Edit tour

Windows Analysis Report
https://www.sendspace.com/pro/dl/m2hhc1

Overview

General Information

Sample URL:	https://www.sendspace.com/pro/dl/m2hhc1
Analysis ID:	1576034
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

AI detected suspicious Javascript

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

Invalid T&C link found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3484 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 792 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2012,i,179980425919327946,16444675099342817025,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6620 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.sendspace.com/pro/dl/m2hhc1" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

Acrobat.exe (PID: 2324 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\Zimmer Automation.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5440 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6400 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1508,i,16474777156784899421,11210886424577744035,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 6264 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://zimmerautomation.federalappbuilders.com/L6qvz/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6204 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 --field-trial-handle=2340,i,18377928426532725856,13506950132613756296,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://zimmerautomation.federalappbuilders.com/L6qvz/	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL 'zimmerautomation.federalappbuilders.com' does not match the legitimate domain 'microsoft.com'., The domain 'federalappbuilders.com' is not associated with Microsoft., The presence of a subdomain 'zimmerautomation' and the main domain 'federalappbuilders.com' suggests a third-party service, which is not typical for Microsoft., The URL structure and domain name do not align with Microsoft's typical domain usage., The input field 'Ita6dj@kskg0v.io' does not provide any direct association with Microsoft. DOM: 5.12.pages.csv
Source: https://zimmerautomation.federalappbuilders.com/L6qvz/	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'zimmerautomation.federalappbuilders.com' does not match the legitimate domain for Microsoft., The domain 'federalappbuilders.com' is not associated with Microsoft and appears unrelated., The presence of a subdomain 'zimmerautomation' and the main domain 'federalappbuilders.com' suggests a potential phishing attempt., The email input field 'Ita6dj@kskg0v.io' does not provide any direct association with Microsoft, adding to the suspicion. DOM: 5.13.pages.csv

AI detected suspicious Javascript

Source: 0.19.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://zimmerautomation.federalappbuilders.com/L6... This script exhibits several high-risk behaviors, including dynamic code execution (via `atob()`) and potential data exfiltration (sending data to an unknown domain via the URL parameter). The use of obfuscated code and the presence of a conditional check for a URL parameter further increase the suspicion of malicious intent. While the script contains some irrelevant text, the overall behavior is highly concerning and indicative of a potential security threat.