Edit tour

Windows Analysis Report
https://www.sendspace.com/pro/dl/m2hhc1

Overview

General Information

Sample URL:	https://www.sendspace.com/pro/dl/m2hhc1
Analysis ID:	1576046
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

AI detected suspicious Javascript

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

Invalid T&C link found

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4436 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4836 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 --field-trial-handle=2388,i,5283216560271925001,12398197257270491601,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3480 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.sendspace.com/pro/dl/m2hhc1" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

Acrobat.exe (PID: 2824 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\Zimmer Automation.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5876 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5880 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1560,i,5576525852591626032,13700392379993395873,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 2412 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://zimmerautomation.federalappbuilders.com/L6qvz/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1224 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1884,i,5042640275534124032,11836437692220122915,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://zimmerautomation.federalappbuilders.com/L6qvz/	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'zimmerautomation.federalappbuilders.com' does not match the legitimate domain for Microsoft., The domain 'federalappbuilders.com' does not have any known association with Microsoft., The presence of a subdomain 'zimmerautomation' and the main domain 'federalappbuilders.com' suggests a third-party service, which is not typically used by Microsoft for their official services., The email input field '9uc3p3@wkdy.com' does not provide any direct association with Microsoft, adding to the suspicion. DOM: 5.12.pages.csv
Source: https://zimmerautomation.federalappbuilders.com/L6qvz/	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'zimmerautomation.federalappbuilders.com' does not match the legitimate domain for Microsoft., The domain 'federalappbuilders.com' is unrelated to Microsoft and could indicate a third-party service or a phishing attempt., The presence of a subdomain 'zimmerautomation' does not align with Microsoft's typical domain structure., The email input field '9uc3p3@wkdy.com' does not provide any direct association with Microsoft, adding to the suspicion. DOM: 5.13.pages.csv

AI detected suspicious Javascript

Source: 0.19.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://zimmerautomation.federalappbuilders.com/L6... This script exhibits several high-risk behaviors, including dynamic code execution (via `atob()`) and potential data exfiltration (sending data to an unknown domain via the URL parameter). The use of obfuscated code and the presence of a conditional check for a URL parameter further increase the suspicion of malicious intent. While the script contains some irrelevant text, the overall behavior is highly concerning and indicative of a potential security threat.