Edit tour

Windows Analysis Report
http://ayeshaaax.github.io/Netflix-Clone

Overview

General Information

Sample URL:	http://ayeshaaax.github.io/Netflix-Clone
Analysis ID:	1527288
Tags:	openphish
Infos:

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Yara detected HtmlPhish64

Phishing site detected (based on favicon image match)

Phishing site detected (based on logo match)

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML title does not match URL

Invalid T&C link found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5940 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2316 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1880,i,5621325372249996298,11128244104133301238,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6516 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://ayeshaaax.github.io/Netflix-Clone" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

HTML

Source	Rule	Description	Author
0.2.id.script.csv	JoeSecurity_HtmlPhish_64	Yara detected HtmlPhish_64	Joe Security
0.1.id.script.csv	JoeSecurity_HtmlPhish_64	Yara detected HtmlPhish_64	Joe Security
0.0.id.script.csv	JoeSecurity_HtmlPhish_64	Yara detected HtmlPhish_64	Joe Security
0.0.pages.csv	JoeSecurity_HtmlPhish_64	Yara detected HtmlPhish_64	Joe Security
0.2.pages.csv	JoeSecurity_HtmlPhish_64	Yara detected HtmlPhish_64	Joe Security
0.1.pages.csv	JoeSecurity_HtmlPhish_64	Yara detected HtmlPhish_64	Joe Security
Click to see the 1 entries

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://ayeshaaax.github.io/Netflix-Clone

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

AI detected phishing page

Source: https://ayeshaaax.github.io/Netflix-Clone/	LLM: Score: 9 Reasons: The brand 'NETFLIX' is a well-known streaming service with a legitimate domain of 'netflix.com'., The URL 'ayeshaaax.github.io' does not match the legitimate domain of Netflix., The use of 'github.io' suggests a GitHub Pages site, which is often used for personal or project pages, not for official brand sites., The URL contains no direct association with Netflix, which is suspicious., The presence of an input field for 'Email Address' on a non-official domain raises concerns about phishing attempts to collect user credentials. DOM: 0.0.pages.csv
Source: https://ayeshaaax.github.io/Netflix-Clone/#login	LLM: Score: 9 Reasons: The brand 'Netflix' is a well-known streaming service with a legitimate domain of 'netflix.com'., The URL 'ayeshaaax.github.io' does not match the legitimate domain of Netflix., The use of 'github.io' suggests a GitHub Pages site, which is not typically used by Netflix for its services., The presence of input fields for 'Email Address' on a non-legitimate domain is a common phishing tactic to collect user credentials., The URL does not contain any direct association with Netflix, indicating a high likelihood of phishing. DOM: 0.1.pages.csv
Source: https://ayeshaaax.github.io/Netflix-Clone/#faq	LLM: Score: 9 Reasons: The brand 'Netflix' is a well-known streaming service with a primary domain of 'netflix.com'., The URL 'ayeshaaax.github.io' does not match the legitimate domain of Netflix., The use of 'github.io' suggests a GitHub Pages site, which is not typically used by Netflix for official pages., The URL contains a personal or non-brand-related subdomain 'ayeshaaax', which is suspicious., The input field asking for an email to create or restart membership is a common phishing tactic to collect user credentials. DOM: 0.2.pages.csv

Yara detected HtmlPhish64

Source: Yara match	File source: 0.2.id.script.csv, type: HTML
Source: Yara match	File source: 0.1.id.script.csv, type: HTML
Source: Yara match	File source: 0.0.id.script.csv, type: HTML
Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML

Phishing site detected (based on favicon image match)

Source: https://ayeshaaax.github.io	Matcher: Template: netflix matched with high similarity
Source: https://ayeshaaax.github.io/Netflix-Clone/	Matcher: Template: netflix matched with high similarity
Source: https://ayeshaaax.github.io/Netflix-Clone/#login	Matcher: Template: netflix matched with high similarity
Source: https://ayeshaaax.github.io/Netflix-Clone/#faq	Matcher: Template: netflix matched with high similarity

Phishing site detected (based on logo match)