Edit tour

Windows Analysis Report
https://atc-secure.com/nocod/wetransdnyd.html#k.muench@muenchundmuench.com

Overview

General Information

Sample URL:	https://atc-secure.com/nocod/wetransdnyd.html#k.muench@muenchundmuench.com
Analysis ID:	1576686
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

AI detected suspicious Javascript

Form action URLs do not match main URL

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

URL contains potential PII (phishing indication)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2148 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1720 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2168,i,6792689511771854500,3480956994836477088,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6748 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5288 --field-trial-handle=2168,i,6792689511771854500,3480956994836477088,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6544 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://atc-secure.com/nocod/wetransdnyd.html#k.muench@muenchundmuench.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://atc-secure.com/nocod/wetransdnyd.html#k.muench@muenchundmuench.com	Avira URL Cloud: detection malicious, Label: phishing
Source: https://atc-secure.com/nocod/wetransdnyd.html#k.muench@muenchundmuench.com	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://nocodeform.io/f/675a94473ecafc11bd1c6947/2009/07/jquery-delay/	Avira URL Cloud: Label: malware
Source: https://atc-secure.com/nocod/weT&_files/css.css	Avira URL Cloud: Label: phishing
Source: https://www.atc-secure.com/nocod/weT&_files/css.css	Avira URL Cloud: Label: phishing

Phishing

AI detected suspicious Javascript

Source: 0.6.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://atc-secure.com/nocod/wetransdnyd.html#k.mu... The provided JavaScript snippet exhibits several high-risk behaviors, including data exfiltration, dynamic code execution, and redirects to suspicious domains. The script collects user email and password information and sends it to an external server at 'https://nocodeform.io/f/675a94473ecafc11bd1c6947', which is a potentially malicious domain. Additionally, the script includes logic to redirect the user to 'https://wetransfer.com/' after a certain number of failed login attempts, which is a suspicious behavior. Overall, the combination of these high-risk indicators suggests that this script is likely malicious and poses a significant security risk.

Source: https://www.besproutable.com/elementary/parent-coaching/#meet-coaches	HTTP Parser: Form action: https://besproutable.us13.list-manage.com/subscribe/post?u=5e11377e68a482c341b78ff6d&id=d25c237449 besproutable list-manage
Source: https://www.besproutable.com/early-years/parent-coaching/	HTTP Parser: Form action: https://besproutable.us13.list-manage.com/subscribe/post?u=5e11377e68a482c341b78ff6d&id=d25c237449 besproutable list-manage
Source: https://www.besproutable.com/early-years/parent-coaching/	HTTP Parser: Form action: https://besproutable.us13.list-manage.com/subscribe/post?u=5e11377e68a482c341b78ff6d&id=d25c237449 besproutable list-manage
Source: https://www.besproutable.com/early-years/parent-coaching/	HTTP Parser: Form action: https://besproutable.us13.list-manage.com/subscribe/post?u=5e11377e68a482c341b78ff6d&id=d25c237449 besproutable list-manage