Jump to behavior