Edit tour

Windows Analysis Report
http://flipsnack.com/BA85A977C6F/oct2024/full-view.html

Overview

General Information

Sample URL:	http://flipsnack.com/BA85A977C6F/oct2024/full-view.html
Analysis ID:	1530828
Infos:

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Yara detected HtmlPhish10

Phishing site detected (based on favicon image match)

Phishing site detected (based on logo match)

Phishing site detected (based on shot match)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

Invalid T&C link found

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 3972 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6812 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1940,i,11512900500131067923,630630465562697349,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6348 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://flipsnack.com/BA85A977C6F/oct2024/full-view.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
1.9.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
2.11.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.8.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://flipsnack.com/BA85A977C6F/oct2024/full-view.html

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

AI detected phishing page

Source: https://simplexml.federalinvoice.com/uQ3xo/	LLM: Score: 9 Reasons: The brand 'Microsoft' is a well-known brand with a widely recognized domain 'microsoft.com'., The URL 'simplexml.federalinvoice.com' does not match the legitimate domain of Microsoft., The domain 'federalinvoice.com' is unrelated to Microsoft and could be a potential phishing attempt., The presence of 'simplexml' as a subdomain does not align with Microsoft's typical domain structure., The use of an unrelated domain with a well-known brand name is a common phishing tactic. DOM: 1.8.pages.csv
Source: https://simplexml.federalinvoice.com/uQ3xo/	LLM: Score: 9 Reasons: The brand 'Microsoft' is a well-known brand with a legitimate domain of 'microsoft.com'., The URL 'simplexml.federalinvoice.com' does not match the legitimate domain of Microsoft., The domain 'federalinvoice.com' is unrelated to Microsoft and could be a potential phishing attempt., The presence of an email input field suggests an attempt to collect sensitive information., The use of a subdomain 'simplexml' does not align with Microsoft's typical domain structure. DOM: 1.9.pages.csv
Source: https://simplexml.federalinvoice.com/uQ3xo/#	LLM: Score: 9 Reasons: The brand 'Microsoft' is a well-known brand with a legitimate domain of 'microsoft.com'., The URL 'simplexml.federalinvoice.com' does not match the legitimate domain of Microsoft., The domain 'federalinvoice.com' is unrelated to Microsoft and could be a potential phishing attempt., The presence of 'simplexml' as a subdomain does not provide any legitimate association with Microsoft., The use of an email input field suggests an attempt to collect sensitive information, which is common in phishing sites. DOM: 2.11.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 1.9.pages.csv, type: HTML
Source: Yara match	File source: 2.11.pages.csv, type: HTML
Source: Yara match	File source: 1.8.pages.csv, type: HTML

Phishing site detected (based on favicon image match)

Source: https://federalinvoice.com

Matcher: Template: microsoft matched with high similarity

Phishing site detected (based on logo match)

Source: https://simplexml.federalinvoice.com/uQ3xo/	Matcher: Template: microsoft matched
Source: https://simplexml.federalinvoice.com/uQ3xo/	Matcher: Template: microsoft matched
Source: https://simplexml.federalinvoice.com/uQ3xo/#	Matcher: Template: microsoft matched

Phishing site detected (based on shot match)