Edit tour

Windows Analysis Report
https://248d0d7c.b6979dc2a0c182f7ec7a4aa7.workers.dev/?_kx=tT2g7RhPaXrh3A6Bckepfg.WnBBDP

Overview

General Information

Sample URL:	https://248d0d7c.b6979dc2a0c182f7ec7a4aa7.workers.dev/?_kx=tT2g7RhPaXrh3A6Bckepfg.WnBBDP
Analysis ID:	1650392
Infos:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish54

AI detected suspicious Javascript

Creates files inside the system directory

Deletes files inside the Windows folder

Form action URLs do not match main URL

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML page contains obfuscated script src

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 1064 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5024 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1976,i,14553789535348024310,2542120593596377207,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6620 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://248d0d7c.b6979dc2a0c182f7ec7a4aa7.workers.dev/?_kx=tT2g7RhPaXrh3A6Bckepfg.WnBBDP" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
0.5..script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
0.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security

Joe Sandbox Signatures

• Phishing
• Compliance
• Software Vulnerabilities
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://248d0d7c.b6979dc2a0c182f7ec7a4aa7.workers.dev/?_kx=tT2g7RhPaXrh3A6Bckepfg.WnBBDP	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL '248d0d7c.b6979dc2a0c182f7ec7a4aa7.workers.dev' does not match the legitimate domain 'microsoft.com'., The domain 'workers.dev' is a generic domain often used for cloud services, which can be legitimate but is not directly associated with Microsoft., The subdomain and path appear to be random strings, which is a common tactic in phishing URLs to obscure the true nature of the site., The presence of input fields for 'Email, phone, or Skype' is typical for phishing attempts targeting Microsoft accounts. DOM: 0.6.pages.csv
Source: https://248d0d7c.b6979dc2a0c182f7ec7a4aa7.workers.dev/?_kx=tT2g7RhPaXrh3A6Bckepfg.WnBBDP	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL '248d0d7c.b6979dc2a0c182f7ec7a4aa7.workers.dev' does not match the legitimate domain 'microsoft.com'., The domain 'workers.dev' is a generic domain often used for cloud services, which can be legitimate but is not directly associated with Microsoft., The subdomain and path structure appear random and do not convey any direct association with Microsoft., The presence of input fields for 'Email, phone, or Skype' is typical for Microsoft services, but the URL does not support legitimacy., The URL contains no direct reference to Microsoft, which is suspicious. DOM: 0.5.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 0.5..script.csv, type: HTML
Source: Yara match	File source: 0.5.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.3..script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://248d0d7c.b6979dc2a0c182f7ec7a4aa7.workers.... This script demonstrates high-risk behavior by using the `atob()` function to decode a base64-encoded string that contains an HTML snippet. The decoded HTML includes an `iframe` element that loads content from an external domain (`qsquarred.com`), which is a potential indicator of malicious activity such as phishing or drive-by downloads. The use of obfuscated code and the inclusion of an external iframe are strong indicators of suspicious and potentially harmful behavior, warranting a high-risk score.