Edit tour

Windows Analysis Report
https://webmail.buzja.com/?auth=byoungjo.yoo@hyundaimovex.com

Overview

General Information

Sample URL:	https://webmail.buzja.com/?auth=byoungjo.yoo@hyundaimovex.com
Analysis ID:	1580749
Infos:

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish44

Yara detected obfuscated html page

AI detected suspicious Javascript

HTML page contains obfuscated javascript

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

Invalid 'forgot password' link found

Suricata IDS alerts with low severity for network traffic

URL contains potential PII (phishing indication)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3140 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2800 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 --field-trial-handle=2436,i,8146624104305031454,14140284813643305396,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6512 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://webmail.buzja.com/?auth=byoungjo.yoo@hyundaimovex.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
dropped/chromecache_114	JoeSecurity_Obshtml	Yara detected obfuscated html page	Joe Security
dropped/chromecache_107	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security
dropped/chromecache_107	JoeSecurity_Obshtml	Yara detected obfuscated html page	Joe Security
dropped/chromecache_149	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security
dropped/chromecache_149	JoeSecurity_Obshtml	Yara detected obfuscated html page	Joe Security

Suricata Signatures

ETPRO PHISHING Possible Successful Generic Phish July 28

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T00:52:14.455161+0100	2812237	1	Successful Credential Theft Detected	192.168.2.4	49778	198.54.116.86	443	TCP
2024-12-26T00:52:38.118805+0100	2812237	1	Successful Credential Theft Detected	192.168.2.4	49839	198.54.116.86	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://webmail.buzja.com/?auth=byoungjo.yoo@hyundaimovex.com	Joe Sandbox AI: Score: 9 Reasons: The brand 'ICANN' is well-known and is typically associated with the domain 'icann.org'., The URL 'webmail.buzja.com' does not match the legitimate domain for ICANN., The domain 'buzja.com' does not have any known association with ICANN., The presence of 'webmail' as a subdomain is often used in phishing attempts to mimic legitimate webmail services., The email address provided is unrelated to ICANN, suggesting potential misuse of brand association. DOM: 1.4.pages.csv
Source: https://webmail.buzja.com/?auth=byoungjo.yoo@hyundaimovex.com	Joe Sandbox AI: Score: 8 Reasons: The brand 'Hyundai Movex' is associated with the domain 'hyundaimovex.com'., The URL 'webmail.buzja.com' does not match the legitimate domain 'hyundaimovex.com'., The domain 'buzja.com' is not commonly associated with 'Hyundai Movex'., The presence of a webmail subdomain on an unrelated domain is suspicious., The email input field suggests a connection to 'hyundaimovex.com', but the URL does not match. DOM: 1.5.pages.csv
Source: https://webmail.buzja.com/?auth=byoungjo.yoo@hyundaimovex.com	Joe Sandbox AI: Score: 8 Reasons: The brand 'Hyundai Movex' is associated with the domain 'hyundaimovex.com'., The URL 'webmail.buzja.com' does not match the legitimate domain 'hyundaimovex.com'., The domain 'buzja.com' is not related to 'Hyundai Movex', which is suspicious., The use of a different domain for a webmail service could indicate a phishing attempt., The email address provided uses the legitimate domain 'hyundaimovex.com', but the URL does not match, increasing suspicion. DOM: 1.6.pages.csv
Source: https://webmail.buzja.com/?auth=byoungjo.yoo@hyundaimovex.com	Joe Sandbox AI: Score: 8 Reasons: The brand 'Hyundai Movex' is associated with the domain 'hyundaimovex.com'., The URL 'webmail.buzja.com' does not match the legitimate domain 'hyundaimovex.com'., The domain 'buzja.com' is not related to 'Hyundai Movex', which raises suspicion., The use of a subdomain 'webmail' could be an attempt to mimic a legitimate webmail service., The email address provided uses the legitimate domain 'hyundaimovex.com', but the URL does not match, indicating a potential phishing attempt. DOM: 1.7.pages.csv

Yara detected HtmlPhish44

Source: Yara match	File source: dropped/chromecache_107, type: DROPPED
Source: Yara match	File source: dropped/chromecache_149, type: DROPPED

Yara detected obfuscated html page

Source: Yara match	File source: dropped/chromecache_114, type: DROPPED
Source: Yara match	File source: dropped/chromecache_107, type: DROPPED
Source: Yara match	File source: dropped/chromecache_149, type: DROPPED

AI detected suspicious Javascript

Source: 0.8.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://webmail.jqswim.com/ff-vs/true/others.html#... This script demonstrates several high-risk behaviors, including dynamic code execution through `unescape()` and `document.write()`, which can be used to inject and execute malicious code. The heavily obfuscated code and the use of unknown domains also raise significant concerns about the script's intent and potential for harm.
Source: 0.2.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://webmail.jqswim.com/ff-vs/true/?utu=byoungj... This script demonstrates several high-risk behaviors, including dynamic code execution through `unescape()` and `document.write()`, as well as potential data exfiltration and redirection to an unknown domain. The heavy obfuscation of the code further increases the risk. Overall, this script exhibits a high level of malicious intent and should be treated with caution.
Source: 0.11.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://webmail.jqswim.com/ff-vs/true/others.html#... This script exhibits several high-risk behaviors, including dynamic code execution through the use of `unescape()` and the inclusion of multiple external scripts from untrusted domains. The obfuscated code and the presence of a fake ICANN website title suggest malicious intent. While some of the included scripts are from reputable domains like Google and jQuery, the overall behavior of the script is highly suspicious and warrants further investigation.
Source: 0.1.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://webmail.jqswim.com/ff-vs/true/?utu=byoungj... This script demonstrates several high-risk behaviors, including dynamic code execution through `document.write(unescape())` and potential data exfiltration by sending data to an unknown domain. The heavy obfuscation of the code and URLs further increases the risk. Overall, this script exhibits a high level of malicious intent and should be considered a significant security threat.
Source: 0.25.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://gateway.lighthouse.storage/ipfs/bafkreigxc... This script appears to be highly suspicious and potentially malicious. It contains several high-risk indicators:1. Dynamic code execution: The script uses `unescape()` and `document.write()` to execute dynamically generated code, which is a common technique used by malware.2. Obfuscated code: The script is heavily obfuscated, making it difficult to analyze and understand its true purpose.3. Potential data exfiltration: The script may be sending sensitive data (e.g., cookies, user information, session identifiers) to external servers, which could be used for malicious purposes.4. Redirects to suspicious domains: The script may be redirecting the user to unknown or potentially malicious domains.Given the combination of these high-risk behaviors, this script should be considered a significant security threat and should be blocked or further investigated.

HTML page contains obfuscated javascript

Source: https://webmail.jqswim.com/ff-vs/true/?utu=byoungjo.yoo@hyundaimovex.com	HTTP Parser: document.write(unescape('%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%6A%61%76%61%73%63%72%69
Source: https://webmail.jqswim.com/ff-vs/true/?utu=byoungjo.yoo@hyundaimovex.com	HTTP Parser: (function(_0x2146f3,_0x467959){const _0x5bd7fa=_0x2146f3();function _0x3693cd(_0x1009d8,_0x35897b,_0
Source: https://webmail.jqswim.com/ff-vs/true/others.html#byoungjo.yoo@hyundaimovex.com	HTTP Parser: document.write(unescape('%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%6A%61%76%61%73%63%72%69
Source: https://webmail.jqswim.com/ff-vs/true/others.html#byoungjo.yoo@hyundaimovex.com	HTTP Parser: (function(_0x478b41,_0x48948a){function _0x21947c(_0x56c420,_0x50b3e1,_0x10d91c,_0x4958a){return _0x
Source: https://gateway.lighthouse.storage/ipfs/bafkreigxcuw5qpl3w3z75rcdxx4mjhyi3epslp7pw45pjtzsb5tqewbc2m	HTTP Parser: document.write(unescape('%3C%73%63%72%69%70%74%3E%0A%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%7
Source: https://gateway.lighthouse.storage/ipfs/bafkreigxcuw5qpl3w3z75rcdxx4mjhyi3epslp7pw45pjtzsb5tqewbc2m	HTTP Parser: document.write(unescape('%3C%21%44%4F%43%54%59%50%45%20%68%74%6D%6C%20%50%55%42%4C%49%43%20%22%2D%2
Source: https://gateway.lighthouse.storage/ipfs/bafkreigxcuw5qpl3w3z75rcdxx4mjhyi3epslp7pw45pjtzsb5tqewbc2m	HTTP Parser: (function(_0x58929a,_0x11c19e){var _0x36d461=_0x58929a();function _0x153090(_0x298ada,_0x424000,_0x7