Edit tour

Windows Analysis Report
https://app.rule.io/link/nl/n_1axpe0s/a/n_9xd/d/n_g0dz/di/n_rt/s/n_5f9b21/e/n_1xckxy

Overview

General Information

Sample URL:	https://app.rule.io/link/nl/n_1axpe0s/a/n_9xd/d/n_g0dz/di/n_rt/s/n_5f9b21/e/n_1xckxy
Analysis ID:	1624183
Infos:

Detection

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

AI detected suspicious URL

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

HTTP GET or POST without a user agent

Classification

Process Tree

System is w11x64_office

chrome.exe (PID: 7152 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 290DF23002E9B52249B5549F0C668A86)

chrome.exe (PID: 6904 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1848,i,308563964456854505,14231195534914521831,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250129-180207.876000 --mojo-platform-channel-handle=2092 /prefetch:11 MD5: 290DF23002E9B52249B5549F0C668A86)

chrome.exe (PID: 4024 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.rule.io/link/nl/n_1axpe0s/a/n_9xd/d/n_g0dz/di/n_rt/s/n_5f9b21/e/n_1xckxy" MD5: 290DF23002E9B52249B5549F0C668A86)

cleanup

Joe Sandbox Signatures

• AV Detection
• Phishing
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://veytjpxr.elementor.cloud/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://veytjpxr.elementor.cloud/cdn-cgi/rum?	Avira URL Cloud: Label: phishing

Phishing

AI detected phishing page

Source: https://hostocorreos.com/App/project/index.php	Joe Sandbox AI: Score: 9 Reasons: The brand 'Apple' is classified as 'wellknown'., The legitimate domain for Apple is 'apple.com'., The provided URL 'hostocorreos.com' does not match the legitimate domain for Apple., The URL 'hostocorreos.com' contains no recognizable association with Apple., The URL uses a domain name that is unrelated to Apple, which is a common phishing tactic., The presence of input fields for 'Email' and 'Password' on a non-Apple domain is suspicious. DOM: 3.7.pages.csv
Source: https://hostocorreos.com/App/project/index.php	Joe Sandbox AI: Score: 9 Reasons: The brand 'Apple' is classified as 'wellknown'., The legitimate domain for Apple is 'apple.com'., The provided URL 'hostocorreos.com' does not match the legitimate domain for Apple., The URL 'hostocorreos.com' does not contain any recognizable association with Apple., The URL contains no direct reference to Apple, which is suspicious given the brand association., The presence of input fields for sensitive information like 'Card Number', 'Name on Card', 'MM/YY', and 'CVV' is typical of phishing sites attempting to steal financial information. DOM: 3.8.pages.csv

AI detected suspicious URL

Source: https://hostocorreos.com

Joe Sandbox AI: The URL 'https://hostocorreos.com' appears to be a typosquatting attempt targeting the Spanish postal service brand 'Correos'. The legitimate URL for Correos is 'https://correos.es'. The analyzed URL uses the word 'correos', which is a direct reference to the brand. The prefix 'hosto' could be a misspelling or a deliberate attempt to confuse users, as it visually resembles 'host' or 'hostel', but does not have a clear legitimate purpose in this context. The '.com' extension is a common alternative to '.es', which could further mislead users into thinking it is a legitimate site. The similarity score is high due to the direct use of the brand name and the potential for user confusion. The likelihood of this being a typosquatting attempt is also high, given the structural and visual similarities to the legitimate brand URL.