Edit tour

Windows Analysis Report
https://cavotec-au.sharefile.com/public/share/web-1271a93971714a91

Overview

General Information

Sample URL:	https://cavotec-au.sharefile.com/public/share/web-1271a93971714a91
Analysis ID:	1575750
Infos:

Detection

HTMLPhisher

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish10

AI detected landing page (webpage, office document or email)

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7044 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6416 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1936,i,17948422447379762883,7660547888404076553,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6908 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cavotec-au.sharefile.com/public/share/web-1271a93971714a91" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_354	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTML

Source	Rule	Description	Author	Strings
3.7.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish10

Source: Yara match	File source: 3.7.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_354, type: DROPPED

AI detected landing page (webpage, office document or email)

Source: https://cavotec-au.sharefile.com/share/view/1271a93971714a91

Joe Sandbox AI: Page contains button: 'Preview or Download' Source: '2.6.pages.csv'

Source: https://victoryacademytc.com/common_oauth2_v20_authorizeclientid_4765445b32c649b0/aspx.htm

HTTP Parser: Number of links: 0

Source: https://cavotec-au.sharefile.com/share/view/1271a93971714a91

HTTP Parser: Base64 decoded: {"version":3,"sources":["webpack://./node_modules/react-loading-skeleton/dist/skeleton.css"],"names":[],"mappings":"AAAA;EACE;IACE,2BAA2B;EAC7B;AACF;;AAEA;EACE,qBAAqB;EACrB,0BAA0B;EAC1B,0BAA0B;EAC1B,6BAA6B;EAC7B,+BAA+B,EAAE,qBAAqB;;EAEtD,mCAAmC;;EAEnC,WAA...

Source: https://victoryacademytc.com/common_oauth2_v20_authorizeclientid_4765445b32c649b0/aspx.htm	HTTP Parser: No favicon
Source: https://s7ol.lomifor.ru/oONm9/#Tasdfasdfa@wp.pl	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49862 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic	DNS traffic detected: DNS query: cavotec-au.sharefile.com
Source: global traffic	DNS traffic detected: DNS query: 0093b71e39a6.us-east-1.sdk.awswaf.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: 0093b71e39a6.11de9b12.us-east-1.token.awswaf.com
Source: global traffic	DNS traffic detected: DNS query: app.launchdarkly.com
Source: global traffic	DNS traffic detected: DNS query: cavotec-au.sf-api.com
Source: global traffic	DNS traffic detected: DNS query: citrix-sharefile-content.customer.pendo.io
Source: global traffic	DNS traffic detected: DNS query: piletfeed-cdn.sharefile.io
Source: global traffic	DNS traffic detected: DNS query: o49063.ingest.sentry.io
Source: global traffic	DNS traffic detected: DNS query: js-agent.newrelic.com
Source: global traffic	DNS traffic detected: DNS query: events.launchdarkly.com
Source: global traffic	DNS traffic detected: DNS query: bam.nr-data.net
Source: global traffic	DNS traffic detected: DNS query: citrix-sharefile-data.customer.pendo.io
Source: global traffic	DNS traffic detected: DNS query: sf-cv.sharefile.com
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: wordonline.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: victoryacademytc.com
Source: global traffic	DNS traffic detected: DNS query: s7ol.lomifor.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: amcdn.msftauth.net

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1936,i,17948422447379762883,7660547888404076553,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cavotec-au.sharefile.com/public/share/web-1271a93971714a91"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1936,i,17948422447379762883,7660547888404076553,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Name	IP	Active	Malicious	Reputation
fastly-tls12-bam.nr-data.net	162.247.243.29	true	false	high
0093b71e39a6.us-east-1.sdk.awswaf.com	18.165.220.77	true	false	high
cavotec-au.sf-api.com	13.248.193.251	true	false	unknown
js-agent.newrelic.com	162.247.243.39	true	false	high
events.launchdarkly.com	34.233.215.113	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
sf-cv.sharefile.com	13.248.193.251	true	false	high
piletfeed-cdn.sharefile.io	216.137.52.33	true	false	high
0093b71e39a6.11de9b12.us-east-1.token.awswaf.com	108.158.75.28	true	false	high
wac-0003.wac-msedge.net	52.108.8.12	true	false	unknown
s7ol.lomifor.ru	104.21.33.6	true	false	unknown
51.138.111.34.bc.googleusercontent.com	34.111.138.51	true	false	high
code.jquery.com	151.101.66.137	true	false	high
o49063.ingest.sentry.io	34.120.195.249	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
cavotec-au.sharefile.com	13.248.193.251	true	false	unknown
challenges.cloudflare.com	104.18.94.41	true	false	high
victoryacademytc.com	192.185.150.180	true	false	unknown
www.google.com	142.250.181.68	true	false	high
api.ipify.org	172.67.74.152	true	false	high
85.204.107.34.bc.googleusercontent.com	34.107.204.85	true	false	unknown
app.launchdarkly.com	unknown	unknown	false	high
citrix-sharefile-content.customer.pendo.io	unknown	unknown	false	high
bam.nr-data.net	unknown	unknown	false	high
wordonline.nel.measure.office.net	unknown	unknown	false	unknown
citrix-sharefile-data.customer.pendo.io	unknown	unknown	false	unknown
amcdn.msftauth.net	unknown	unknown	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
108.158.75.28	0093b71e39a6.11de9b12.us-east-1.token.awswaf.com	United States	16509	AMAZON-02US	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
151.101.130.217	unknown	United States	54113	FASTLYUS	false
51.11.192.49	unknown	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.126.36.32	unknown	United States	20940	AKAMAI-ASN1EU	false
52.108.9.12	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.248.193.251	cavotec-au.sf-api.com	United States	16509	AMAZON-02US	false
216.137.52.33	piletfeed-cdn.sharefile.io	United States	8014	BATELNETBS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
172.217.21.35	unknown	United States	15169	GOOGLEUS	false
64.233.162.84	unknown	United States	15169	GOOGLEUS	false
162.247.243.39	js-agent.newrelic.com	United States	13335	CLOUDFLARENETUS	false
172.217.17.42	unknown	United States	15169	GOOGLEUS	false
34.233.215.113	events.launchdarkly.com	United States	14618	AMAZON-AESUS	false
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.107.204.85	85.204.107.34.bc.googleusercontent.com	United States	15169	GOOGLEUS	false
172.217.19.238	unknown	United States	15169	GOOGLEUS	false
104.26.12.205	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.33.6	s7ol.lomifor.ru	United States	13335	CLOUDFLARENETUS	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
23.32.238.227	unknown	United States	2828	XO-AS15US	false
52.108.8.12	wac-0003.wac-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.108.186.5	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.165.220.77	0093b71e39a6.us-east-1.sdk.awswaf.com	United States	3	MIT-GATEWAYSUS	false
216.58.208.234	unknown	United States	15169	GOOGLEUS	false
34.111.138.51	51.138.111.34.bc.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.181.106	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
162.247.243.29	fastly-tls12-bam.nr-data.net	United States	13335	CLOUDFLARENETUS	false
192.185.150.180	victoryacademytc.com	United States	46606	UNIFIEDLAYER-AS-1US	false
216.137.52.123	unknown	United States	8014	BATELNETBS	false
76.223.1.166	unknown	United States	16509	AMAZON-02US	false
34.120.195.249	o49063.ingest.sentry.io	United States	15169	GOOGLEUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575750
Start date and time:	2024-12-16 09:45:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://cavotec-au.sharefile.com/public/share/web-1271a93971714a91
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.phis.win@23/106@78/268

Input	Output
URL: https://cavotec-au.sharefile.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://cavotec-au.sharefile.com
URL: https://cavotec-au.sharefile.com/public/share/web-... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be primarily focused on setting and managing session storage values, which is a common practice for web applications. While it includes some feature flags and configuration settings, there are no clear indicators of high-risk behaviors such as dynamic code execution, data exfiltration, or malicious redirects. The script seems to be part of a legitimate web application functionality." }
try { sessionStorage.setItem('useLanguage', 'en'); sessionStorage.setItem("apiDomain", "sf-api.com"); sessionStorage.setItem("ioDomain", "sharefile.io") sessionStorage.removeItem("Branch"); sessionStorage.removeItem("OAuthToken"); var pendoModel = { apiKey: "74b07336-7560-45fc-7cd1-95032a784d52" }; sessionStorage.setItem("Pendo", JSON.stringify(pendoModel)); sessionStorage.setItem("LDClientId_CCC", "5f33f5d44f29ea099db90d2a"); window.SF_LDUserFlagState = {"enable_task_aggregator_pilet":true,"webapp-client-portal":false,"should-check-admin-sso-role":false,"e-commerce-integration-test-flag":false,"enable-dc-pilet":true,"decouple-sf-from-ws-remove-trial-from-cc":false,"support-cloud-native-multipart-upload":true,"enable_plg_test_page":false,"enable-on-prem-edit-from-webapp-using-wopi-plus-service":false,"email-verification-policy-start":"2053-01-15T00:00:00.000-00:00","enable-storage-enforcement":true,"test-feature-flag-removal":false,"enable-check-if-authorized-to-get-apps":true,"enable-docreq-display-task-duedates":true,"podio_apps":false,"enableresourcegenpiletdrlgenbetatag":true,"webapp-client-my-files":false,"passiveexpireitems-max-items-to-process":5000,"orderfulfillment-bot-sends-admin-sf-account-email-activation-reminders":true,"use-new-branding-for-auth":true,"webapp-get-thread-pool-min":1024,"hronboard":true,"provide-explicit-jwt-algorithm-on-decode-in-oauth-2-server":false,"disable-random-db-call-logic":true,"enable_partner_profile_page":true,"enable_audit_collector":true,"content-viewer-uses-esign-pilet-actions":true,"upload_document_notification":false,"dev-aanp":false,"enable-drl-approve-many-tasks":true,"enable-use-new-hash-algorithm":false,"appointment_request_form":false,"enable-packages-pilet":true,"use-create-user-for-folder-api":true,"enable-project-atlas-sfdc-integration":true,"subcontractor_onboarding":true,"Enable_Folder_Support_In_FBP":true,"admin-sf-account-email-activation-reminder":false,"enable_unified_search_bar":false,"enable-recent-searches-in-search-bar":true,"rl_enable_save_as_template_extension":true,"tax_manager":false,"WebAppCspHeaderUpdates":false,"display-squelch-link-feature-flag":true,"update-order-fulfillment-bot-to-set-line-item-success":true,"use-new-login-flow-which-is-done-on-new-auth-sharefile-io-side":false,"enable-multi-account-penetration-threat":true,"webapp-show-prospective-clients":false,"u_s__individual_tax_return_10221":false,"disable_project_vertiuserzation":true,"webapp-should-check-sharefileio":false,"number-of-parallel-chunks-for-cloud-native-multipart-upload":16,"enable-pilet-branch-testing-ui":false,"enable-captcha-for-require-user-info-shares":true,"Allow_Admin_To_Enable_Microsoft_Social_Login":false,"enable-support-for-vdr-accounts":true,"mk-denial-screen-first-name-last-name":false,"specific-account-cancellation-limit-per-run":2500,"enable_template_editing":true,"enable-bot-control-on-public-shares":true,"real_estate_solution":false,"future-orders-should-be-reprocessed-by-future-fulfillment-order-processor":true,"enable_personal_connection_manager":true,"enable-email-verification-for-manage-employee-admin":false,"enable-save-as-template-extension":true,"enable_esign_signer_route":true,"enable-point-in-time-persistent-shares":true,"enable-projects-save-as-template-extension":true,"auto-enable-workspace-new-ccc":false,"enable-otp-feature-for-hybris-accounts-in-webapp":true,"enable-agreements-feature-vdr":false,"enable-account-flips-audit-only":false,"is-agreements-feature-enabled":true,"webapp-esign-generic-context-action-slot":true,"enable-new-create-project-modal":true,"self_service_hipaa_settings":true,"enable-domino-debug-helper":false,"reencrypt-legacy-extenstions-for-cloud-native-download":true,"edit_billing_info_use_pilet":true,"display-retain-accounts-link":false,"SFAuth_Should_Move_Terms_To_WebApp":true,"client-my-files":false,"enable-automated-workflows-vdr":false,"esign-pilet-uses-auth-proxy":true,"enable-
URL: https://cavotec-au.sharefile.com/public/share/web-... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This code snippet appears to be a benign attempt to store a user's language preference in the session storage. It does not exhibit any high-risk behaviors, such as dynamic code execution, data exfiltration, or suspicious redirects. The use of session storage is a common and legitimate practice for maintaining user preferences across page loads. While the incomplete nature of the code snippet makes it difficult to provide a comprehensive assessment, the observed behavior suggests a low-risk scenario." }
try { sessionStorage.setItem('useLanguage', '
URL: https://cavotec-au.sharefile.com/public/share/web-... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be related to the New Relic performance monitoring service. It initializes the New Relic agent and sets up various configurations, including enabling distributed tracing, privacy settings, and a deny list for the 'bam.nr-data.net' domain. This behavior is typical of a legitimate performance monitoring tool and does not exhibit any high-risk indicators. The script seems to be focused on collecting and reporting performance data, which is a common and expected practice for web applications. Overall, this script poses a low risk and is likely part of a legitimate monitoring solution." }
;window.NREUM\|\|(NREUM={});NREUM.init={distributed_tracing:{enabled:true},privacy:{cookies_enabled:true},ajax:{deny_list:["bam.nr-data.net"]}}; ;NREUM.loader_config={accountID:"294030",trustKey:"3347059",agentID:"30142649",licenseKey:"fd14b65b5e",applicationID:"594432325"} ;NREUM.info={beacon:"bam.nr-data.net",errorBeacon:"bam.nr-data.net",licenseKey:"fd14b65b5e",applicationID:"594432325",sa:1} window.NREUM\|\|(NREUM={}),__nr_require=function(t,e,n){function r(n){if(!e[n]){var o=e[n]={exports:{}};t[n][0].call(o.exports,function(e){var o=t[n][1][e];return r(o\|\|e)},o,o.exports)}return e[n].exports}if("function"==typeof __nr_require)return __nr_require;for(var o=0;o<n.length;o++)r(n[o]);return r}({1:[function(t,e,n){function r(t){try{s.console&&console.log(t)}catch(e){}}var o,i=t("ee"),a=t(31),s={};try{o=localStorage.getItem("__nr_flags").split(","),console&&"function"==typeof console.log&&(s.console=!0,o.indexOf("dev")!==-1&&(s.dev=!0),o.indexOf("nr_dev")!==-1&&(s.nrDev=!0))}catch(c){}s.nrDev&&i.on("internal-error",function(t){r(t.stack)}),s.dev&&i.on("fn-err",function(t,e,n){r(n.stack)}),s.dev&&(r("NR AGENT IN DEVELOPMENT MODE"),r("flags: "+a(s,function(t,e){return t}).join(", ")))},{}],2:[function(t,e,n){function r(t,e,n,r,s){try{l?l-=1:o(s\|\|new UncaughtException(t,e,n),!0)}catch(f){try{i("ierr",[f,c.now(),!0])}catch(d){}}return"function"==typeof u&&u.apply(this,a(arguments))}function UncaughtException(t,e,n){this.message=t\|\|"Uncaught error with no additional information",this.sourceURL=e,this.line=n}function o(t,e){var n=e?null:c.now();i("err",[t,n])}var i=t("handle"),a=t(32),s=t("ee"),c=t("loader"),f=t("gos"),u=window.onerror,d=!1,p="nr@seenError";if(!c.disabled){var l=0;c.features.err=!0,t(1),window.onerror=r;try{throw new Error}catch(h){"stack"in h&&(t(14),t(13),"addEventListener"in window&&t(7),c.xhrWrappable&&t(15),d=!0)}s.on("fn-start",function(t,e,n){d&&(l+=1)}),s.on("fn-err",function(t,e,n){d&&!n[p]&&(f(n,p,function(){return!0}),this.thrown=!0,o(n))}),s.on("fn-end",function(){d&&!this.thrown&&l>0&&(l-=1)}),s.on("internal-error",function(t){i("ierr",[t,c.now(),!0])})}},{}],3:[function(t,e,n){var r=t("loader");r.disabled\|\|(r.features.ins=!0)},{}],4:[function(t,e,n){function r(){U++,L=g.hash,this[u]=y.now()}function o(){U--,g.hash!==L&&i(0,!0);var t=y.now();this[h]=~~this[h]+t-this[u],this[d]=t}function i(t,e){E.emit("newURL",[""+g,e])}function a(t,e){t.on(e,function(){this[e]=y.now()})}var s="-start",c="-end",f="-body",u="fn"+s,d="fn"+c,p="cb"+s,l="cb"+c,h="jsTime",m="fetch",v="addEventListener",w=window,g=w.location,y=t("loader");if(w[v]&&y.xhrWrappable&&!y.disabled){var x=t(11),b=t(12),E=t(9),R=t(7),O=t(14),T=t(8),S=t(15),P=t(10),M=t("ee"),C=M.get("tracer"),N=t(23);t(17),y.features.spa=!0;var L,U=0;M.on(u,r),b.on(p,r),P.on(p,r),M.on(d,o),b.on(l,o),P.on(l,o),M.buffer([u,d,"xhr-resolved"]),R.buffer([u]),O.buffer(["setTimeout"+c,"clearTimeout"+s,u]),S.buffer([u,"new-xhr","send-xhr"+s]),T.buffer([m+s,m+"-done",m+f+s,m+f+c]),E.buffer(["newURL"]),x.buffer([u]),b.buffer(["propagate",p,l,"executor-err","resolve"+s]),C.buffer([u,"no-"+u]),P.buffer(["new-jsonp","cb-start","jsonp-error","jsonp-end"]),a(T,m+s),a(T,m+"-done"),a(P,"new-jsonp"),a(P,"jsonp-end"),a(P,"cb-start"),E.on("pushState-end",i),E.on("replaceState-end",i),w[v]("hashchange",i,N(!0)),w[v]("load",i,N(!0)),w[v]("popstate",function(){i(0,U>1)},N(!0))}},{}],5:[function(t,e,n){function r(){var t=new PerformanceObserver(function(t,e){var n=t.getEntries();s(v,[n])});try{t.observe({entryTypes:["resource"]})}catch(e){}}function o(t){if(s(v,[window.performance.getEntriesByType(w)]),window.performance["c"+p])try{window.performance[h](m,o,!1)}catch(t){}else try{window.performance[h]("webkit"+m,o,!1)}catch(t){}}function i(t){}if(window.performance&&window.performance.timing&&window.performance.getEntriesByType){var a=t("ee"),s=t("handle"),c=t(14),f=t(13),u=t(6),d=t(23),p="learResourceTimings",l="addEventListener",h="removeEventListener",m="resourcetimingbufferfull",v="
URL: https://0093b71e39a6.11de9b12.us-east-1.token.awsw... Model: Joe Sandbox AI	{ "risk_score": 5, "reasoning": "The provided JavaScript snippet contains a mix of behaviors that require further review. While it includes some potentially benign functionality like analytics and telemetry, it also exhibits moderate-risk indicators such as external data transmission and aggressive DOM manipulation. Additionally, the presence of obfuscated code and references to suspicious domains raises some concerns. Overall, the script requires closer inspection to determine its true intent and potential impact." }
var a0_0x53a8=['bind','SafeBag','safeBags','map','element','touchstart','wheel','warn','canvas','10405jtEuNh','contentInfo','1001','fullMessageLength','Amadeus','createKeyPairGenerationState','arr','certificatePolicies','Cannot\x20read\x20password-based-encryption\x20algorithm\x20parameters.\x20ASN.1\x20object\x20is\x20not\x20a\x20supported\x20EncryptedPrivateKeyInfo.','authorityInfoAccess','Proxy\x203','writeOffset','ENCRYPTED','client\x20finished','getRawHostname','EncryptedData','extractWhich','Comic\x20Sans\x20MS','4oSNJWx','2.5.29.31','pBits','1.2.840.113549.1.7.1','decryptPrivateKeyInfo','getBerValueLength','BrowalliaUPC','2.5.29.1','104hFXINP','Algerian','ax-plugin','as-plugin','pathLenConstraint','SHA-384','label','NO_LEVEL_CHECK','FWCIMCompoundCollector','ComponentID','_hashBlock','mmmmmmmmmmlli','Latha','Lucida\x20Sans\x20Typewriter','Unsupported\x20certificate\x20type,\x20only\x20X.509\x20supported.','mac_key_length','userinfoWithAt','[object\x20Array]','CanvasCollector','lastCollection','Cannot\x20read\x20encrypted\x20private\x20key.\x20ASN.1\x20object\x20is\x20not\x20a\x20supported\x20EncryptedPrivateKeyInfo.','Certificate\x20is\x20not\x20trusted.','registerWorker','decode_rsa_oaep','1.2.840.113549.2.10','notBefore','Arno\x20Pro\x20Smbd\x20Caption','generateSubHashTable','inline','publicKey','blockLength','getLowestSetBit','Access\x20denied.','keyCycles','PKCS#12\x20authSafe\x20content\x20data\x20is\x20not\x20an\x20OCTET\x20STRING.','tagClass','Kozuka\x20Gothic\x20Pr6N\x20H','cuts','2.3.0','UTF8','idleCallbackCalled','blockSize','RSA\x20PRIVATE\x20KEY','stepKeyPairGenerationState','Proxy\x208','arguments','Could\x20not\x20convert\x20public\x20key\x20from\x20PEM;\x20PEM\x20is\x20encrypted.','prepareHeartbeatRequest','UNMASKED_RENDERER_WEBGL','cache','Attribute\x20type\x20not\x20specified.','Cambria','from','phi','transform3d','publicKeyToRSAPublicKeyPem','createHistogram','timeout','TOUCH_EVENT','1.2.840.113549.2.9','857wGMIon','telemetryProfilerCallCount','cfb','.{1,','globalCompositeOperation','byteValue','isPrivate','Kozuka\x20Gothic\x20Pro\x20B',']\x20Expected\x20type\x20\x22','next_interval','title','BigInteger','observe','default','firstReport','88000','pkcs5','Copperplate\x20Gothic\x20Light','getTime','ssh','recipients','negate','CertificationRequestInfo.subject','642hulHoa','input[type=\x22phone\x22]','ops','Malgun\x20Gothic','sign','https://www.amazon.com/','trailer','verifyClient','__webdriver_script_fn','fillWithByte','WebStorageBuffer','ShockwaveFlash.ShockwaveFlash','objsign','RSAPublicKey.exponent','MT\x20Extra','fwcim-caps','fragment','IA5STRING','2.5.4.13','Poor\x20Richard','macFunction','RSAPrivateKey.privateExponent','setPublicKey','ContentInfo','macKey','handleClientHello','1.2.840.113549.2.11','TelemetryNumberOfFormFields','EncryptedContentInfo','1229103SWHMUP','sha1','toUTCString','Helvetica','EncryptedContentInfo.contentType','generateKeyPairSync','61099YOlOoK','collector','Invalid\x20SHA-512\x20algorithm:\x20','Message\x20is\x20too\x20long\x20to\x20encrypt.','Goudy\x20Stout','_op','__awaiter','getAlgorithm','363hRNeEp','ENCRYPTED\x20PRIVATE\x20KEY','pbkdf2Sync','logMessage','Could\x20not\x20encrypt\x20record.','sha512-256','NavigatorPluginCollector','elCaptcha','certificationRequestFromAsn1','PBES2Algorithms.keyDerivationFunc','Profiler.stop()\x20is\x20unimplemented!','prepareStandard','6xZckvR','webCryptoCapabilities','bindEventCycleTelemetry','normalizeDntValue','setItem','encodeUtf8','white','givenName','listCaptchaB','SupportedVersions','timeoutMs','Auto','keyWasPressed','utf16','us-east-1','Dnt','rsapss.saltLength','privateKey','rsapss.saltLength.saltLength','1.2.840.113549.1.9.20','handleAlert','Aparajita','detachEvent','SignalAcquisitionTime','Swis721\x20LtCn\x20BT','fillString','sha1WithRSAEncryption','Encoded\x20message\x20does\x20not\x20end\x20in\x200xBC.','1.3.6.1.4.1.311.60.2.1.3','setUint8','Could\x20not\x20compress\x20record.','removeChild','__generator','testContainer','secure','ex
URL: https://piletfeed-cdn.sharefile.io/sharefile-web/s... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "This script appears to be a part of a larger web application, likely related to file sharing or user actions. It imports several modules from the '@citrite/citrix-ui' library, which suggests legitimate functionality. However, the use of the 'System.register' syntax and the presence of the 'cancelToken' and 'signal' handling indicate some potentially aggressive or defensive behavior that requires further review. Overall, the script exhibits a moderate risk level and should be analyzed in the context of the larger application." }
//@pilet v:2(webpackChunkpr_sharefiledevuseractionspilet,{"@citrite/citrix-ui@25.46.0":"citrite-citrix-ui.js"}) System.register(["@citrite/citrix-ui@25.46.0","react","react-router"],(function(e,t){var r={},n={},o={};return{setters:[function(e){r.confirmModal=e.confirmModal,r.notifyError=e.notifyError,r.notifySuccess=e.notifySuccess,r.warningConfirmModal=e.warningConfirmModal},function(e){n.createElement=e.createElement,n["default"]=e["default"]},function(e){o.useHistory=e.useHistory}],execute:function(){e((()=>{var e={9669:(e,t,r)=>{e.exports=r(1609)},5448:(e,t,r)=>{"use strict";var n=r(4867),o=r(6026),i=r(4372),s=r(5327),a=r(4097),u=r(4109),c=r(7985),l=r(7874),f=r(2648),d=r(644),p=r(205);e.exports=function(e){return new Promise((function(t,r){var h,g=e.data,m=e.headers,v=e.responseType;function y(){e.cancelToken&&e.cancelToken.unsubscribe(h),e.signal&&e.signal.removeEventListener("abort",h)}n.isFormData(g)&&n.isStandardBrowserEnv()&&delete m["Content-Type"];var b=new XMLHttpRequest;if(e.auth){var _=e.auth.username\|\|"",w=e.auth.password?unescape(encodeURIComponent(e.auth.password)):"";m.Authorization="Basic "+btoa(_+":"+w)}var k=a(e.baseURL,e.url);function S(){if(b){var n="getAllResponseHeaders"in b?u(b.getAllResponseHeaders()):null,i={data:v&&"text"!==v&&"json"!==v?b.response:b.responseText,status:b.status,statusText:b.statusText,headers:n,config:e,request:b};o((function(e){t(e),y()}),(function(e){r(e),y()}),i),b=null}}if(b.open(e.method.toUpperCase(),s(k,e.params,e.paramsSerializer),!0),b.timeout=e.timeout,"onloadend"in b?b.onloadend=S:b.onreadystatechange=function(){b&&4===b.readyState&&(0!==b.status\|\|b.responseURL&&0===b.responseURL.indexOf("file:"))&&setTimeout(S)},b.onabort=function(){b&&(r(new f("Request aborted",f.ECONNABORTED,e,b)),b=null)},b.onerror=function(){r(new f("Network Error",f.ERR_NETWORK,e,b,b)),b=null},b.ontimeout=function(){var t=e.timeout?"timeout of "+e.timeout+"ms exceeded":"timeout exceeded",n=e.transitional\|\|l;e.timeoutErrorMessage&&(t=e.timeoutErrorMessage),r(new f(t,n.clarifyTimeoutError?f.ETIMEDOUT:f.ECONNABORTED,e,b)),b=null},n.isStandardBrowserEnv()){var x=(e.withCredentials\|\|c(k))&&e.xsrfCookieName?i.read(e.xsrfCookieName):undefined;x&&(m[e.xsrfHeaderName]=x)}"setRequestHeader"in b&&n.forEach(m,(function(e,t){void 0===g&&"content-type"===t.toLowerCase()?delete m[t]:b.setRequestHeader(t,e)})),n.isUndefined(e.withCredentials)\|\|(b.withCredentials=!!e.withCredentials),v&&"json"!==v&&(b.responseType=e.responseType),"function"==typeof e.onDownloadProgress&&b.addEventListener("progress",e.onDownloadProgress),"function"==typeof e.onUploadProgress&&b.upload&&b.upload.addEventListener("progress",e.onUploadProgress),(e.cancelToken\|\|e.signal)&&(h=function(e){b&&(r(!e\|\|e&&e.type?new d:e),b.abort(),b=null)},e.cancelToken&&e.cancelToken.subscribe(h),e.signal&&(e.signal.aborted?h():e.signal.addEventListener("abort",h))),g\|\|(g=null);var O=p(k);O&&-1===["http","https","file"].indexOf(O)?r(new f("Unsupported protocol "+O+":",f.ERR_BAD_REQUEST,e)):b.send(g)}))}},1609:(e,t,r)=>{"use strict";var n=r(4867),o=r(1849),i=r(321),s=r(7185);var a=function u(e){var t=new i(e),r=o(i.prototype.request,t);return n.extend(r,i.prototype,t),n.extend(r,t),r.create=function(t){return u(s(e,t))},r}(r(5546));a.Axios=i,a.CanceledError=r(644),a.CancelToken=r(4972),a.isCancel=r(6502),a.VERSION=r(7288).version,a.toFormData=r(7675),a.AxiosError=r(2648),a.Cancel=a.CanceledError,a.all=function(e){return Promise.all(e)},a.spread=r(8713),a.isAxiosError=r(6268),e.exports=a,e.exports["default"]=a},4972:(e,t,r)=>{"use strict";var n=r(644);function o(e){if("function"!=typeof e)throw new TypeError("executor must be a function.");var t;this.promise=new Promise((function(e){t=e}));var r=this;this.promise.then((function(e){if(r._listeners){var t,n=r._listeners.length;for(t=0;t<n;t++)r._listeners[t](e);r._listeners=null}})),this.promise.then=function(e){var t,n=new Promise((function(e){r.subscribe(e),t=e})).then(e);return n.cancel=function(){r.unsubscribe
URL: https://piletfeed-cdn.sharefile.io/sharefile-web/s... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a module loader and does not contain any high-risk indicators. It uses standard module loading techniques and does not exhibit behaviors associated with malicious scripts, such as dynamic code execution, data exfiltration, or redirects to suspicious domains. The code seems to be part of a legitimate web application and is likely used for loading dependencies and managing the application's structure. While the code could be improved in terms of transparency and potentially outdated practices, it does not pose a significant security risk." }
//@pilet v:2(webpackChunkpr_sharefiledevremediationpilet,{"@citrite/citrix-ui@25.46.0":"citrite-citrix-ui.js"}) System.register(["@citrite/citrix-ui@25.46.0","@sharefiledev/antd-config","antd","react","tslib"],(function(e,t){var r={},n={},o={},a={},i={};return{setters:[function(e){r.notifyError=e.notifyError,r.notifyInfo=e.notifyInfo,r.notifySuccess=e.notifySuccess},function(e){n.AntDConfigProvider=e.AntDConfigProvider,n.colorPalette=e.colorPalette},function(e){o.Button=e.Button,o.Card=e.Card,o.Col=e.Col,o.Divider=e.Divider,o.Flex=e.Flex,o.Modal=e.Modal,o.Row=e.Row,o.Space=e.Space,o.Switch=e.Switch,o.Tooltip=e.Tooltip,o.Typography=e.Typography,o.theme=e.theme},function(e){a.Fragment=e.Fragment,a.createContext=e.createContext,a.createElement=e.createElement,a.default=e.default,a.forwardRef=e.forwardRef,a.useContext=e.useContext,a.useEffect=e.useEffect,a.useRef=e.useRef,a.useState=e.useState},function(e){i.__awaiter=e.__awaiter}],execute:function(){e((()=>{var e,l,s={8569:(e,t,r)=>{"use strict";r.d(t,{B:()=>a,t:()=>i});var n=function(){throw new Error("Logger not setup")},o={logError:n,logInfo:n,setLoggingTags:n};function a(e){o=e}function i(){return o}},126:(e,t,r)=>{const n=r(358).y;t.w=function(e){if(e\|\|(e=1),!r.y.meta\|\|!r.y.meta.url)throw console.error("__system_context__",r.y),Error("systemjs-webpack-interop was provided an unknown SystemJS context. Expected context.meta.url, but none was provided");r.p=n(r.y.meta.url,e)}},358:(e,t,r)=>{function n(e,t){var r=document.createElement("a");r.href=e;for(var n="/"===r.pathname[0]?r.pathname:"/"+r.pathname,o=0,a=n.length;o!==t&&a>=0;){"/"===n[--a]&&o++}if(o!==t)throw Error("systemjs-webpack-interop: rootDirectoryLevel ("+t+") is greater than the number of directories ("+o+") in the URL path "+e);var i=n.slice(0,a+1);return r.protocol+"//"+r.host+i}t.y=n;var o=Number.isInteger\|\|function(e){return"number"==typeof e&&isFinite(e)&&Math.floor(e)===e}},3099:e=>{"use strict";e.exports=r},4634:e=>{"use strict";e.exports=n},4876:e=>{"use strict";e.exports=o},4726:e=>{"use strict";e.exports=a},8109:e=>{"use strict";e.exports=i}},u={};function d(e){var t=u[e];if(void 0!==t)return t.exports;var r=u[e]={exports:{}};return s[e](r,r.exports,d),r.exports}d.m=s,d.y=t,d.n=e=>{var t=e&&e.__esModule?()=>e.default:()=>e;return d.d(t,{a:t}),t},d.d=(e,t)=>{for(var r in t)d.o(t,r)&&!d.o(e,r)&&Object.defineProperty(e,r,{enumerable:!0,get:t[r]})},d.f={},d.e=e=>Promise.all(Object.keys(d.f).reduce(((t,r)=>(d.f[r](e,t),t)),[])),d.u=e=>({366:"eded7517",673:"c91f103b"}[e]+".js"),d.miniCssF=e=>e+".eded75.css",d.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window)return window}}(),d.o=(e,t)=>Object.prototype.hasOwnProperty.call(e,t),e={},l="pr_sharefiledevremediationpilet:",d.l=(t,r,n,o)=>{if(e[t])e[t].push(r);else{var a,i;if(void 0!==n)for(var s=document.getElementsByTagName("script"),u=0;u<s.length;u++){var c=s[u];if(c.getAttribute("src")==t\|\|c.getAttribute("data-webpack")==l+n){a=c;break}}a\|\|(i=!0,(a=document.createElement("script")).charset="utf-8",a.timeout=120,d.nc&&a.setAttribute("nonce",d.nc),a.setAttribute("data-webpack",l+n),a.src=t),e[t]=[r];var f=(r,n)=>{a.onerror=a.onload=null,clearTimeout(p);var o=e[t];if(delete e[t],a.parentNode&&a.parentNode.removeChild(a),o&&o.forEach((e=>e(n))),r)return r(n)},p=setTimeout(f.bind(null,void 0,{type:"timeout",target:a}),12e4);a.onerror=f.bind(null,a.onerror),a.onload=f.bind(null,a.onload),i&&document.head.appendChild(a)}},d.r=e=>{"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},d.p="https://localhost:4321/",(()=>{if("undefined"!=typeof document){var e=e=>new Promise(((t,r)=>{var n=d.miniCssF(e),o=d.p+n;if(((e,t)=>{for(var r=document.getElementsByTagName("link"),n=0;n<r.length;n++){var o=(i=r[n]).getAttribute("data-href")\|\|i.getAttribute("href");if("stylesheet"===i.rel&&
URL: https://piletfeed-cdn.sharefile.io/sharefile-web/s... Model: Joe Sandbox AI	```json { "risk_score": 2, "reasoning": "The script uses XMLHttpRequest for data transmission, which is a moderate-risk indicator. However, there is no evidence of dynamic code execution, data exfiltration, or interaction with suspicious domains. The script appears to be part of a legitimate application, likely for handling API requests." }
//@pilet v:2(webpackChunkpr_sharefiledevworkflowspilet,{}) System.register(["react","antd","react-dom","tslib","@citrite/sf-api","react-router-dom","@sharefiledev/antd-config","react-router"],(function(e,t){var n={},r={},o={},a={},i={},s={},l={},c={};return Object.defineProperty(n,"__esModule",{value:!0}),Object.defineProperty(o,"__esModule",{value:!0}),{setters:[function(e){Object.keys(e).forEach((function(t){n[t]=e[t]}))},function(e){r.Alert=e.Alert,r.App=e.App,r.Avatar=e.Avatar,r.Badge=e.Badge,r.Button=e.Button,r.Card=e.Card,r.Col=e.Col,r.Divider=e.Divider,r.Dropdown=e.Dropdown,r.Flex=e.Flex,r.Form=e.Form,r.Input=e.Input,r.List=e.List,r.Menu=e.Menu,r.Modal=e.Modal,r.Row=e.Row,r.Select=e.Select,r.Skeleton=e.Skeleton,r.Spin=e.Spin,r.Steps=e.Steps,r.Switch=e.Switch,r.Tabs=e.Tabs,r.Tooltip=e.Tooltip,r.Typography=e.Typography,r.notification=e.notification,r.theme=e.theme},function(e){Object.keys(e).forEach((function(t){o[t]=e[t]}))},function(e){a.__assign=e.__assign,a.__awaiter=e.__awaiter,a.__rest=e.__rest},function(e){i.CustomWorkflowBundleType=e.CustomWorkflowBundleType,i.ItemsEntity=e.ItemsEntity,i.RightSignatureEntity=e.RightSignatureEntity,i.Uploader=e.Uploader,i.UserRole=e.UserRole,i.UsersContactInfoEntity=e.UsersContactInfoEntity,i.UsersEntity=e.UsersEntity,i.ZoneService=e.ZoneService,i.createFile=e.createFile,i.isCustomWorkflowBundle=e.isCustomWorkflowBundle,i.isFile=e.isFile,i.isFolder=e.isFolder,i.isLink=e.isLink,i.isMedicalStudyBundle=e.isMedicalStudyBundle,i.isNote=e.isNote,i.isProspect=e.isProspect,i.isRequestListBundle=e.isRequestListBundle,i.isSymbolicLink=e.isSymbolicLink,i.isWorkflowBundle=e.isWorkflowBundle},function(e){s.Link=e.Link,s.Redirect=e.Redirect,s.Route=e.Route,s.Switch=e.Switch,s.useHistory=e.useHistory},function(e){l.sizes=e.sizes},function(e){c.useHistory=e.useHistory}],execute:function(){e((()=>{var e,u,d={69144:(e,t,n)=>{e.exports=n(14492)},25097:(e,t,n)=>{"use strict";var r=n(30892),o=n(72683),a=n(45650),i=n(70178),s=n(60728),l=n(72722),c=n(12329),u=n(13322);e.exports=function(e){return new Promise((function(t,n){var d=e.data,f=e.headers;r.isFormData(d)&&delete f["Content-Type"];var h=new XMLHttpRequest;if(e.auth){var m=e.auth.username\|\|"",p=e.auth.password?unescape(encodeURIComponent(e.auth.password)):"";f.Authorization="Basic "+btoa(m+":"+p)}var v=s(e.baseURL,e.url);if(h.open(e.method.toUpperCase(),i(v,e.params,e.paramsSerializer),!0),h.timeout=e.timeout,h.onreadystatechange=function(){if(h&&4===h.readyState&&(0!==h.status\|\|h.responseURL&&0===h.responseURL.indexOf("file:"))){var r="getAllResponseHeaders"in h?l(h.getAllResponseHeaders()):null,a={data:e.responseType&&"text"!==e.responseType?h.response:h.responseText,status:h.status,statusText:h.statusText,headers:r,config:e,request:h};o(t,n,a),h=null}},h.onabort=function(){h&&(n(u("Request aborted",e,"ECONNABORTED",h)),h=null)},h.onerror=function(){n(u("Network Error",e,null,h)),h=null},h.ontimeout=function(){var t="timeout of "+e.timeout+"ms exceeded";e.timeoutErrorMessage&&(t=e.timeoutErrorMessage),n(u(t,e,"ECONNABORTED",h)),h=null},r.isStandardBrowserEnv()){var g=(e.withCredentials\|\|c(v))&&e.xsrfCookieName?a.read(e.xsrfCookieName):undefined;g&&(f[e.xsrfHeaderName]=g)}if("setRequestHeader"in h&&r.forEach(f,(function(e,t){void 0===d&&"content-type"===t.toLowerCase()?delete f[t]:h.setRequestHeader(t,e)})),r.isUndefined(e.withCredentials)\|\|(h.withCredentials=!!e.withCredentials),e.responseType)try{h.responseType=e.responseType}catch(_){if("json"!==e.responseType)throw _}"function"==typeof e.onDownloadProgress&&h.addEventListener("progress",e.onDownloadProgress),"function"==typeof e.onUploadProgress&&h.upload&&h.upload.addEventListener("progress",e.onUploadProgress),e.cancelToken&&e.cancelToken.promise.then((function(e){h&&(h.abort(),n(e),h=null)})),d\|\|(d=null),h.send(d)}))}},14492:(e,t,n)=>{"use strict";var r=n(30892),o=n(65189),a=n(8859),i=n(40637);function s(e){var t=new a(e),n=o(a.prototype.request,t);return r.extend(n,a.prototype,t),r.extend(n,t
URL: https://piletfeed-cdn.sharefile.io/sharefile-web/s... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script primarily involves module imports and object property definitions without any high-risk behaviors such as dynamic code execution, data exfiltration, or redirects. It appears to be part of a larger application setup, likely for a web application using React and other libraries. No suspicious domains or obfuscated code are present." }
//@pilet v:2(webpackChunkpr_sharefiledevconversationspilet,{}) System.register(["@citrite/sf-api","@sharefiledev/antd-config","antd","react","react-dom","react-router","react-router-dom","tslib"],(function(t,e){var n={},r={},i={},s={},a={},o={},u={},c={};return Object.defineProperty(s,"__esModule",{value:!0}),{setters:[function(t){n.Api=t.Api,n.ItemsEntity=t.ItemsEntity,n.Uploader=t.Uploader,n.UsersEntity=t.UsersEntity,n.ZoneService=t.ZoneService,n.createFile=t.createFile},function(t){r.colorPalette=t.colorPalette,r.sizes=t.sizes},function(t){i.Avatar=t.Avatar,i.Badge=t.Badge,i.Button=t.Button,i.Flex=t.Flex,i.Form=t.Form,i.Grid=t.Grid,i.Input=t.Input,i.Skeleton=t.Skeleton,i.Spin=t.Spin,i.Typography=t.Typography,i.notification=t.notification,i.theme=t.theme},function(t){Object.keys(t).forEach((function(e){s[e]=t[e]}))},function(t){a["default"]=t["default"],a.findDOMNode=t.findDOMNode,a.flushSync=t.flushSync},function(t){o.useHistory=t.useHistory},function(t){u.Link=t.Link,u.useHistory=t.useHistory},function(t){c.__awaiter=t.__awaiter,c.__rest=t.__rest}],execute:function(){t((()=>{var t,l,d={1292:(t,e,n)=>{"use strict";n.d(e,{R7:()=>x,A1:()=>T});var r=n(8109),i=n(782);class s extends Error{constructor(t,e,n){super(t),this.message=t,this.response=e,this.status=null!=n?n:e.status}}var a,o,u,c,l,d,h;!function(t){t.requestlist="requestlist",t.item="requestlist_item"}(a\|\|(a={})),function(t){t.NotSent="NotStarted",t.InProgress="InProgress",t.Completed="Completed"}(o\|\|(o={})),function(t){t.Active="Active",t.Deleted="Deleted",t.Frozen="Frozen"}(u\|\|(u={})),function(t){t.NotSent="NotSent",t.InProgress="InProgress",t.InReview="InReview",t.Completed="Completed"}(c\|\|(c={})),function(t){t.CanCreateNewDocumentRequestInPlugin="CanCreateNewDocumentRequestInPlugin",t.CanAddItem="CanAddItem",t.CanCloseOrOpenDocumentRequest="CanCloseOrOpenDocumentRequest",t.CanStartDocumentRequest="CanStartDocumentRequest",t.CanDeleteDocumentRequest="CanDeleteDocumentRequest",t.CanModifyDocumentRequest="CanModifyDocumentRequest",t.CanRemoveItem="CanRemoveItem",t.CanModifyItem="CanModifyItem",t.CanReviewItem="CanReviewItem",t.CanShareItem="CanShareItem",t.CanAddActorToRequestListItem="CanAddActorToRequestListItem",t.CanRemoveActorFromRequestListItem="CanRemoveActorFromRequestListItem",t.CanSendItemForReview="CanSendItemForReview",t.CanRemoveAttachment="CanRemoveAttachment",t.CanAddAttachment="CanAddAttachment",t.CanDownloadAttachment="CanDownloadAttachment",t.CanDownloadAllItemAttachments="CanDownloadAllItemAttachments",t.CanShareDocumentRequest="CanShareDocumentRequest",t.CanRemoveActorFromRequestList="CanRemoveActorFromRequestList",t.CanRestoreDocumentRequests="CanRestoreDocumentRequests",t.CanViewDeletedItems="CanViewDeletedItems"}(l\|\|(l={})),function(t){t.RequiresItemInList="RequiresItemInList",t.RequiresInProgressItem="RequiresInProgressItem",t.RequiresSomeActors="RequiresSomeActors",t.RequiresInProgressList="RequiresInProgressList",t.RequiresNotCompletedList="RequiresNotCompletedList",t.RequiresNotCompletedItem="RequiresNotCompletedItem",t.RequiresStartedList="RequiresStartedList",t.RequiresSentItem="RequiresSentItem",t.RequiresNotSpecEditRenderMode="RequiresNotSpecEditRenderMode"}(d\|\|(d={})),function(t){t.RefreshDocumentRequestsChannel="requestlists.requestlist.refresh",t.RefreshDocumentRequestTasksChannel="requestlists.requestlist_item.refresh",t.OnAttachmentCountChanged="urn:sfevent:request-list-pilet:attachment-count",t.OnResourceDeleted="urn:event:resource:deleted",t.OnResourceUpdated="urn:event:resource:updated",t.OnResourceCreated="urn:event:resource:created"}(h\|\|(h={}));const f={origin:window.origin,apiPath:"/io/requestlist/v1/"};function p(t,e={}){return(0,r.__awaiter)(this,void 0,void 0,(function(){const n=`${f.origin}${f.apiPath}${t}`;return e.headers=Object.assign(Object.assign({},e.headers),{"X-BFF-CSRF":"true"}),new Request(n,e)}))}const y={getRequestListsByDestinationId(t,e){return(0,r.__awaiter)(this,void 0,void 0,(function(){const n=new URLSearc
URL: https://piletfeed-cdn.sharefile.io/sharefile-web/s... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script primarily involves module registration and imports from known libraries like React, Ant Design, and Citrix APIs. There are no high-risk indicators such as dynamic code execution or data exfiltration. The script does not interact with external domains or perform aggressive DOM manipulations. It appears to be a legitimate use of libraries for application functionality." }
//@pilet v:2(webpackChunkpr_sharefiledevesignpilet,{}) System.register(["@citrite/sf-api","@sharefiledev/antd-config","antd","react","react-dom","react-router-dom","tslib"],(function(e,t){var n={},i={},o={},r={},a={},s={},l={};return Object.defineProperty(r,"__esModule",{value:!0}),{setters:[function(e){n.AccountsEntity=e.AccountsEntity,n.Api=e.Api,n.ContactListType=e.ContactListType,n.ContactsEntity=e.ContactsEntity,n.CustomWorkflowBundleType=e.CustomWorkflowBundleType,n.FileVirusStatus=e.FileVirusStatus,n.IntegrationProvider=e.IntegrationProvider,n.IntegrationsEntity=e.IntegrationsEntity,n.ItemOperations=e.ItemOperations,n.ItemOrderingMode=e.ItemOrderingMode,n.ItemsEntity=e.ItemsEntity,n.RightSignatureEntity=e.RightSignatureEntity,n.Uploader=e.Uploader,n.UserRole=e.UserRole,n.UsersEntity=e.UsersEntity,n.createFolder=e.createFolder,n.isCustomWorkflowBundle=e.isCustomWorkflowBundle,n.isFile=e.isFile,n.isFolder=e.isFolder,n.isLink=e.isLink,n.isMedicalStudyBundle=e.isMedicalStudyBundle,n.isNote=e.isNote,n.isRequestListBundle=e.isRequestListBundle,n.isSymbolicLink=e.isSymbolicLink,n.isWorkflowBundle=e.isWorkflowBundle},function(e){i.colorPalette=e.colorPalette,i.sizes=e.sizes},function(e){o.Alert=e.Alert,o.Avatar=e.Avatar,o.Button=e.Button,o.Card=e.Card,o.Col=e.Col,o.ConfigProvider=e.ConfigProvider,o.DatePicker=e.DatePicker,o.Divider=e.Divider,o.Drawer=e.Drawer,o.Flex=e.Flex,o.Grid=e.Grid,o.Input=e.Input,o.Layout=e.Layout,o.List=e.List,o.Modal=e.Modal,o.Pagination=e.Pagination,o.Radio=e.Radio,o.Result=e.Result,o.Row=e.Row,o.Select=e.Select,o.Skeleton=e.Skeleton,o.Space=e.Space,o.Spin=e.Spin,o.Steps=e.Steps,o.Tabs=e.Tabs,o.Tag=e.Tag,o.Typography=e.Typography,o.notification=e.notification,o.theme=e.theme},function(e){Object.keys(e).forEach((function(t){r[t]=e[t]}))},function(e){a.createPortal=e.createPortal,a["default"]=e["default"],a.findDOMNode=e.findDOMNode,a.flushSync=e.flushSync,a.render=e.render,a.unmountComponentAtNode=e.unmountComponentAtNode,a.unstable_batchedUpdates=e.unstable_batchedUpdates},function(e){s.useHistory=e.useHistory,s.useLocation=e.useLocation},function(e){l.__assign=e.__assign,l.__awaiter=e.__awaiter,l.__rest=e.__rest}],execute:function(){e((()=>{var e,c,u,d,m={3862:(e,t,n)=>{"use strict";function i(e){var t,n,i=arguments.length>1&&arguments[1]!==undefined?arguments[1]:null,r=null===(t=o())\|\|void 0===t?void 0:t.v1;return r&&null!==(n=r.getValue(e))&&void 0!==n?n:i}function o(){var e,t;return"undefined"==typeof window?undefined:(null!==(t=(e=window).__citrix_internal_featureflags__)&&void 0!==t\|\|(e.__citrix_internal_featureflags__={}),window.__citrix_internal_featureflags__)}n.d(t,{Y:()=>i})},4300:(e,t,n)=>{"use strict";n.d(t,{A:()=>re});var i=function(){function e(e){var t=this;this._insertTag=function(e){var n;n=0===t.tags.length?t.insertionPoint?t.insertionPoint.nextSibling:t.prepend?t.container.firstChild:t.before:t.tags[t.tags.length-1].nextSibling,t.container.insertBefore(e,n),t.tags.push(e)},this.isSpeedy=e.speedy===undefined\|\|e.speedy,this.tags=[],this.ctr=0,this.nonce=e.nonce,this.key=e.key,this.container=e.container,this.prepend=e.prepend,this.insertionPoint=e.insertionPoint,this.before=null}var t=e.prototype;return t.hydrate=function(e){e.forEach(this._insertTag)},t.insert=function(e){this.ctr%(this.isSpeedy?65e3:1)==0&&this._insertTag(function(e){var t=document.createElement("style");return t.setAttribute("data-emotion",e.key),e.nonce!==undefined&&t.setAttribute("nonce",e.nonce),t.appendChild(document.createTextNode("")),t.setAttribute("data-s",""),t}(this));var t=this.tags[this.tags.length-1];if(this.isSpeedy){var n=function(e){if(e.sheet)return e.sheet;for(var t=0;t<document.styleSheets.length;t++)if(document.styleSheets[t].ownerNode===e)return document.styleSheets[t]}(t);try{n.insertRule(e,n.cssRules.length)}catch(b){0}}else t.appendChild(document.createTextNode(e));this.ctr++},t.flush=function(){this.tags.forEach((function(e){return e.parentNode&&e.parentNode.removeChild(e)})),this.tags=[],this.c
URL: https://citrix-sharefile-content.customer.pendo.io... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script appears to be a Pendo agent wrapper, which is typically used for analytics and user guidance. It does not exhibit high-risk behaviors such as dynamic code execution or data exfiltration. The script uses some legacy practices and tracking behavior, but these are common for analytics purposes and do not indicate malicious intent. The domain (pendo.io) is known and reputable, which further reduces the risk score." }
// Pendo Agent Wrapper // Copyright 2024 Pendo.io, Inc. // Environment: production // Agent Version: 2.258.1 // Installed: 2024-12-16T06:13:02Z (function (PendoConfig) { /* @license https://agent.pendo.io/licenses */ !function(ww,Iw,Sw){!function(){var T=Array.prototype.slice;try{T.call(Iw.documentElement)}catch(Ut){Array.prototype.slice=function(e,t){if(t=void 0!==t?t:this.length,"[object Array]"===Object.prototype.toString.call(this))return T.call(this,e,t);var n,i=[],r=this.length,o=e\|\|0,a=(t<0?r+t:t\|\|r)-(o=0<=o?o:r+o);if(0<a)if(i=new Array(a),this.charAt)for(n=0;n<a;n++)i[n]=this.charAt(o+n);else for(n=0;n<a;n++)i[n]=this[o+n];return i}}String.prototype.trim\|\|(String.prototype.trim=function(){return this.replace(/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,"")});var A=function(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_".split("");return{uint8ToBase64:function(e){var t,n,i,r=e.length%3,o="";for(t=0,i=e.length-r;t<i;t+=3)n=(e[t]<<16)+(e[t+1]<<8)+e[t+2],o+=function(e){return a[e>>18&63]+a[e>>12&63]+a[e>>6&63]+a[63&e]}(n);switch(r){case 1:n=e[e.length-1],o=(o+=a[n>>2])+a[n<<4&63];break;case 2:n=(e[e.length-2]<<8)+e[e.length-1],o=(o=(o+=a[n>>10])+a[n>>4&63])+a[n<<2&63]}return o}}}(),Bt="undefined"!=typeof globalThis?globalThis:void 0!==ww?ww:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function e(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e["default"]:e}var t={exports:{}},i=(!function(p){!function(){var s="object"==typeof ww?ww:{},i=!s.JS_SHA1_NO_NODE_JS&&"object"==typeof process&&process.versions&&process.versions.node,e=(i&&(s=Bt),!s.JS_SHA1_NO_COMMON_JS&&p.exports),o="0123456789abcdef".split(""),n=[-2147483648,8388608,32768,128],u=[24,16,8,0],r=["hex","array","digest","arrayBuffer"],t=[],a=function(t){return function(e){return new l(!0).update(e)[t]()}},d=function(){var t=a("hex");(t=i?c(t):t).create=function(){return new l},t.update=function(e){return t.create().update(e)};for(var e=0;e<r.length;++e){var n=r[e];t[n]=a(n)}return t},c=function(t){var n=eval("require('crypto')"),i=eval("require('buffer').Buffer"),e=function(e){if("string"==typeof e)return n.createHash("sha1").update(e,"utf8").digest("hex");if(e.constructor===ArrayBuffer)e=new Uint8Array(e);else if(e.length===Sw)return t(e);return n.createHash("sha1").update(new i(e)).digest("hex")};return e};function l(e){e?(t[0]=t[16]=t[1]=t[2]=t[3]=t[4]=t[5]=t[6]=t[7]=t[8]=t[9]=t[10]=t[11]=t[12]=t[13]=t[14]=t[15]=0,this.blocks=t):this.blocks=[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],this.h0=1732584193,this.h1=4023233417,this.h2=2562383102,this.h3=271733878,this.h4=3285377520,this.block=this.start=this.bytes=this.hBytes=0,this.finalized=this.hashed=!1,this.first=!0}l.prototype.update=function(e){if(!this.finalized){for(var t,n,i="string"!=typeof e,r=0,o=(e=i&&e.constructor===s.ArrayBuffer?new Uint8Array(e):e).length\|\|0,a=this.blocks;r<o;){if(this.hashed&&(this.hashed=!1,a[0]=this.block,a[16]=a[1]=a[2]=a[3]=a[4]=a[5]=a[6]=a[7]=a[8]=a[9]=a[10]=a[11]=a[12]=a[13]=a[14]=a[15]=0),i)for(n=this.start;r<o&&n<64;++r)a[n>>2]\|=e[r]<<u[3&n++];else for(n=this.start;r<o&&n<64;++r)(t=e.charCodeAt(r))<128?a[n>>2]\|=t<<u[3&n++]:(t<2048?a[n>>2]\|=(192\|t>>6)<<u[3&n++]:(t<55296\|\|57344<=t?a[n>>2]\|=(224\|t>>12)<<u[3&n++]:(t=65536+((1023&t)<<10\|1023&e.charCodeAt(++r)),a[n>>2]\|=(240\|t>>18)<<u[3&n++],a[n>>2]\|=(128\|t>>12&63)<<u[3&n++]),a[n>>2]\|=(128\|t>>6&63)<<u[3&n++]),a[n>>2]\|=(128\|63&t)<<u[3&n++]);this.lastByteIndex=n,this.bytes+=n-this.start,64<=n?(this.block=a[16],this.start=n-64,this.hash(),this.hashed=!0):this.start=n}return 4294967295<this.bytes&&(this.hBytes+=this.bytes/4294967296<<0,this.bytes=this.bytes%4294967296),this}},l.prototype.finalize=function(){var e,t;this.finalized\|\|(this.finalized=!0,e=this.blocks,t=this.lastByteIndex,e[16]=this.block,e[t>>2]\|=n[3&t],this.block=e[16],56<=t&&(this.hashed\|\|this.hash(),e[0]=this.block,e[16]=e[1]=e[2]=e[3]=e[4]=e[5]=e[6]=e[7]=e[8]=e[9]=e[10]=e[11]=e[12]=e[13]=e[14]=e[15]=0),e[1
URL: https://cavotec-au.sharefile.com/share/view/1271a93971714a91 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_security_alerts": false }

URL: https://cavotec-au.sharefile.com/share/view/1271a93971714a91 Model: Joe Sandbox AI	{ "brands": [ "Cavotec" ] }
	{ "brands": [ "Cavotec" ] }
URL: https://cavotec-au.sharefile.com/share/view/1271a93971714a91 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "You have received a document from Cavotec Australia Pty Limited", "prominent_button_name": "Preview or Download", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_security_alerts": true }

URL: https://cavotec-au.sharefile.com/share/view/1271a93971714a91 Model: Joe Sandbox AI	{ "brands": [ "OneDrive" ] }
	{ "brands": [ "OneDrive" ] }
URL: https://victoryacademytc.com/common_oauth2_v20_authorizeclientid_4765445b32c649b0/aspx.htm Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "We need verify the intended recipient's email to continue reading in word document. Please enter the email address to which document was shared.", "prominent_button_name": "Open in Word Document", "text_input_field_labels": [ "Enter email" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_security_alerts": false }

URL: https://victoryacademytc.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://victoryacademytc.com
URL: https://victoryacademytc.com/common_oauth2_v20_authorizeclientid_4765445b32c649b0/aspx.htm Model: Joe Sandbox AI	{ "brands": [ "Word Default" ] }
	{ "brands": [ "Word Default" ] }
URL: https://victoryacademytc.com/common_oauth2_v20_authorizeclientid_4765445b32c649b0/aspx.htm Model: Joe Sandbox AI	```json{ "legit_domain": "unknown", "classification": "unknown", "reasons": [ "The brand 'Word Default' does not correspond to any well-known or known brand.", "The URL 'victoryacademytc.com' does not match any known domain associated with a recognized brand.", "The domain name does not contain any obvious misspellings or suspicious elements, but it is not associated with a known brand.", "The presence of an email input field without a clear brand association could be a phishing attempt." ], "riskscore": 7}
URL: victoryacademytc.com Brands: Word Default Input Fields: Enter email
URL: https://s7ol.lomifor.ru/oONm9/#Tasdfasdfa@wp.pl Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Your browser is being verified to protect your connection", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_security_alerts": true }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 07:46:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9890880955203984
Encrypted:	false
SSDEEP:
MD5:	29F82B7BD8D44187B4AED3E6D939F1FF
SHA1:	CDA821DB50DB23B79050CE7890BC8E576034C5AE
SHA-256:	9FEEF97FB27E03262FC96AEAFFDDD0EAE6D402E2F7E7DA2DCD5145AC0A9D3881
SHA-512:	A1E9430488B845079630A59E4172645E6A61D1AFD932388520AF0883D4E7EEB80AEE379F174BDB25758CFCE670262EC8DB278CF292735769B8052BE31BA07CE3
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....../..O..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.E....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.E....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.E....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.E..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 07:46:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.003931890937136
Encrypted:	false
SSDEEP:
MD5:	8D4B8928BBFF73DA8A70AE64EB13B4CC
SHA1:	09D5E4271832BBE589E9B0FA70D63D2C0CE22094
SHA-256:	7D4782B012C531C5F494CE0831547A107E4FF8636888E5D3272577100CBDDBCF
SHA-512:	9B9C7CC5FFCBC064FB7051DEB6FAFDDF7A484707F47F7C8ED980E8BC206D73BD723ECA2F3B4C7C1941F70443660FAE6D1046F3F146AC686535733B4F94BAD4E0
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....F."..O..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.E....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.E....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.E....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.E..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://cavotec-au.sharefile.com/public/share/web-1271a93971714a91

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 199

Chrome Cache Entry: 203

Chrome Cache Entry: 204

Chrome Cache Entry: 209

Chrome Cache Entry: 211

Chrome Cache Entry: 214

Chrome Cache Entry: 215

Chrome Cache Entry: 216

Chrome Cache Entry: 217

Chrome Cache Entry: 219

Chrome Cache Entry: 220

Chrome Cache Entry: 221

Chrome Cache Entry: 223

Chrome Cache Entry: 224

Chrome Cache Entry: 226

Chrome Cache Entry: 227

Chrome Cache Entry: 228

Chrome Cache Entry: 229

Chrome Cache Entry: 232

Chrome Cache Entry: 234

Chrome Cache Entry: 235

Chrome Cache Entry: 236

Chrome Cache Entry: 237

Chrome Cache Entry: 239

Chrome Cache Entry: 241

Chrome Cache Entry: 242

Chrome Cache Entry: 244

Chrome Cache Entry: 245

Chrome Cache Entry: 246

Chrome Cache Entry: 248

Windows Analysis Report
https://cavotec-au.sharefile.com/public/share/web-1271a93971714a91