Play interactive tourEdit tour
Windows Analysis Report Proof oF Payment.htm
Overview
General Information
Detection
HTMLPhisher
Score: | 60 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Yara detected HtmlPhish10
HTML document with suspicious title
Phishing site detected (based on various OCR indicators)
HTML document with suspicious name
PE file contains an invalid checksum
Drops PE files
None HTTPS page querying sensitive user data (password, username or email)
PE file contains sections with non-standard names
No HTML title found
JA3 SSL client fingerprint seen in connection with other malware
HTML body contains low number of good links
IP address seen in connection with other malware
Classification
Process Tree |
---|
|
Malware Configuration |
---|
No configs have been found |
---|
Yara Overview |
---|
Initial Sample |
---|
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_HtmlPhish_10 | Yara detected HtmlPhish_10 | Joe Security |
Sigma Overview |
---|
No Sigma rule has matched |
---|
Jbx Signature Overview |
---|
Click to jump to signature section
Show All Signature Results
Phishing: |
---|
Yara detected HtmlPhish10 | Show sources |
Source: | File source: | ||
Source: | File source: |
Phishing site detected (based on various OCR indicators) | Show sources |
Source: | OCR Text: | ||
Source: | OCR Text: |