Windows
Analysis Report
https://www.powr.io/form-builder/i/39342486#page
Overview
General Information
Detection
HTMLPhisher, Invisible JS, Tycoon2FA
Score: | 100 |
Range: | 0 - 100 |
Confidence: | 100% |
Signatures
AI detected phishing page
Antivirus detection for URL or domain
Found malware configuration
Yara detected AntiDebug via timestamp check
Yara detected HtmlPhish10
Yara detected Invisible JS
Yara detected Obfuscation Via HangulCharacter
Yara detected Tycoon 2FA PaaS
AI detected suspicious Javascript
Creates files inside the system directory
Deletes files inside the Windows folder
HTML body contains low number of good links
HTML body contains password input but no form action
HTML page contains hidden javascript code
HTML title does not match URL
Invalid T&C link found
Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)
Classification
- System is w10x64
chrome.exe (PID: 2932 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --s tart-maxim ized "abou t:blank" MD5: E81F54E6C1129887AEA47E7D092680BF) chrome.exe (PID: 4840 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --no-pre-r ead-main-d ll --field -trial-han dle=1988,i ,745230212 666400134, 1437844378 1146120642 ,262144 -- disable-fe atures=Opt imizationG uideModelD ownloading ,Optimizat ionHints,O ptimizatio nHintsFetc hing,Optim izationTar getPredict ion --vari ations-see d-version --mojo-pla tform-chan nel-handle =2016 /pre fetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)
chrome.exe (PID: 6860 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" "htt ps://www.p owr.io/for m-builder/ i/39342486 #page" MD5: E81F54E6C1129887AEA47E7D092680BF)
- cleanup
{
"otherweburl": "",
"websitenames": "[\"godaddy\", \"okta\"]",
"bes": "[\"Apple.com\",\"Netflix.com\"]",
"pes": "[\"https:\\/\\/t.me\\/\",\"https:\\/\\/t.com\\/\",\"t.me\\/\",\"https:\\/\\/t.me.com\\/\",\"t.me.com\\/\",\"t.me@\",\"https:\\/\\/t.me@\",\"https:\\/\\/t.me\",\"https:\\/\\/t.com\",\"t.me\",\"https:\\/\\/t.me.com\",\"t.me.com\",\"t.me\\/@\",\"https:\\/\\/t.me\\/@\",\"https:\\/\\/t.me@\\/\",\"t.me@\\/\",\"https:\\/\\/www.telegram.me\\/\",\"https:\\/\\/www.telegram.me\"]",
"capnum": "1",
"appnum": "1",
"pvn": "0",
"view": "",
"pagelinkval": "m3JXm",
"emailcheck": "0",
"webname": "rtrim(/web8/, '/')",
"urlo": "/gwjuloFKSWa9vIkCoGz9No1kCsCButwCtvXz4X47uVArOIM7zU2qjl",
"gdf": "/ijdfDqgz1K7nJlXX4uvsFYNbBbrrC7cd120"
}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_HangulCharacter | Yara detected Obfuscation Via HangulCharacter | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Tycoon2FA_1 | Yara detected Tycoon 2FA PaaS | Joe Security | ||
JoeSecurity_AntiDebugBrowser | Yara detected AntiDebug via timestamp check | Joe Security | ||
JoeSecurity_Tycoon2FA_1 | Yara detected Tycoon 2FA PaaS | Joe Security | ||
JoeSecurity_Tycoon2FA_1 | Yara detected Tycoon 2FA PaaS | Joe Security | ||
JoeSecurity_AntiDebugBrowser | Yara detected AntiDebug via timestamp check | Joe Security | ||
Click to see the 21 entries |
⊘No Sigma rule has matched
⊘No Suricata rule has matched
- • AV Detection
- • Cryptography
- • Phishing
- • Compliance
- • Networking
- • System Summary
- • Malware Analysis System Evasion
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: |
Source: | Malware Configuration Extractor: |
Source: | Binary or memory string: |