Edit tour

Windows Analysis Report
https://forms.office.com/e/xknrfCPQkR

Overview

General Information

Sample URL:	https://forms.office.com/e/xknrfCPQkR
Analysis ID:	1590960
Infos:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Yara detected HtmlPhish54

AI detected suspicious Javascript

Detected non-DNS traffic on DNS port

Form action URLs do not match main URL

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 7104 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5332 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1968,i,14927796347915687807,8777124078998564644,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2808 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://forms.office.com/e/xknrfCPQkR" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
3.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://1j2uwkzenvzkjg6ain3wlndcn1wvvgxfd7haufpku0ncadh3cgpizix0.gageodeg.ru/thWOadPwmcTkbkAAQIhXImDoMmFNCFTUYWPKDVFQMJEQDCGAJWTPHBGAGZNUPSJUS	Avira URL Cloud: Label: malware
Source: https://3x9.xtogen.ru/Md2LG3i/	Avira URL Cloud: Label: phishing

Phishing

Yara detected HtmlPhish54

Source: Yara match

File source: 3.7.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.28.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://elektrokapellen.blob.core.windows.net/elek... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirection to a potentially malicious domain. The use of obfuscated code and the creation of an iframe with permissive sandbox settings further increase the risk. Overall, this script exhibits a high level of suspicious and potentially malicious activity.
Source: 0.31.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://3x9.xtogen.ru/Md2LG3i/... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The script collects user data and sends it to an unknown domain, and it also redirects the user to a Microsoft login page, which could be part of a phishing attempt. Overall, the script demonstrates highly suspicious and potentially malicious behavior.
Source: 0.30.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://3x9.xtogen.ru/Md2LG3i/... This script exhibits several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to a suspicious domain. The script also uses obfuscated variable names and setInterval to repeatedly trigger a debugger statement, which could be an attempt to detect and evade analysis. These behaviors strongly indicate malicious intent, likely for the purpose of phishing or other malicious activities.
Source: 0.29.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://3x9.xtogen.ru/Md2LG3i/... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of `atob()` and `decodeURIComponent()` to decode and execute remote code is a clear indicator of malicious intent. Additionally, the script attempts to prevent common security measures like developer tools and context menus, further suggesting suspicious activity. Overall, this script poses a significant risk and should be treated with caution.