Edit tour

Windows Analysis Report
https://forms.office.com/e/xknrfCPQkR

Overview

General Information

Sample URL:	https://forms.office.com/e/xknrfCPQkR
Analysis ID:	1590988
Infos:

Detection

HTMLPhisher

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Yara detected HtmlPhish44

Yara detected HtmlPhish54

AI detected suspicious Javascript

Form action URLs do not match main URL

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6128 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1936,i,1601381255336036837,136358594727870665,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6500 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://forms.office.com/e/xknrfCPQkR" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_122	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security

HTML

Source	Rule	Description	Author	Strings
3.6.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://ordt78snafesrfqw9totqctrxy8rjrbq9g744p8agnedmlwgqfoc6.deryposi.ru/gcusurtxhkjllgbyhrfaxixdtFPJQNsFQGSCVBFNKQDDWAAQKCKBNTTHNKTDHXMMENXZSPZMJF	Avira URL Cloud: Label: malware
Source: https://3x9.xtogen.ru/Md2LG3i/	Avira URL Cloud: Label: phishing

Phishing

Yara detected HtmlPhish44

Source: Yara match

File source: dropped/chromecache_122, type: DROPPED

Yara detected HtmlPhish54

Source: Yara match

File source: 3.6.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.30.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://3x9.xtogen.ru/Md2LG3i/... This script exhibits several high-risk behaviors, including detecting the presence of web automation tools, disabling common keyboard shortcuts, and redirecting the user to a suspicious domain. The script also uses a setInterval loop with a debugger statement, which could be an attempt to detect and bypass security measures. Overall, this script demonstrates malicious intent and poses a significant risk to the user's security and privacy.
Source: 0.28.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://elektrokapellen.blob.core.windows.net/elek... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirection to a potentially malicious domain. The use of obfuscated code and the creation of an iframe with permissive sandbox settings further increase the risk. Overall, this script exhibits a high level of suspicious and potentially malicious activity.
Source: 0.29.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://3x9.xtogen.ru/Md2LG3i/... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and the presence of anti-debugging techniques further increase the risk. Overall, this script demonstrates a high likelihood of malicious intent and should be treated with caution.
Source: 0.31.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://3x9.xtogen.ru/Md2LG3i/... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The script collects user data and sends it to an unknown domain, and it also redirects the user to a Microsoft login page, which is likely a phishing attempt. Overall, the script demonstrates malicious intent and poses a significant security risk.