Edit tour

Windows Analysis Report
https://app.heptabase.com/w/9572b61a878f03208943512867a816847d4d23b4f7ccb0a7fe97bab5d1ad7da7

Overview

General Information

Sample URL:	https://app.heptabase.com/w/9572b61a878f03208943512867a816847d4d23b4f7ccb0a7fe97bab5d1ad7da7
Analysis ID:	1647358
Infos:

Detection

HTMLPhisher, Invisible JS, Tycoon2FA

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

Yara detected AntiDebug via timestamp check

Yara detected HtmlPhish10

Yara detected Invisible JS

Yara detected Obfuscation Via HangulCharacter

Yara detected Tycoon 2FA PaaS

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

Phishing site or detected (based on various text indicators)

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

Invalid T&C link found

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6588 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1984,i,8051527031639735662,391681969348511936,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 2748 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.heptabase.com/w/9572b61a878f03208943512867a816847d4d23b4f7ccb0a7fe97bab5d1ad7da7" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_138	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security

HTML

Source	Rule	Description	Author
2.23.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.20.d.script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.20.d.script.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
2.24..script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.19.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.19.d.script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.5.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.5.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
3.30..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
3.30..script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.28.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
3.35.d.script.csv	JoeSecurity_Tycoon2FA	Yara detected Tycoon 2FA PaaS	Joe Security
3.31..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
3.31..script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
3.38..script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.6.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.6.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
3.9.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
3.9.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
3.9.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
3.8.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
3.8.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
3.8.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
Click to see the 18 entries

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Software Vulnerabilities
• Networking
• System Summary
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://ms.naturdon.com/rqS5DHMtUFf3KT9q8ukN4yHulJtYoxvAk1NDcbB3pNrzjy	Avira URL Cloud: Label: phishing
Source: https://ms.naturdon.com/opSQsIIfCrYEifeBNcpBzLABefvLCJwGmOyMuRzcmBuX45133	Avira URL Cloud: Label: phishing
Source: https://ms.naturdon.com/efGejjtuNnmhRtNkGlHs8IHE7ijpHoVGG7mAI92qSys9uQiaNo78150	Avira URL Cloud: Label: phishing
Source: https://ms.naturdon.com/stjXGvT17JklTv4LfDUGVIPdaYnFaQdUW4jCMkD3HbMhZoqA0Z67SnPrMnOwyyOYBACmgPHP6wGVVWZbZOviWBaoaGgh254	Avira URL Cloud: Label: phishing
Source: https://ms.naturdon.com/ghN0n6xyqF79DUkCI7M5jl9tDKtEGk7pgxypCNYtBFhWI8elPUjiKnPef204	Avira URL Cloud: Label: phishing
Source: https://ms.naturdon.com/wxE3arEkk2RbNb59NyJropvgEEl7AIwr34125	Avira URL Cloud: Label: phishing
Source: https://ms.naturdon.com/GDSherpa-regular.woff	Avira URL Cloud: Label: phishing
Source: https://ms.naturdon.com/ijDh3NnwhFxGLRV4LwW2300gHnRdqrb51FENUw7805QPX1NNab230	Avira URL Cloud: Label: phishing
Source: https://ms.naturdon.com/kleRO9JVys2NlTKKYiRt12w9NfiqKjLiiBbqOE07EDpVPCYTbXYoOXDS2ZtRvcD9w4YjWzcKTWa9tmSgbDuolYpqsXv8GNph76iirb3Gh5eLR6hFTzubcQLg5pdZAdNeB8tRVtUFZIBB7Uj497bIA4m2QpRzW8rW7SPyz660	Avira URL Cloud: Label: phishing
Source: https://ms.naturdon.com/xynACghvrsuVjigh30	Avira URL Cloud: Label: phishing

Phishing

AI detected phishing page

Source: https://ms.naturdon.com/icqvphaklstpaqrjclpxqvkdxiz03jft5l8dw3i9p2yx3gfgx0ym1?RMGDUWTXPSXJWMMIUPGUOYFFNR	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The legitimate domain for Microsoft is 'microsoft.com'., The provided URL 'ms.naturdon.com' does not match the legitimate domain for Microsoft., The URL contains 'ms', which could be an attempt to mimic 'Microsoft', but it is not a full match., The domain 'naturdon.com' is not associated with Microsoft and appears unrelated., The presence of input fields for 'Email, phone, or Skype' is typical for Microsoft services, but given the domain mismatch, it raises suspicion. DOM: 3.9.pages.csv
Source: https://ms.naturdon.com/icqvphaklstpaqrjclpxqvkdxiz03jft5l8dw3i9p2yx3gfgx0ym1?RMGDUWTXPSXJWMMIUPGUOYFFNR	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'ms.naturdon.com' does not match the legitimate domain 'microsoft.com'., The use of 'ms' in the subdomain could be an attempt to mimic 'Microsoft', but the main domain 'naturdon.com' is unrelated to Microsoft., The presence of input fields for 'Email, phone, or Skype' is typical for Microsoft services, but given the domain mismatch, it raises suspicion., The domain 'naturdon.com' does not have any known association with Microsoft, increasing the likelihood of phishing. DOM: 3.8.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 3.9.pages.csv, type: HTML
Source: Yara match	File source: 3.8.pages.csv, type: HTML

Yara detected Invisible JS

Source: Yara match	File source: 2.20.d.script.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML
Source: Yara match	File source: 2.6.pages.csv, type: HTML

Yara detected Obfuscation Via HangulCharacter

Source: Yara match	File source: 2.20.d.script.csv, type: HTML
Source: Yara match	File source: 2.24..script.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML
Source: Yara match	File source: 3.38..script.csv, type: HTML
Source: Yara match	File source: 2.6.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_138, type: DROPPED

Yara detected Tycoon 2FA PaaS

Source: Yara match	File source: 3.35.d.script.csv, type: HTML
Source: Yara match	File source: 2.23.d.script.csv, type: HTML
Source: Yara match	File source: 2.19.d.script.csv, type: HTML
Source: Yara match	File source: 3.30..script.csv, type: HTML
Source: Yara match	File source: 2.28.d.script.csv, type: HTML
Source: Yara match	File source: 3.31..script.csv, type: HTML
Source: Yara match	File source: 3.9.pages.csv, type: HTML
Source: Yara match	File source: 3.8.pages.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: https://app.heptabase.com/w/9572b61a878f03208943512867a816847d4d23b4f7ccb0a7fe97bab5d1ad7da7?id=c9bfc81f-fa96-4dff-99fa-279a46da3576	Joe Sandbox AI: Page contains button: 'VIEW PDF DOCUMENT' Source: '1.2.pages.csv'
Source: https://app.heptabase.com/w/9572b61a878f03208943512867a816847d4d23b4f7ccb0a7fe97bab5d1ad7da7?id=c9bfc81f-fa96-4dff-99fa-279a46da3576	Joe Sandbox AI: Page contains button: 'VIEW PDF DOCUMENT' Source: '1.3.pages.csv'

AI detected suspicious Javascript

Source: 2.21..script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://ms.naturdon.com/iVYo/... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of `atob()` to decode base64-encoded strings, followed by `eval()` to execute the decoded content, is a clear indicator of malicious intent. Additionally, the script appears to be sending user data to an untrusted domain, which poses a significant risk of data theft or other malicious activities. Overall, this script exhibits a high level of suspicion and should be treated as a potential security threat.

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 1.2	OCR Text: Q A document has been shared with you Monday Mar 24, 2025 Docuser A PDF document has been shared with you cn DocuSign for business. To viev.% follow the 'View POF Document" below VIEW PDF DOCUMENT
Source: Chrome DOM: 1.3	OCR Text: Q A document has been shared with you Monday Mar 24, 2025 Monday Mar 24, 202 Docufibn Docuser A PDF document has been shared with you on A PDF document has b DocuSign for business. To view, follow the 'iView DocuSign for business, PDF Document" below Document" below VIEW PDF DOCUMI VIEW PDF DOCUMENT