Windows Analysis Report
https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/

Overview

General Information

Sample URL: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/
Analysis ID: 1592313
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

AI detected phishing page
Antivirus / Scanner detection for submitted sample
HTML body contains low number of good links
HTML body with high number of embedded images detected
HTML title does not match URL

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

AV Detection

barindex
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/ Avira URL Cloud: detection malicious, Label: phishing

Phishing

barindex
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/ Joe Sandbox AI: Score: 8 Reasons: The brand 'FTX' is a well-known cryptocurrency exchange platform., The URL 'restructuring.rh-kroll.com' does not match the legitimate domain 'ftx.com'., The domain 'rh-kroll.com' does not appear to be directly associated with FTX., The presence of a subdomain 'restructuring' could indicate a specific service or department, but it is not a known subdomain of FTX., The use of a different domain name suggests potential phishing, especially when combined with a well-known brand like FTX. DOM: 1.0.pages.csv
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php Joe Sandbox AI: Score: 8 Reasons: The brand 'FTX' is a well-known cryptocurrency exchange platform., The URL 'restructuring.rh-kroll.com' does not match the legitimate domain 'ftx.com'., The domain 'rh-kroll.com' does not appear to be directly associated with FTX., The presence of a subdomain 'restructuring' could indicate a specific service or department, but it is not a known subdomain of FTX., The URL structure suggests a potential phishing attempt as it does not align with the known domain of the brand. DOM: 2.1.pages.csv
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php Joe Sandbox AI: Score: 8 Reasons: The brand 'FTX' is a well-known cryptocurrency exchange platform., The URL 'restructuring.rh-kroll.com' does not match the legitimate domain 'ftx.com'., The domain 'rh-kroll.com' does not appear to be directly associated with FTX., The presence of a subdomain 'restructuring' could indicate a specific service or department, but it is not a known subdomain of FTX., The URL structure includes multiple segments and does not directly reflect the brand name, which is a common phishing tactic. DOM: 2.2.pages.csv
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php Joe Sandbox AI: Score: 8 Reasons: The brand 'FTX' is a well-known cryptocurrency exchange platform., The URL 'restructuring.rh-kroll.com' does not match the legitimate domain 'ftx.com'., The domain 'rh-kroll.com' does not appear to be directly associated with FTX., The presence of a subdomain 'restructuring' could indicate a specific service or department, but it is not a known subdomain of FTX., The URL structure includes multiple segments and does not clearly indicate a direct association with FTX., The use of a different domain name could be an attempt to impersonate or mislead users into thinking it is associated with FTX. DOM: 2.3.pages.csv
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php Joe Sandbox AI: Score: 8 Reasons: The brand 'FTX' is a well-known cryptocurrency exchange platform., The legitimate domain for FTX is 'ftx.com'., The provided URL 'restructuring.rh-kroll.com' does not match the legitimate domain for FTX., The URL contains multiple subdomains and does not directly relate to FTX, which is suspicious., The domain 'rh-kroll.com' does not have any known association with FTX., The presence of an email input field could be used to harvest credentials, which is a common phishing tactic. DOM: 2.4.pages.csv
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/ HTTP Parser: Number of links: 0
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php HTTP Parser: Number of links: 0
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/ HTTP Parser: Total embedded image size: 40172
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php HTTP Parser: Total embedded image size: 40172
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/ HTTP Parser: Title: Recovery User Login | FTX does not match URL
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php HTTP Parser: Title: Recovery User Login | FTX does not match URL
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/ HTTP Parser: No <meta name="author".. found
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php HTTP Parser: No <meta name="author".. found
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php HTTP Parser: No <meta name="author".. found
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php HTTP Parser: No <meta name="author".. found
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php HTTP Parser: No <meta name="author".. found
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php HTTP Parser: No <meta name="author".. found
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/ HTTP Parser: No <meta name="copyright".. found
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php HTTP Parser: No <meta name="copyright".. found
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php HTTP Parser: No <meta name="copyright".. found
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php HTTP Parser: No <meta name="copyright".. found
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php HTTP Parser: No <meta name="copyright".. found
Source: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.php HTTP Parser: No <meta name="copyright".. found
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /scheduled-claims/login-desktop.php/ HTTP/1.1Host: restructuring.rh-kroll.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /jquery-3.7.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://restructuring.rh-kroll.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /jquery-3.7.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /scheduled-claims/login-desktop.php/code-desktop.php HTTP/1.1Host: restructuring.rh-kroll.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /scheduled-claims/login-desktop.php/code-desktop.php HTTP/1.1Host: restructuring.rh-kroll.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /scheduled-claims/login-desktop.php/code-desktop.php HTTP/1.1Host: restructuring.rh-kroll.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /scheduled-claims/login-desktop.php/code-desktop.php HTTP/1.1Host: restructuring.rh-kroll.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /scheduled-claims/login-desktop.php/code-desktop.php HTTP/1.1Host: restructuring.rh-kroll.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /scheduled-claims/login-desktop.php/code-desktop.php HTTP/1.1Host: restructuring.rh-kroll.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/code-desktop.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: restructuring.rh-kroll.com
Source: global traffic DNS traffic detected: DNS query: code.jquery.com
Source: unknown HTTP traffic detected: POST /scheduled-claims/login-desktop.php/ HTTP/1.1Host: restructuring.rh-kroll.comConnection: keep-aliveContent-Length: 26Cache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1Origin: https://restructuring.rh-kroll.comContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: chromecache_57.2.dr String found in binary or memory: https://code.jquery.com/jquery-3.7.1.min.js
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: classification engine Classification label: mal56.phis.win@16/7@10/7
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1832 --field-trial-handle=1956,i,15969681716738809597,4299525528950541004,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://restructuring.rh-kroll.com/scheduled-claims/login-desktop.php/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1832 --field-trial-handle=1956,i,15969681716738809597,4299525528950541004,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs