Edit tour

Windows Analysis Report
https://forms.office.com/e/xknrfCPQkR

Overview

General Information

Sample URL:	https://forms.office.com/e/xknrfCPQkR
Analysis ID:	1590968
Infos:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Yara detected HtmlPhish54

AI detected suspicious Javascript

Form action URLs do not match main URL

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4928 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2488 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2552 --field-trial-handle=2420,i,10394221779363493289,1917952059437808651,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6488 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://forms.office.com/e/xknrfCPQkR" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
3.6.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://3x9.xtogen.ru/Md2LG3i/	Avira URL Cloud: Label: phishing
Source: https://e05x2aocrmiihvknxzl1r2w4kqvrzemvu75vuqxioi8snwfgfjmu.sprocubseq.ru/02816945966029649405878OLOyddfIBWHRDUFYMPBCSFPGKCZEEJLEZHFYJMWASTSHQ	Avira URL Cloud: Label: malware

Phishing

Yara detected HtmlPhish54

Source: Yara match

File source: 3.6.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.30.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://3x9.xtogen.ru/Md2LG3i/... This script exhibits several high-risk behaviors, including disabling common developer tools and keyboard shortcuts, as well as redirecting the user to a suspicious domain (login.microsoftonline.com) after a delay. The script appears to be attempting to detect and prevent security analysis, which is a strong indicator of malicious intent.
Source: 0.29.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://3x9.xtogen.ru/Md2LG3i/... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and the presence of anti-debugging techniques further increase the risk. Overall, this script demonstrates a high likelihood of malicious intent and should be treated with caution.
Source: 0.28.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://elektrokapellen.blob.core.windows.net/elek... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirection to a potentially malicious domain. The use of obfuscated code and the creation of an iframe with permissive sandbox settings further increase the risk. Overall, this script exhibits a high level of suspicious and potentially malicious activity.
Source: 0.31.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://3x9.xtogen.ru/Md2LG3i/... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. It collects user data and sends it to an untrusted domain, and it also attempts to bypass form submission validation. Overall, the script demonstrates malicious intent and poses a significant security risk.