Edit tour

Windows Analysis Report
https://ik.imagekit.io/nrof2h909/Sherman%20Pruitt,%20Chief%20of%20Police,%20MSCJ.pdf?updatedAt=1736444487005

Overview

General Information

Sample URL:	https://ik.imagekit.io/nrof2h909/Sherman%20Pruitt,%20Chief%20of%20Police,%20MSCJ.pdf?updatedAt=1736444487005
Analysis ID:	1587251
Infos:

Errors URL not reachable

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

Drops files with a non-matching file extension (content does not match file extension)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

Invalid T&C link found

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2804 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3920 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1896,i,3149072989168332374,3115819170252126573,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5952 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ik.imagekit.io/nrof2h909/Sherman%20Pruitt,%20Chief%20of%20Police,%20MSCJ.pdf?updatedAt=1736444487005" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

Acrobat.exe (PID: 2552 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5496 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6572 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1612,i,4555544093122859011,1755152164905103344,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 4180 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://jackoffjackofflilliilkillxoopoeadonline.top/drive MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5132 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1932,i,9153267959082624924,9136755991196431065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6416 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://jackoffjackofflilliilkillxoopoeadonline.top/drive" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5384 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2000,i,12263652073252406114,9605289258351852576,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://jackoffjackofflilliilkillxoopoeadonline.top/drive/	Joe Sandbox AI: Score: 10 Reasons: The brand 'Microsoft' is a well-known global technology company., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'jackoffjackofflilliilkillxoopoeadonline.top' does not match the legitimate domain for Microsoft., The URL contains suspicious elements such as random words and an unusual domain extension '.top'., The URL does not have any recognizable association with Microsoft., The email domain 'rojpxs.org' is not associated with Microsoft. DOM: 5.9.pages.csv
Source: https://jackoffjackofflilliilkillxoopoeadonline.top/drive/	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'jackoffjackofflilliilkillxoopoeadonline.top' does not match the legitimate domain for Microsoft., The URL contains suspicious elements such as random words and an unusual domain extension '.top'., There is no association between the URL and the brand 'Microsoft'., The email domain 'rojpxs.org' does not relate to Microsoft, adding to the suspicion. DOM: 5.10.pages.csv

AI detected landing page (webpage, office document or email)

Source: file:///C:/Users/user/Downloads/downloaded.pdf	Joe Sandbox AI: Page contains button: 'View Document' Source: '1.1.pages.csv'
Source: file:///C:/Users/user/Downloads/downloaded.pdf	Joe Sandbox AI: Page contains button: 'View Document' Source: '1.2.pages.csv'
Source: https://jackoffjackofflilliilkillxoopoeadonline.top/drive/	Joe Sandbox AI: Page contains button: 'Verifying...' Source: '5.10.pages.csv'

AI detected suspicious Javascript

Source: 2.7.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://jackoffjackofflilliilkillxoopoeadonline.to... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load an external script, along with the obfuscated nature of the script, further increases the risk. While the script may have a legitimate purpose, such as a challenge platform, the overall behavior is highly suspicious and indicative of potential malicious intent.
Source: 2.10.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://jackoffjackofflilliilkillxoopoeadonline.to... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as implementing a security challenge, the overall behavior is highly suspicious and indicative of potential malicious intent.
Source: 2.5.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://jackoffjackofflilliilkillxoopoeadonline.to... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and suspicious domain interactions. The use of obfuscated code and the presence of encoded strings further increase the risk. While some contextual factors, such as the potential for legitimate analytics or telemetry, could slightly reduce the score, the overall behavior of the script is highly suspicious and indicative of malicious intent.
Source: 2.9.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://jackoffjackofflilliilkillxoopoeadonline.to... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. It appears to be collecting user email and password information and sending it to an external domain, which is a strong indicator of malicious intent. The script also attempts to redirect the user to a suspicious domain, further increasing the risk. While some contextual factors, such as the use of a legitimate-looking domain, may suggest a potential legitimate purpose, the overall behavior of the script is highly suspicious and warrants further investigation.
Source: 2.0.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://jackoffjackofflilliilkillxoopoeadonline.to... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and multiple fallback domains further increases the risk. While some contextual factors like the domain name suggest potential malicious intent, the script's purpose is not entirely clear. Overall, the combination of these behaviors warrants a high-risk score.