Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

PaymentOnline.html

HTML document, ASCII text, with very long lines (755)

initial sample

Details

Filetype:	HTML document, ASCII text, with very long lines (755)
Entropy:	6.111868428475651
Filename:	PaymentOnline.html
Filesize:	658162
MD5:	4cacf32138486b8ca5adb3da029444eb
SHA1:	47f8ea09758e72f0c95fa25d3267deb4ee5f4e0d
SHA256:	f8b83a4418456313b2f77ebc2d03e24662e913782b576b872315084f91658f9d
SHA512:	05f489bd7f076078b7b5426bcd6927da839b1e8480328a0a78bab112cbae4c046ccb55e685f35a48a5b6e45a4fc3718982915054626dce062eb41d45862a19db
SSDEEP:	12288:vN6L85UGPStyn9nG8//JVkPeMW307F10G1bmpNdMq:IL8/PZJW2MWiKGMpTMq
Preview:	<html lang="en">.<head>. <meta http-equiv="x-ua-compatible" content="EmulateIE9" />.<meta charset="utf-8" />.<meta.name="viewport".content="width=device-width, initial-scale=1, shrink-to-fit=no"./>..<title>se</title>.<meta http-equiv="imagetoolbar" conte

Signature Hits	Behavior Group	Mitre Attack
HTML document with suspicious name	System Summary
HTML file submission containing password form	Stealing of Sensitive Information
Phishing site detected (based on image similarity)	Phishing
Phishing site detected (based on logo match)	Phishing
HTML body contains low number of good links	Phishing
HTML body contains password input but no form action	Phishing
HTML title does not match URL	Phishing
None HTTPS page querying sensitive user data (password, username or email)	Phishing
HTML body contains password input	Phishing
HTML page is missing a favicon	Phishing
META author tag missing	Phishing
META copyright tag missing	Phishing
URLs found in memory or binary data	Networking

Chrome Cache Entry: 64

ASCII text, with very long lines (2058), with no line terminators

downloaded

Details

File:	Chrome Cache Entry: 64
Category:	downloaded
Dump:	chromecache_64.2.dr
ID:	dr_6
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (2058), with no line terminators
Entropy:	5.2275519102374925
Encrypted:	false
Ssdeep:	48:I54twbMVLUwxlRiCXloJpA+D+F0N+4+DSnm7DGl46YXkgs2:I5nb+YaHP1oJC+iF0J+enm7I43X42
Size:	2058
Whitelisted:	false
Reputation:	moderate

Chrome Cache Entry: 65

ASCII text, with very long lines (32065)

dropped

Details

File:	Chrome Cache Entry: 65
Category:	dropped
Dump:	chromecache_65.2.dr
ID:	dr_1
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (32065)
Entropy:	5.366055229017455
Encrypted:	false
Ssdeep:	1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2
Size:	85578
Whitelisted:	true
Reputation:	high

Chrome Cache Entry: 66

ASCII text, with no line terminators

downloaded

Details

File:	Chrome Cache Entry: 66
Category:	downloaded
Dump:	chromecache_66.2.dr
ID:	dr_7
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with no line terminators
Entropy:	3.9361804341297555
Encrypted:	false
Ssdeep:	3:DyclXMR+:jlXL
Size:	23
Whitelisted:	false
Reputation:	moderate

Chrome Cache Entry: 67

ASCII text, with very long lines (2058), with no line terminators

dropped

Details

File:	Chrome Cache Entry: 67
Category:	dropped
Dump:	chromecache_67.2.dr
ID:	dr_3
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (2058), with no line terminators
Entropy:	5.2275519102374925
Encrypted:	false
Ssdeep:	48:I54twbMVLUwxlRiCXloJpA+D+F0N+4+DSnm7DGl46YXkgs2:I5nb+YaHP1oJC+iF0J+enm7I43X42
Size:	2058
Whitelisted:	false
Reputation:	moderate

Chrome Cache Entry: 68

ASCII text, with no line terminators

dropped

Details

File:	Chrome Cache Entry: 68
Category:	dropped
Dump:	chromecache_68.2.dr
ID:	dr_4
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with no line terminators
Entropy:	3.9361804341297555
Encrypted:	false
Ssdeep:	3:DyclXMR+:jlXL
Size:	23
Whitelisted:	false
Reputation:	moderate

Chrome Cache Entry: 69

ASCII text, with very long lines (32065)

downloaded

Details

File:	Chrome Cache Entry: 69
Category:	downloaded
Dump:	chromecache_69.2.dr
ID:	dr_8
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (32065)
Entropy:	5.366055229017455
Encrypted:	false
Ssdeep:	1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2
Size:	85578
Whitelisted:	true
Reputation:	timeout

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\PaymentOnline.html"

Details

Is windows:	true
Is dropped:	false
PID:	4520
Target ID:	0
Parent PID:	3568
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\PaymentOnline.html"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	09:34:50
Date:	28/08/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2008,i,10137650121201936708,14751184556041639990,262144 /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	4928
Target ID:	2
Parent PID:	4520
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2008,i,10137650121201936708,14751184556041639990,262144 /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	09:34:52
Date:	28/08/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

file:///C:/Users/user/Desktop/PaymentOnline.html

https://github.com/twbs/bootstrap/blob/master/LICENSE)

unknown

https://cdn.jsdelivr.net/npm/

unknown

https://dashboard.emailjs.com/admin/account

unknown

https://api.emailjs.com

unknown

https://dashboard.emailjs.com/admin/templates

unknown

https://getbootstrap.com)

unknown

https://cdn.jsdelivr.net/npm/@emailjs/browser@3/dist/email.min.js

151.101.65.229

https://l2.io/ip.js?var=userip

195.80.159.133

https://dashboard.emailjs.com/admin

unknown

Domains

Name

Malicious

jsdelivr.map.fastly.net

151.101.65.229

l2.io

195.80.159.133

Details

Name:	l2.io
IP:	195.80.159.133
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

www.google.com

172.217.16.132

Details

Name:	www.google.com
IP:	172.217.16.132
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

cdn.jsdelivr.net

unknown

Details

Name:	cdn.jsdelivr.net
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

151.101.65.229

jsdelivr.map.fastly.net

United States

192.168.2.4

unknown

239.255.255.250

unknown

Reserved

195.80.159.133

l2.io

France

172.217.16.132

www.google.com

United States

DOM / HTML

URL

Malicious

file:///C:/Users/user/Desktop/PaymentOnline.html

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
PaymentOnline.html

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportPaymentOnline.html

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
PaymentOnline.html