Edit tour

Windows Analysis Report
Subscription_Renewal_Receipt_2025.htm

Overview

General Information

Sample name:	Subscription_Renewal_Receipt_2025.htm
Analysis ID:	1591034
MD5:	406b5e692e92eed5cd1ac3641aa03575
SHA1:	db2a888a708bdb319c4157902063b2a35347d07b
SHA256:	dd0ed35a4d6f585bcbe7971ed9c7cf87040a9cf77b94ce7594d2c39ed66d374c
Infos:

Detection

HTMLPhisher

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

HTML file submission requesting Cloudflare captcha challenge

Yara detected HtmlPhish77

AI detected suspicious Javascript

Detected javascript redirector / loader

HTML document with suspicious name

Suspicious Javascript code found in HTML file

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

Invalid 'forgot password' link found

Invalid T&C link found

JA3 SSL client fingerprint seen in connection with other malware

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 7044 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Subscription_Renewal_Receipt_2025.htm" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3948 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2220,i,1449854067578553754,12097904517622000412,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
6.6.pages.csv	JoeSecurity_HtmlPhish_77	Yara detected HtmlPhish_77	Joe Security
6.5.pages.csv	JoeSecurity_HtmlPhish_77	Yara detected HtmlPhish_77	Joe Security
6.4.pages.csv	JoeSecurity_HtmlPhish_77	Yara detected HtmlPhish_77	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://243dev.com/js/fNCszfNCsz/dan.mooney	Avira URL Cloud: Label: phishing
Source: https://243dev.com/favicon.ico	Avira URL Cloud: Label: phishing

Phishing

Yara detected HtmlPhish77

Source: Yara match	File source: 6.6.pages.csv, type: HTML
Source: Yara match	File source: 6.5.pages.csv, type: HTML
Source: Yara match	File source: 6.4.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.7.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://cotceur.com/?cf-turnstile-response=0.ZfVzj... This JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. The use of `eval`, `Function` constructor, and heavily encoded strings indicates a high likelihood of malicious intent. Additionally, the script appears to be attempting to redirect the user to an unknown or suspicious domain, which further increases the risk. Overall, this script demonstrates a clear pattern of malicious activity and should be considered a high-risk threat.

Detected javascript redirector / loader

Source: Subscription_Renewal_Receipt_2025.htm

HTTP Parser: Low number of body elements: 1

Suspicious Javascript code found in HTML file

Source: Subscription_Renewal_Receipt_2025.htm	HTTP Parser: .location
Source: Subscription_Renewal_Receipt_2025.htm	HTTP Parser: .location