Edit tour

Windows Analysis Report
https://forms.office.com/e/xknrfCPQkR

Overview

General Information

Sample URL:	https://forms.office.com/e/xknrfCPQkR
Analysis ID:	1590967
Infos:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Yara detected HtmlPhish54

AI detected suspicious Javascript

Form action URLs do not match main URL

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 796 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6948 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1736,i,15154943280445360381,2459087164175112524,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 348 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://forms.office.com/e/xknrfCPQkR" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
3.6.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://dkddg3mmbsvxfdtosj9borbui6vsranqv5uummvmmxkhw4suxhryusgr.ivertoneym.ru/0095112956656554431QfOoQTRGMMNWJEWCZOVYEKCLWJYFEVWPDIMM	Avira URL Cloud: Label: malware
Source: https://3x9.xtogen.ru/Md2LG3i/	Avira URL Cloud: Label: phishing

Phishing

Yara detected HtmlPhish54

Source: Yara match

File source: 3.6.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.30.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://3x9.xtogen.ru/Md2LG3i/... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The script collects user data and sends it to an unknown domain, and it also redirects the user to a Microsoft login page, which is likely a phishing attempt. Overall, the script demonstrates malicious intent and poses a significant security risk.
Source: 0.29.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://3x9.xtogen.ru/Md2LG3i/... This script exhibits several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to a suspicious domain. The script also includes an obfuscated interval function that appears to be designed to detect and respond to debugging attempts. Overall, this script demonstrates a high level of malicious intent and should be considered a significant security risk.
Source: 0.28.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://3x9.xtogen.ru/Md2LG3i/... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and the presence of anti-debugging techniques further increase the risk. While the script may have some legitimate functionality, the overall behavior is highly suspicious and indicative of malicious intent.
Source: 0.27.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://elektrokapellen.blob.core.windows.net/elek... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirection to a potentially malicious domain. The use of obfuscated code and the creation of an iframe with permissive sandbox settings further increase the risk. Overall, this script exhibits a high level of suspicious and potentially malicious activity.