Edit tour

Windows Analysis Report
https://pwv95gp5r-xn--r3h9jdud-xn----c1a2cj-xn----p1ai.translate.goog/sIQKSvTC/b8KvU/uoTt6?ZFhObGNpNXBiblp2YkhabGJXVnVkRUJ6YjNWMGFHVnliblJ5ZFhOMExtaHpZMjVwTG01bGRBPT06c1JsOUE+&_x_tr_sch=http&_x_tr_sl=hrLWHGLm&_x_tr_tl=bTtllyql

Overview

General Information

Sample URL:	https://pwv95gp5r-xn--r3h9jdud-xn----c1a2cj-xn----p1ai.translate.goog/sIQKSvTC/b8KvU/uoTt6?ZFhObGNpNXBiblp2YkhabGJXVnVkRUJ6YjNWMGFHVnliblJ5ZFhOMExtaHpZMjVwTG01bGRBPT06c1JsOUE+&_x_tr_sch=http&_x_tr_sl=
Analysis ID:	1584763
Infos:

Detection

HTMLPhisher

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Suricata IDS alerts for network traffic

Yara detected HtmlPhish29

AI detected suspicious Javascript

AI detected suspicious URL

HTML page contains hidden URLs

Javascript uses Clearbit API to dynamically determine company logos

Detected hidden input values containing email addresses (often used in phishing pages)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML title does not match URL

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2056 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4108 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2192,i,9900941316819676959,10690270301518993952,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://pwv95gp5r-xn--r3h9jdud-xn----c1a2cj-xn----p1ai.translate.goog/sIQKSvTC/b8KvU/uoTt6?ZFhObGNpNXBiblp2YkhabGJXVnVkRUJ6YjNWMGFHVnliblJ5ZFhOMExtaHpZMjVwTG01bGRBPT06c1JsOUE+&_x_tr_sch=http&_x_tr_sl=hrLWHGLm&_x_tr_tl=bTtllyql" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
4.1.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security
4.3.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security
4.5.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security
4.6.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security

Suricata Signatures

ET PHISHING HiYu - Request for User Specific Landing Page

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T13:05:46.334251+0100	2044322	1	A Network Trojan was detected	192.168.2.4	49778	199.36.158.100	443	TCP

ET PHISHING HiYu - Request for Victim Enrichment

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T13:05:45.601021+0100	2044318	2	Possible Social Engineering Attempted	192.168.2.4	49764	188.114.96.3	443	TCP

ET PHISHING HiYu - Victim Enrichment Response M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T13:05:45.601274+0100	2044321	2	Possible Social Engineering Attempted	188.114.96.3	443	192.168.2.4	49764	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://pwv95gp5r-xn--r3h9jdud-xn----c1a2cj-xn----p1ai.translate.goog/sIQKSvTC/b8KvU/uoTt6?ZFhObGNpNXBiblp2YkhabGJXVnVkRUJ6YjNWMGFHVnliblJ5ZFhOMExtaHpZMjVwTG01bGRBPT06c1JsOUE+&_x_tr_sch=http&_x_tr_sl=hrLWHGLm&_x_tr_tl=bTtllyql

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

Yara detected HtmlPhish29

Source: Yara match	File source: 4.1.pages.csv, type: HTML
Source: Yara match	File source: 4.3.pages.csv, type: HTML
Source: Yara match	File source: 4.5.pages.csv, type: HTML
Source: Yara match	File source: 4.6.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.27.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://pwv95gp5r-xn--r3h9jdud-xn----c1a2cj-xn----... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated URLs and the overall suspicious nature of the script's functionality indicate a high likelihood of malicious intent.
Source: 0.1.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://pwv95gp5r-xn--r3h9jdud-xn----c1a2cj-xn----... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated URLs and the overall suspicious nature of the script's functionality indicate a high likelihood of malicious intent.

AI detected suspicious URL

Source: URL

Joe Sandbox AI: AI detected Typosquatting in URL: https://pwv95gp5r-xn--r3h9jdud-xn----c1a2cj-xn----p1ai.translate.goog

HTML page contains hidden URLs