Edit tour

Windows Analysis Report
https://disruptivc-dot-yamm-track.appspot.com/Redirect?ukey=1-0q8XPD2_exH3GZm9N9GPlcuW7DeTrX4WZWK6ta6DkQ-0&key=YAMMID-76523483&link=https://construction-sealants-ltd.jimdosite.com

Overview

General Information

Sample URL:	https://disruptivc-dot-yamm-track.appspot.com/Redirect?ukey=1-0q8XPD2_exH3GZm9N9GPlcuW7DeTrX4WZWK6ta6DkQ-0&key=YAMMID-76523483&link=https://construction-sealants-ltd.jimdosite.com
Analysis ID:	1576750

Detection

HTMLPhisher

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish29

AI detected suspicious Javascript

AI detected suspicious URL

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6176 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6404 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1972,i,12227774127741270878,15978676523614478423,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7080 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://disruptivc-dot-yamm-track.appspot.com/Redirect?ukey=1-0q8XPD2_exH3GZm9N9GPlcuW7DeTrX4WZWK6ta6DkQ-0&key=YAMMID-76523483&link=https://construction-sealants-ltd.jimdosite.com" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
1.2.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security
1.5.pages.csv	JoeSecurity_HtmlPhish_29	Yara detected HtmlPhish_29	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish29

Source: Yara match	File source: 1.2.pages.csv, type: HTML
Source: Yara match	File source: 1.5.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.5.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://construction-sealants-ltd.jimdosite.com/... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to a suspicious domain. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as implementing a security challenge, the overall behavior is highly suspicious and indicative of potential malicious intent.

AI detected suspicious URL

Source: Email

Joe Sandbox AI: AI detected Typosquatting in URL: https://disruptivc-dot-yamm-track.appspot.com

Source: https://construction-sealants-ltd.jimdosite.com/

HTTP Parser: Base64 decoded: 1734441827.000000

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.17:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.17:49771 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: disruptivc-dot-yamm-track.appspot.com
Source: global traffic	DNS traffic detected: DNS query: construction-sealants-ltd.jimdosite.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: jimdo-dolphin-static-assets-prod.freetls.fastly.net
Source: global traffic	DNS traffic detected: DNS query: fonts.jimstatic.com
Source: global traffic	DNS traffic detected: DNS query: jimdo-storage.freetls.fastly.net
Source: global traffic	DNS traffic detected: DNS query: yugaljeeautomotive.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: at.prod.jimdo.systems

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.17:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.17:49771 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.win@21/18@30/219

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1972,i,12227774127741270878,15978676523614478423,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://disruptivc-dot-yamm-track.appspot.com/Redirect?ukey=1-0q8XPD2_exH3GZm9N9GPlcuW7DeTrX4WZWK6ta6DkQ-0&key=YAMMID-76523483&link=https://construction-sealants-ltd.jimdosite.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1972,i,12227774127741270878,15978676523614478423,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
https://disruptivc-dot-yamm-track.appspot.com/Redirect?ukey=1-0q8XPD2_exH3GZm9N9GPlcuW7DeTrX4WZWK6ta6DkQ-0&key=YAMMID-76523483&link=https://construction-sealants-ltd.jimdosite.com	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
jimdo-dolphin-static-assets-prod.freetls.fastly.net	151.101.2.79	true	false	high
at.prod.jimdo.systems	3.255.10.234	true	false	unknown
jimdo-storage.freetls.fastly.net	151.101.2.79	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
www.google.com	142.250.181.100	true	false	high
yugaljeeautomotive.com	118.139.179.98	true	false	unknown
disruptivc-dot-yamm-track.appspot.com	172.217.17.52	true	false	unknown
construction-sealants-ltd.jimdosite.com	unknown	unknown	true	unknown
fonts.jimstatic.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://yugaljeeautomotive.com/z/pro/mentanance/auth/	false		unknown
https://construction-sealants-ltd.jimdosite.com/	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.206	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
54.171.97.194	unknown	United States	16509	AMAZON-02US	false
172.217.17.46	unknown	United States	15169	GOOGLEUS	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
3.255.10.234	at.prod.jimdo.systems	United States	16509	AMAZON-02US	false
118.139.179.98	yugaljeeautomotive.com	Singapore	26496	AS-26496-GO-DADDY-COM-LLCUS	false
104.18.41.38	unknown	United States	13335	CLOUDFLARENETUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
151.101.2.79	jimdo-dolphin-static-assets-prod.freetls.fastly.net	United States	54113	FASTLYUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
64.233.164.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.130.79	unknown	United States	54113	FASTLYUS	false
172.217.17.52	disruptivc-dot-yamm-track.appspot.com	United States	15169	GOOGLEUS	false
172.217.21.35	unknown	United States	15169	GOOGLEUS	false
142.250.181.99	unknown	United States	15169	GOOGLEUS	false
162.159.128.70	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.17
192.168.2.4
192.168.2.24

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576750
Start date and time:	2024-12-17 14:23:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://disruptivc-dot-yamm-track.appspot.com/Redirect?ukey=1-0q8XPD2_exH3GZm9N9GPlcuW7DeTrX4WZWK6ta6DkQ-0&key=YAMMID-76523483&link=https://construction-sealants-ltd.jimdosite.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@21/18@30/219

Warnings

Exclude process from analysis (whitelisted): TextInputHost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.19.206, 64.233.164.84
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://disruptivc-dot-yamm-track.appspot.com/Redirect?ukey=1-0q8XPD2_exH3GZm9N9GPlcuW7DeTrX4WZWK6ta6DkQ-0&key=YAMMID-76523483&link=https://construction-sealants-ltd.jimdosite.com

LLM Input / Output

Input	Output
URL: https://disruptivc-dot-yamm-track.appspot.com Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": true, "malicious_keywords": true, "encoded_characters": false, "redirection": true, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://disruptivc-dot-yamm-track.appspot.com
URL: https://yugaljeeautomotive.com/z/pro/mentanance/au... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet simply reloads the current page, which is a common and benign operation. This behavior does not indicate any high-risk or malicious activities." }
window.location.reload();
URL: https://construction-sealants-ltd.jimdosite.com/... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to a suspicious domain. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as implementing a security challenge, the overall behavior is highly suspicious and indicative of potential malicious intent." }
(function(){function c(){var b=a.contentDocument\|\|a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8f373acb99d942b2',t:'MTczNDQ0MTgyNy4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange\|\|function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();
URL: https://challenges.cloudflare.com/turnstile/v0/b/7... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet exhibits several behaviors that raise moderate security concerns. While it does not contain any clear indicators of malicious intent, the use of dynamic code execution, external data transmission, and aggressive DOM manipulation warrant further review. Additionally, the presence of obfuscated code and the use of multiple fallback domains increase the overall risk profile of the script. Overall, this script requires closer inspection to determine its true purpose and potential impact on user security and privacy." }
"use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Ht(u,o,c,g,h,"next",l)}function h(l){Ht(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=null?r:{},Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):Sr(Object(r)).forEach(function(n){Object.defineProperty(e,n,Object.getOwnPropertyDescriptor(r,n))}),e}function jt(e){if(Array.isArray(e))return e}function qt(e,r){var n=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(n!=null){var o=[],c=!0,u=!1,g,h;try{for(n=n.call(e);!(c=(g=n.next()).done)&&(o.push(g.value),!(r&&o.length===r));c=!0);}catch(l){u=!0,h=l}finally{try{!c&&n.return!=null&&n.return()}finally{if(u)throw h}}return o}}function zt(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}function at(e,r){(r==null\|\|r>e.length)&&(r=e.length);for(var n=0,o=new Array(r);n<r;n++)o[n]=e[n];return o}function Gt(e,r){if(e){if(typeof e=="string")return at(e,r);var n=Object.prototype.toString.call(e).slice(8,-1);if(n==="Object"&&e.constructor&&(n=e.constructor.name),n==="Map"\|\|n==="Set")return Array.from(n);if(n==="Arguments"\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(n))return at(e,r)}}function Ae(e,r){return jt(e)\|\|qt(e,r)\|\|Gt(e,r)\|\|zt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(u[0]&1)throw u[1];return u[1]},trys:[],ops:[]},o,c,u,g;return g={next:h(0),throw:h(1),return:h(2)},typeof Symbol=="function"&&(g[Symbol.iterator]=function(){return this}),g;function h(p){return function(E){return l([p,E])}}function l(p){if(o)throw new TypeError("Generator is already executing.");for(;g&&(g=0,p[0]&&(n=0)),n;)try{if(o=1,c&&(u=p[0]&2?c.return:p[0]?c.throw\|\|((u=c.return)&&u.call(c),0):c.next)&&!(u=u.call(c,p[1])).done)return u;switch(c=0,u&&(p=[p[0]&2,u.value]),p[0]){case 0:case 1:u=p;break;case 4:return n.label++,{value:p[1],done:!1};case 5:n.label++,c=p[1],p=[0];continue;case 7:p=n.ops.pop(),n.trys.pop();continue;default:if(u=n.trys,!(u=u.length>0&&u[u.length-1])&&(p[0]===6\|\|p[0]===2)){n=0;continue}if(p[0]===3&&(!u\|\|p[1]>u[0]&&p[1]<u[3])){n.label=p[1];break}if(p[0]===6&&n.label<u[1]){n.label=u[1],u=p;break}if(u&&n.label<u[2]){n.label=u[2],n.ops.push(p);break}u[2]&&n.ops.pop(),n.trys.pop();continue}p=r.call(e,n)}catch(E){p=[6,E],c=0}finally{o=u=0}if(p[0]&5)throw p[1];return{value:p[0]?p[1]:void 0,done:!0}}}var Xt={code:200500,internalRepr:"iframe_load_err",public:!0,retryable:!1,description:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Yt=300020;var De=300030;var Ve=300031;var j;(function(e){e.MANAGED="managed",e.NON_INTERACTIVE="non-interactive",e.INVISIBLE="invisible"})(j\|\|(j={}));var L;(fun
URL: https://yugaljeeautomotive.com/z/pro/mentanance/au... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a legitimate implementation of the Cloudflare Turnstile CAPTCHA system. It initializes the Turnstile widget, attaches an event listener to handle the 'turnstile:pass' event, and automatically submits the form when the CAPTCHA is successfully completed. The script does not exhibit any high-risk behaviors and is likely used for legitimate user verification purposes. Some low-risk indicators, such as the use of a legacy `XDomainRequest` API and the presence of a retry mechanism, are present, but these are common practices in CAPTCHA implementations and do not indicate malicious intent. Overall, this script is considered low risk." }
function onloadTurnstileCallback() { console.log('Turnstile script loaded'); // Initialize Turnstile after the script is loaded window.turnstile = window.turnstile \|\| {}; window.turnstile.render = window.turnstile.render \|\| {}; const turnstileElement = document.querySelector('.cf-turnstile'); if (turnstileElement) { console.log('Turnstile element found'); // Attach the event listener to the Turnstile instance turnstileElement.addEventListener('turnstile:pass', function() { console.log('Turnstile CAPTCHA passed'); document.getElementById('captcha-form').submit(); }); // Define a retry function for the fallback function checkTurnstileResponse(retryCount = 0) { if (window.turnstile && window.turnstile.getResponse) { const response = window.turnstile.getResponse(); if (response) { // Append the response to the form before submitting const form = document.getElementById('captcha-form'); const input = document.createElement('input'); input.type = 'hidden'; input.name = 'cf-turnstile-response'; input.value = response; form.appendChild(input); // Add the response input to the form // Auto-submit the form setTimeout(function() { form.submit(); }, 500); // You can adjust the delay if necessary (in milliseconds) } else if (retryCount < 10) { // Retry up to 10 times console.log('Turnstile response not yet obtained, retrying...'); setTimeout(() => checkTurnstileResponse(retryCount + 1), 3000); // Retry after 5 seconds } else { console.error('Turnstile response not obtained after several attempts'); } } else if (retryCount < 10) { // Retry if Turnstile is not ready console.log('Turnstile not ready, retrying...'); setTimeout(() => checkTurnstileResponse(retryCount + 1), 3000); // Retry after 5 seconds } else { console.error('Turnstile not initialized after several attempts'); } } // Start checking for the Turnstile response setTimeout(() => checkTurnstileResponse(), 3000); // Initial delay before starting checks } else { console.error('Turnstile element not found'); } }
URL: https://construction-sealants-ltd.jimdosite.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://construction-sealants-ltd.jimdosite.com
URL: https://jimdo-dolphin-static-assets-prod.freetls.f... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The provided JavaScript snippet appears to be a part of a larger library or framework, and it does not exhibit any clear high-risk behaviors. However, it does contain some moderate-risk indicators, such as external data transmission and the use of legacy APIs. Additionally, the code is obfuscated, which can make it more difficult to analyze and understand its true purpose. Overall, this script requires further review due to its unclear behavior and potential for aggressive DOM manipulation." }
/! For license information please see dd36634b5e90c11d85d7.js.LICENSE.txt / (()=>{var e,t,n,i,a={58695:(e,t,n)=>{"use strict";n(33893).Cookie;var i=n(76046);t.u5=i.CKies,i.CookieOptions,i.CookieType},76046:(e,t,n)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0});var i,a,o=n(33893);!function(e){e.NECESSARY="necessary",e.FUNCTIONAL="functional",e.PERFORMANCE="performance",e.MARKETING="marketing"}(i=t.CookieType\|\|(t.CookieType={})),function(e){e.ALLOW="allow",e.DENY="deny"}(a=t.CookieOptions\|\|(t.CookieOptions={})),t.CONFIG_EXPIRATION=31536e6;var r=function(){function e(){}return e.getExpireDate=function(){var e=new Date;return e.setTime(e.getTime()+t.CONFIG_EXPIRATION),e},e.key=function(e){return"ckies_"+e},e.use=function(e){return e===i.NECESSARY\|\|(this.isOptIn()?o.Cookie.get(this.key(e))===a.ALLOW:o.Cookie.get(this.key(e))!==a.DENY)},e.deny=function(e){this.set(e,a.DENY)},e.allow=function(e){this.set(e,a.ALLOW)},e.useNecessary=function(){return this.use(i.NECESSARY)},e.useFunctional=function(){return this.use(i.FUNCTIONAL)},e.usePerformance=function(){return this.use(i.PERFORMANCE)},e.useMarketing=function(){return this.use(i.MARKETING)},e.set=function(e,t){e!==i.NECESSARY&&o.Cookie.set(this.key(e),t,this.getExpireDate())},e.isOptIn=function(){return window.hasOwnProperty("CKIES_OPTIN")&&!0===window.CKIES_OPTIN},e}();t.CKies=r},33893:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=function(){function e(){}return e.get=function(e){var t=("; "+document.cookie).split("; "+e+"=");return t&&2===t.length?(t.pop()\|\|"").split(";").shift():null},e.set=function(e,t,n){document.cookie=e+"="+t+"; expires="+n.toUTCString()+"; path=/"},e}();t.Cookie=n},2604:(e,t,n)=>{"use strict";n.d(t,{UD:()=>Mo});var i={log:"log",debug:"debug",info:"info",warn:"warn",error:"error"},a=console,o={};Object.keys(i).forEach((function(e){o[e]=a[e]}));var r="Datadog Browser SDK:",s={debug:o.debug.bind(a,r),log:o.log.bind(a,r),info:o.info.bind(a,r),warn:o.warn.bind(a,r),error:o.error.bind(a,r)};function l(e,t){return function(){for(var n=[],i=0;i<arguments.length;i++)n[i]=arguments[i];try{return e.apply(void 0,n)}catch(e){s.error(t,e)}}}var c,d=!1;function u(e){d=e}function m(e,t,n){var i=n.value;n.value=function(){for(var e=[],t=0;t<arguments.length;t++)e[t]=arguments[t];return(c?p(i):i).apply(this,e)}}function p(e){return function(){return g(e,this,arguments)}}function g(e,t,n){try{return e.apply(t,n)}catch(e){if(h(e),c)try{c(e)}catch(e){h(e)}}}function h(){for(var e=[],t=0;t<arguments.length;t++)e[t]=arguments[t];d&&s.error.apply(s,function(e,t,n){if(n\|\|2===arguments.length)for(var i,a=0,o=t.length;a<o;a++)!i&&a in t\|\|(i\|\|(i=Array.prototype.slice.call(t,0,a)),i[a]=t[a]);return e.concat(i\|\|Array.prototype.slice.call(t))}(["[MONITOR]"],e,!1))}function b(e,t){return-1!==e.indexOf(t)}function f(e){if(Array.from)return Array.from(e);var t=[];if(e instanceof Set)e.forEach((function(e){return t.push(e)}));else for(var n=0;n<e.length;n++)t.push(e[n]);return t}function y(e,t){for(var n=0;n<e.length;n+=1){var i=e[n];if(t(i,n))return i}}function v(e){return Object.keys(e).map((function(t){return e[t]}))}function S(e){return Object.keys(e).map((function(t){return[t,e[t]]}))}function k(e,t){return e.slice(0,t.length)===t}function w(e){for(var t=[],n=1;n<arguments.length;n++)t[n-1]=arguments[n];return t.forEach((function(t){for(var n in t)Object.prototype.hasOwnProperty.call(t,n)&&(e[n]=t[n])})),e}function C(e){var t=w({version:"5.15.0",onReady:function(e){e()}},e);return Object.defineProperty(t,"_setDebug",{get:function(){return u},enumerable:!1}),t}function T(e,t,n){var i=e[t];e[t]=n,i&&i.q&&i.q.forEach((function(e){return l(e,"onReady callback threw an error:")()}))}function P(){if("object"==typeof globalThis)return globalThis;Object.defineProperty(Object.prototype,"_dd_temp_",{get:function(){return this},configurable:!0});var e=_dd_temp_;return delete Object.prototype._dd_temp_,"object"!=typeof e&&(e="object"==typeof self?self:"ob
URL: https://challenges.cloudflare.com/cdn-cgi/challeng... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a Cloudflare challenge script, which is a legitimate behavior for websites that use Cloudflare's security services. The script sets up various configuration options for the Cloudflare challenge and includes some communication with the parent window, which is a common pattern for these types of challenges. While the script uses some obfuscated code, this is likely a security measure implemented by Cloudflare and does not necessarily indicate malicious intent. Overall, the script seems to be part of a legitimate security mechanism and does not demonstrate any high-risk behaviors." }
(function(){ window._cf_chl_opt={ cvId: '3', cZone: 'challenges.cloudflare.com', cTplV: 5, chlApivId: '0', chlApiWidgetId: 'f8dyj', chlApiSitekey: '0x4AAAAAAA2TdCPQgN_V-Tva', chlApiMode: 'managed', chlApiSize: 'normal', chlApiRcV: 'eATZcCAG8Y3zlOWH4H5mERNViexzVv48_C_hsxiwibc-1734441846-1.3.1.1-iWqrLu.bQiUq1zDHesvSFlkOTSzEXtjeS3ZJ_ayQutI', chlApiTimeoutEncountered: 0, chlApiOverrunBudgetMs:10000, chlTimeoutMs:120000, cK:[], cType: 'chl_api_m', cRay: '8f373b445bd67ce7', cH: 'HXx1SoTmJOn1S4cQIEai.07VycQpJzJAxBVN7tY26vo-1734441846-1.1.1.1-dO050.wp3H.mWXeKtudpoNSggUqfwz41tDRiBm_buJDr9Zmkpv4_SzrLzQ6AjcQQ', cFPWv: 'b', cLt: 'n', chlApiFailureFeedbackEnabled:true, chlApiLoopFeedbackEnabled:false, wOL:false, wT: 'auto', wS: 'normal', md: 'fcXPlycarcA_DYTEj89lncGF7Gm5LdUKs6TM8IiZpOs-1734441846-1.1.1.1-f4EwZ8zYRrd9pG7VMDRTvHeIkxUIdU7TW_nFppirLtYUsh.iw6WbDLSxVzI6SAbNwCqCDtgEv.4UD5WKsqjV9H8MCWNof9B2hHI_RjFGhDKFaPYWhAoJ5LBkCVxpxgVkTM5fa6iAjPr1HWeRF1keRNmee.LZqqS1l2ovEiShZPB4xMUWwJ.bX50IJPKMOJAcDyLRDDBSTWNGsYWKV4JD2kokGzSNOU4wxPJHU9tecFLkbnE6T2Otl0.Uhc_8KrQ3DF.w8BdhqFxNa6.F23QaF8ugwHXL1kiOrsKvk10tw82tdkPVxUZHxrhGSNURyFrLnDRzSdTuafwUtt1a9ybfarawMHwJ20X7bibgBF2VNdTONMzi7wrqX3fxu_mz7WyqwvYDRaRK1jKdBM8W4iSJa8hnfOyWhZySlVzcNKpd.P4Vjtmu7Sn4r5NXIhpWLnfdUEaXkAYYf0hr8uQig3qgmPyDdcy9Mlo7TdSKo5H16iu2RtQK1YBwTvVesogkxvQxKvWEZVeTAbRu6UpN6iDjqDx.kyMM6YWwhNRsCT7AUztmW930Fu5rI6RJLm6fmW9e0KWR.6Xy0_IjU3tP.9P7rRWBDa2vy9d9_zdTj43suJyjjphCrwdKm.ls3M3pCLMe3fSwkbX6rF9YoirqHDFcr.tR9WdfGILlxytmcu4ILI.6tFg1QxLaXABb98sssFVaIFCCyVsFI1BFiB5Ha2Q2LbZAujFBPgK.Rhz6eLrUVldhB9Xo6nePoYor1.HgLeV6FNbWldQAmz.twhl68Tu0ETHetN3ioJJ0y1sMvWTr7o8dvfx6p.03Lmgh0pKSXujMeB13O84lZHAyxNwwkPk1zT.FrkCRX0S39Zrp3hzFkd5JcZ.x32HodUQKEgV3mA.Azwi9fPpNAKHKEm.5sPH2BZrVbBY89cKPeI9aJv6aWchAkrZ78ty1.FgB3uTdTwmxKIL0VBozT9N1VEmHlSwMnPpi0EcduyPqYab_bOIbPcc1M6VEP.xWsPwpLnv6HLdU9tawh9DE6SJi.RtScsVYsa5zCW1KvGWNrX16fiK3.lDW0Hh1noxcgDH2pgxMqsPh.mZsY7uY_yjyggYUjHkQyvEfmDjBZCCE.k7T9vrnhQye2mV4I6YuObVPrrNe.2_RuY_JZH67b_54EvYF8VWSSfT6MuVBL66g9pQk.FfpVfPKV4tMLU1RBzmInB3_50JFuXESQopOoqQGg0i7ii3MCBPhByg72TP5RFfT6KPwxDu7WgU0vdG_EbQXHcwmaVn0Ifa38PDJLXWHKCJjeOfpb2dC9V1R09RWy8mgxs7B7kvWCW3VNOacXD1dExwB1idw9nBP3ahqEFgnSMSXV7m.F16F45PZkuITgBV72gt46V0TSolQtffqp32s3Ll4uVtLdtLBsPwYGMlVAfRE44OSdA', cITimeS: '1734441846', refresh: function(){ if(window['parent']){ window['parent'].postMessage({ source: 'cloudflare-challenge', widgetId: 'f8dyj', nextRcV: 'eATZcCAG8Y3zlOWH4H5mERNViexzVv48_C_hsxiwibc-1734441846-1.3.1.1-iWqrLu.bQiUq1zDHesvSFlkOTSzEXtjeS3ZJ_ayQutI', event: 'reloadRequest', }, ""); } } }; var handler = function(event) { var e = event.data; if (e.source && e.source === 'cloudflare-challenge' && e.event === 'meow' && e.widgetId === window._cf_chl_opt.chlApiWidgetId) { if(window['parent']){ window['parent'].postMessage({ source: 'cloudflare-challenge', widgetId: window._cf_chl_opt.chlApiWidgetId, event: 'food', seq: e.seq, }, ''); } } } window.addEventListener('message', handler); }());
URL: https://construction-sealants-ltd.jimdosite.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "New PDF Document Received", "prominent_button_name": "Review Document Here", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_security_alerts": false }

URL: https://construction-sealants-ltd.jimdosite.com/ Model: Joe Sandbox AI	{ "brands": [ "Construction Sealants Ltd", "Jimdo" ] }
	{ "brands": [ "Construction Sealants Ltd", "Jimdo" ] }
URL: https://jimdosite.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://jimdosite.com

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.01646459116556
Encrypted:	false
SSDEEP:
MD5:	EA84325064C7EF8C91084A248600D30E
SHA1:	A15EEFA920BAE968C313E4A1776431BD30716514
SHA-256:	36B0F718ED8E9D4FD8CD62A16FF38DDD2937A82FBCDCDF277A96BD4E2E558358
SHA-512:	2D04BC7314B748F73E5183996AE604521B7F7CA02DA39FA54477AF8014A32B8CE6391599A21E50AEC3853F893B8E252A0DACB1D2BAE89C57ECD17A002B24E633
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.j....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.j....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.j....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.j...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........=..T.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 17 12:23:43 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.008159702070473
Encrypted:	false
SSDEEP:
MD5:	CC5DA2005E97FB9D3FA12A58C2F41028
SHA1:	6DDEDBA9896FBE12AAEDE219255A904A0A519736
SHA-256:	4B5D455C9524ABBBBC6E0D3CC0B8AF5DE5DD7A8BE01979086ABE0D746091DB05
SHA-512:	4CB5D92F951D7F97EE1C31C4D8FB0DE46CC8DBBCC68E7B8204CAF5CCD49690AC2DD04C0AAEBDEBC02EF2145EC9349351A638635999EB131A554007F9AF73547F
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....Q...P......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.j....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.j....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.j....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.j...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.j...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........=..T.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 17 12:23:43 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.007238388164584
Encrypted:	false
SSDEEP:
MD5:	930DAEFE933958D0609319F96BDD7309
SHA1:	73D95A334A0C4FA842EF30A9F9CE771D4EA7ADFB
SHA-256:	6611F0799EA2CC4D404DBCE1053B42E71325DB8784486CB6B329867ACB23337B
SHA-512:	4EC3C0511C65F2B25A081CDF4B6EF681E069F92A2E51749C0754231BA195B44AC32463B4EC7670087A4B98456F9A75EB5E3BFBE67195943B4461751FA7FA9EFB
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....'w..P......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.Y.j....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.j....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.Y.j....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.Y.j...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.j...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........=..T.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	549
Entropy (8bit):	6.943052302431237
Encrypted:	false
SSDEEP:
MD5:	FD400ADA20E53B4BB4EFBBEB0C0E16FD
SHA1:	16C4AEFE874E9B5952A1E72528E1011BD38D8772
SHA-256:	E29475FE49A5A23D5ECA32E07367AA425D4A1F32D75DFE7E6D8D0398C35802CE
SHA-512:	3B144B04507C840A7A0A350480B4846D4A37B98551DA2B993879FE5995A48FCAAB0C3967ACDE6B57C6FEB3FB43E3F28B5CBFB7D69B9E8FDBF573EFD577626967
Malicious:	false
Reputation:	unknown
URL:	https://jimdo-dolphin-static-assets-prod.freetls.fastly.net/renderer/static/default-website-favicon.1a874ea70dbf3a4b0e0e..png
Preview:	.PNG........IHDR... ... .....D.......sRGB.........PLTE...........'..1..4...........&........H..H..7.......!K!#M.......5.....J..D&(Q56].....;.......8..;...........WXw68^[\{...st...G........@\^\|...OPqtu.......gh.JKm......ACf..2..9UVv...........OQr..8.x.....:tRNS..Y...Y....Y..............................................7......IDAT8..W..0..O.I.`..{...?e..D`.O......0,.D.D..I$&......T.@..A..:.1@.._<A.t6....A.vN...@&K..'.....@....+.Vk.W.lZoP.l1.F.......C...xb.....\|.D.....o....n...G.......f.....K.}hqB.............{.!zf1;.....IEND.B`.

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8824), with no line terminators
Category:	downloaded
Size (bytes):	8824
Entropy (8bit):	5.737826514104679
Encrypted:	false
SSDEEP:
MD5:	910A68EF8441D04EB449CE4FE9B8281F
SHA1:	5F097122406B7A813974F14A9E4E49B24BA89EC5
SHA-256:	133E88C191691D91D167D43EFAF7FAF8E3DFCF16A4DF33F634B6FFE6A727A9B5
SHA-512:	8D2357C8A14D7922C915EA68563549746F63BE8A6D783FC007542F8EB0732BCCA485450AF5257D0FD35507FC65C8F7D5E5BB37E87DD458AAA37728658B865BB5
Malicious:	false
Reputation:	unknown
URL:	https://construction-sealants-ltd.jimdosite.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?
Preview:	window._cf_chl_opt={cFPWv:'b'};~function(W,h,i,j,k,o,s,x){W=b,function(d,e,V,f,g){for(V=b,f=d();!![];)try{if(g=-parseInt(V(467))/1(parseInt(V(502))/2)+parseInt(V(413))/3(-parseInt(V(428))/4)+parseInt(V(409))/5(parseInt(V(510))/6)+-parseInt(V(506))/7(-parseInt(V(509))/8)+-parseInt(V(438))/9*(-parseInt(V(424))/10)+-parseInt(V(492))/11+-parseInt(V(425))/12,e===g)break;else f.push(f.shift())}catch(E){f.push(f.shift())}}(a,368678),h=this\|\|self,i=h[W(497)],j={},j[W(418)]='o',j[W(487)]='s',j[W(407)]='u',j[W(511)]='z',j[W(499)]='n',j[W(399)]='I',j[W(474)]='b',k=j,h[W(457)]=function(g,E,F,G,a1,I,J,K,L,M,N){if(a1=W,null===E\|\|void 0===E)return G;for(I=n(E),g[a1(462)][a1(400)]&&(I=I[a1(479)](g[a1(462)][a1(400)](E))),I=g[a1(433)][a1(514)]&&g[a1(419)]?g[a1(433)][a1(514)](new g[(a1(419))](I)):function(O,a2,P){for(a2=a1,O[a2(488)](),P=0;P<O[a2(449)];O[P]===O[P+1]?O[a2(496)](P+1,1):P+=1);return O}(I),J='nAsAaAb'.split('A'),J=J[a1(393)][a1(408)](J),K=0;K<I[a1(449)];L=I[K],M=m(g,E,L),J(M)?(N='s'===M&

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65458)
Category:	downloaded
Size (bytes):	5951227
Entropy (8bit):	5.614122146341247
Encrypted:	false
SSDEEP:
MD5:	A8C84540E657622E2AFECAA4C180F688
SHA1:	D1F382A687B674C61D85D8A9A8DF8AF06D25E8F0
SHA-256:	14517F8775FE2B471B4BAEB2541A4879C1615845F921FFDED290C448B2AC37FC
SHA-512:	4E56B8CE3002F58F9766B1E11287E5238891A6FCD89735706C2146448386F1DFF49C52B2DC0C2A442B05F057F81E535F33BFF6B7D58E20DFAFCE517B7C8FA933
Malicious:	false
Reputation:	unknown
URL:	https://jimdo-dolphin-static-assets-prod.freetls.fastly.net/renderer/static/dd36634b5e90c11d85d7.js
Preview:	/! For license information please see dd36634b5e90c11d85d7.js.LICENSE.txt /.(()=>{var e,t,n,i,a={58695:(e,t,n)=>{"use strict";n(33893).Cookie;var i=n(76046);t.u5=i.CKies,i.CookieOptions,i.CookieType},76046:(e,t,n)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0});var i,a,o=n(33893);!function(e){e.NECESSARY="necessary",e.FUNCTIONAL="functional",e.PERFORMANCE="performance",e.MARKETING="marketing"}(i=t.CookieType\|\|(t.CookieType={})),function(e){e.ALLOW="allow",e.DENY="deny"}(a=t.CookieOptions\|\|(t.CookieOptions={})),t.CONFIG_EXPIRATION=31536e6;var r=function(){function e(){}return e.getExpireDate=function(){var e=new Date;return e.setTime(e.getTime()+t.CONFIG_EXPIRATION),e},e.key=function(e){return"ckies_"+e},e.use=function(e){return e===i.NECESSARY\|\|(this.isOptIn()?o.Cookie.get(this.key(e))===a.ALLOW:o.Cookie.get(this.key(e))!==a.DENY)},e.deny=function(e){this.set(e,a.DENY)},e.allow=function(e){this.set(e,a.ALLOW)},e.useNecessary=function(){return this.use(i.NECESSARY)},e.

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 8000, version 1.0
Category:	downloaded
Size (bytes):	8000
Entropy (8bit):	7.97130996744173
Encrypted:	false
SSDEEP:
MD5:	72993DDDF88A63E8F226656F7DE88E57
SHA1:	179F97EC0275F09603A8DB94D4380EB584D81CD5
SHA-256:	F4E80D9DFD374D02989B87A27B5ED4CB78FBB177C27F1478E9A8B0AFB7513149
SHA-512:	7C20165F9D22A86341E841FD58526209017DCDE2AFE2D0D2A89FE853D95DC69F658D25CF798C71F452DAB09843FC808C1AE87A60B1284134163ABF5A1D93E50A
Malicious:	false
Reputation:	unknown
URL:	https://fonts.jimstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
Preview:	wOF2.......@......?@.................................`..T..t...6..6.$..h. ..T.....1E.r.8...KD......2.>L.......0..c.h...y_)s...N..(._C,/.v...7B...Z..gT@....u*.\t.9....{.&.;<...j.2.H-...A.S......E..)..f.Y8vuw^.^_.n{.Z..U.h..Kcm.........E..........'.J.-.-.......=.."...E...../R.8P....>?.]...R..Ag:.Pt..j..s..pG. .!f?.Q.T.".O.....D.r......3>gJN!V.\.!....+.......X.B.v....c9.&iW-[.,.. ...Q.k%I.s.%...d...8q..._~.C.n".v0..6B.eT..?..7.....l....3..7...M...5......k......^.....F.v~\|.....3N=.....[.!......}....F(...fA..c)0X$,FYL..=).(h<4...M5..<3.c....K/.{.p....3+'W...Z.[..;.w.....X....nx..v.(c;._.W......\|.b.....{...9..A6...V\|.N...Z?+\|H/.#.W%.._.8,...>._..w...RP..-.?.k7X..".._S.3,J.........&.8Gs.?yH.Yx......I_....._o.0K......(e.Q.W....=...J.7.\k.n.pd.....s..%...sD......_..&-...(.7..6.U..&<~8...9......uV..\|h.#m\.d./!....s.......b.j. ."...wX...B.`..Bj=......VnM....p..k.%..U.F..-VN).Y........_..W.p...B..\|.j..f..7....).~....n......c.3....t.......s..>...

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (7817)
Category:	downloaded
Size (bytes):	17238
Entropy (8bit):	5.461091402810924
Encrypted:	false
SSDEEP:
MD5:	D5E1D2B1A1C3504B3187ACA0F44DE6B6
SHA1:	5F92CB8A0EA38782C81D8433FA395D8C1934C75C
SHA-256:	9A1CC6A512CBA70C909E2182C366963DEEAA07378E35D77D3562166DDECA256B
SHA-512:	ACA19F7420E9CBC5C3432C1318C605D4E275F5A25B80662BFB2674AA48F40E0BC5BC63418D1B2FDB9710BAB347B871580B14E4E3F0FCA1270488A99144413B1A
Malicious:	false
Reputation:	unknown
URL:	https://construction-sealants-ltd.jimdosite.com/
Preview:	<!doctype html>.<html lang="en">. <head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">. <meta name="format-detection" content="telephone=no">. <link rel="preconnect" href="https://jimdo-dolphin-static-assets-prod.freetls.fastly.net/renderer/" crossorigin>. <link rel="preconnect" href="https://jimdo-storage.freetls.fastly.net/" crossorigin>. <link rel="preconnect" href="https://fonts.jimstatic.com/" crossorigin>. <link rel='shortcut icon' type='image/png' href="https://jimdo-dolphin-static-assets-prod.freetls.fastly.net/renderer/static/default-website-favicon.1a874ea70dbf3a4b0e0e..png" />. <title>Home \| Construction Sealants Ltd</title>. <script>. window.__dolphin_environment__ = 'prod';. </script>. . <meta name="robots" content="noindex, nofollow, noarchive"><meta name="twitter:card" content="summary_large_image">.<meta property="og:type" content="website">.<meta property="og:title" content="Hom

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (13643)
Category:	downloaded
Size (bytes):	136628
Entropy (8bit):	5.511430134506631
Encrypted:	false
SSDEEP:
MD5:	A5AEFE6D38A1AD99175F9BB9A369AD2B
SHA1:	D27CC3BA0B87863E61EB3EDBCB421C4EFBE96451
SHA-256:	8E6D9E10E77CC154D1C4852A8D0999ACE6E3CA3A7DBE650ADF91FFD8241FE0D9
SHA-512:	350D41C796D5C8934AB01BBBB65102175611F957DAC91681D05CA25BE429FE03C1AEEDE54BED473A9D158931CBC6FEC8B114D73A6425D05D33F8401C3250F47F
Malicious:	false
Reputation:	unknown
URL:	https://jimdo-dolphin-static-assets-prod.freetls.fastly.net/renderer/static/dce59a6d0d9d29d0455f.css
Preview:	.rdtDR{position:relative;z-index:3;width:100%}.EiaDC{z-index:4}.eP8Dq{display:flex;flex-direction:column}...hcw3J{color:#323335}.hcw3J a:hover{color:#535353}.KNvh9{color:#fff}.KNvh9 a:hover{color:#dcdcdc}..sTtmz{word-wrap:break-word;word-break:break-word;overflow-wrap:break-word;box-sizing:border-box;width:100%;padding:20px 0}.sTtmz.FG8T_{padding:5px}.sTtmz a,.sTtmz a:hover{color:inherit}.sTtmz ol,.sTtmz ul{margin:0 0 0 30px;padding:0}.jkRjK h1,.jkRjK h2,.jkRjK h3,.jkRjK h4,.jkRjK h5,.jkRjK h6,.jkRjK li,.jkRjK p{display:inline;margin-right:4px;font-weight:400;font-size:18px}..YH0K9{position:relative;width:100%;padding:0;line-height:0}.YH0K9.gBwSj{background:#181818}.YH0K9.gBwSj.S5qxR{background:none}.YH0K9.BuD0P{background:#f2f2f2}.YH0K9.aPnO4{background:#fff}.YH0K9.mLGql{margin:auto}.YH0K9.bDzAf,.YH0K9.zDzDH{flex-grow:1}.YH0K9 iframe{width:100%;height:500px;border:0}.YH0K9 iframe.sK02L{height:232px}.YH0K9 iframe.GZWz7{height:450px}.YH0K9 iframe.U5VF7{height:175px}.gszAl{position:relat

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 160x97, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	3652
Entropy (8bit):	7.915844365889926
Encrypted:	false
SSDEEP:
MD5:	AEA1AB7D5469887B557739ED41C96403
SHA1:	B03A5160E586F9182509D1B7CE0BDA18B1BD6998
SHA-256:	76AE0CC29FE1817DCD31E2417AF4E136B34DEC64342F1ED68559A0BDDD85CBB8
SHA-512:	882EA88B718BA106CB44644678F3FCB2469709B18E1D2B50DD507EE3607393E9AB289BF4B1D5652DD36183B4BAF6F3BE1F3B44DBC592072B824AE9749BDF4612
Malicious:	false
Reputation:	unknown
URL:	"https://jimdo-storage.freetls.fastly.net/image/495347646/cc35b4b9-c1e5-4ee9-9f3e-e8e67b4d5507.jpg?format=pjpg&quality=80,90&auto=webp&disable=upscale&width=160&height=97&trim=0,836,0,0"
Preview:	RIFF<...WEBPVP8 0....=.....a.>1..B.!!.fP ....j. ?U.......j....O ..........9._.'._.>.....0;Dy..{...P.3.7...W.N...aO.oL...........\|...............>...h...............K....... .1.+.....?.~Y...j.w......?..T.g.7}u....d...7....?.........[.../.o.....z..\|.{..j..D....0+.....z..ar.73Hz...,..J.@RW..%dc....).C2.6...J0.eo;...(....y.....#.R.\|d..+t.Tt..5..x.f0.:k.\.@.%.}...S..+rh.qZ_h8q.......>!..4.W.4..\|....<.......0.....j).,,Y....,).....t...{..rlJ......8....U.".p.......vh...".5......"..D...!_e...wQ......j...2.:.G.2>#9.#...5.l.G..".-.......:.u.:.#hA....;".".4.\......s?0S.....!.wS._.m]..^.p.M4v.4.MT".)..{g.u..pG...4\|.%(....m.+..7\|...W./.T%.k_...N............;.....Z...nU>...1.z.......=h".%.X9.......0.W...Vn....!.]..K._..F.dp......p0..].w....yR..E._.?9(.......]...h,9.xv......N....KE.D.T.4..fF.\..Soo...KI.h.34...i{...i....w.3...G.}..Ek.W.......lDg../.$sg..r.[.....w..W..\|_W".L..H.W...7P..G.u.SvfUO...O...........)./_h:.x7rB..h.a..6a(.j.@..x....@3

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18596, version 1.0
Category:	downloaded
Size (bytes):	18596
Entropy (8bit):	7.988788312296589
Encrypted:	false
SSDEEP:
MD5:	C83E4437A53D7F849F9D32DF3D6B68F3
SHA1:	FABEA5AD92ED3E2431659B02E7624DF30D0C6BBC
SHA-256:	D9BADA3A44BB2FFA66DEC5CC781CAFC9EF17ED876CD9B0C5F7EF18228B63CEBB
SHA-512:	C2CA1630F7229DD2DEC37E0722F769DD94FD115EEFA8EEBA40F9BB09E4FDAB7CC7D15F3DEEA23F50911FEAE22BAE96341A5BACA20B59C7982CAF7A91A51E152F
Malicious:	false
Reputation:	unknown
URL:	https://fonts.jimstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Preview:	wOF2......H...........H=................................\|.`..J.H..<........>..Z...x.6.$..0. ..~. ..)...%.m..t.D<...U.c....D....@........@e..a..R./<...p..q..q....S<.nm...X..(ER....e.....O.?Q_..FYH......ml.E..?;X0>.f.Y.,.n.a...._h8c.006U.cS..3.m.Or..I9..5.;.=..'!..c.O...W.K..f....k..&Xq..Y?.r...%.S..y.:q.......uD.d.R..'..Q,L.... e`..=?.{...e%{.....3+$.....NkF2...... ._}..2]....,.F.u.S4O.~w).G..../]}6.nVwKj.h@........5.7P....i..r........U?.........q..Cm......g...\.zu.....P..\|....5G$...4k$..L..g..".y..?..6...O...e..@..0TYh..v........M.....#B...O.i.G$.Bq..m.A.s~...A...c.....25K.....B..<..w.A....G.O...A......A,y"q....q<....N..{Ta..!.\|vzo.;9.5>.>....7I.i.Ld.4..y...].g.....'m_(...O-..}.K.(....R..2.q.z9.D..]..$.#$.:x..:{..m.OF...K[J. ......lpH.#%V....4.;l.<..J.6.T..a...I..\|..zj.k.-...y...#..e.1,s....<.HX.....z{L....'.$. "..tY..m.<.\8P. a.......x.W\.b.%...RA.\.... M.......v1......#...............`.c..%.Nc.d.qP.68....$<.O.S_7...U.].jn>@.3.c..wO..>.>a.qg....\..kb.

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47691)
Category:	downloaded
Size (bytes):	47692
Entropy (8bit):	5.4016459163756165
Encrypted:	false
SSDEEP:
MD5:	9046FDD8B20F930F537279DEDE41E747
SHA1:	EBB905F60D71F45D056D42E6096736EA8C2D4BD9
SHA-256:	5AAC9E52F80011983676C03AD8120E0369E651E6357D0B05054026A3BC8EC32D
SHA-512:	F289C718B32D9E75E5725116D7696070C840426310B2A75E3EE66933E50B85BF738B4015FCFB8BAF7A8545B600B9820D85F8BB41C055FB0877C1420655E5E975
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/turnstile/v0/b/787bc399e22f/api.js
Preview:	"use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Ht(u,o,c,g,h,"next",l)}function h(l){Ht(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	4802
Entropy (8bit):	5.415883081641602
Encrypted:	false
SSDEEP:
MD5:	A90A2E5B9A3C097A815681A49DA9E6A1
SHA1:	1142CB363AB1A35E64546ED886CFD00B5093F504
SHA-256:	308FCE1E8CC31B982E8ED8A78A0729F7935F0056FDCE41483C59691B1339599E
SHA-512:	B006B37B8EBF9FFBF3291AB773CE36E6F8AC671FE63DF080596C102E5651CB7B12FDBE407645ACFF84101EDDD777564BED23B66B12EC10CFE30B6420643B58E8
Malicious:	false
Reputation:	unknown
URL:	"https://fonts.jimstatic.com/css?display=swap&family=Roboto:400,700"
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.jimstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.jimstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu5mxKOzY.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.jimstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7mxKOzY.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.jimstat

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 160x97, components 3
Category:	dropped
Size (bytes):	4586
Entropy (8bit):	7.519959268030158
Encrypted:	false
SSDEEP:
MD5:	5B6DA7E91B2985CB99EACD5EE277E11D
SHA1:	945AE197E9BDE878917235096AFB9012E345C999
SHA-256:	D7FF6140CF1479EC1E70A8860C2A264CFB3EC27CA37085066FDD0EB6E902F60B
SHA-512:	30B2F4FD10A3E0B3B797BF4F9BAED5744C5EECCEB1E4F02BC808BC46E6C1E911B68D52D9E7FE5BB5DC54FCB2713F888D207883BB08AC8E2999BB5136951F99C8
Malicious:	false
Reputation:	unknown
Preview:	......JFIF..............ICC_PROFILE.......lcms....mntrRGB XYZ .........).9acspAPPL...................................-lcms................................................desc.......^cprt...\....wtpt...h....bkpt...\|....rXYZ........gXYZ........bXYZ........rTRC.......@gTRC.......@bTRC.......@desc........c2..................................................................................text....FB..XYZ ...............-XYZ ...........3....XYZ ......o...8.....XYZ ......b.........XYZ ......$.........curv...............c...k...?.Q.4!.).2.;.F.Qw].kpz....\|.i.}...0.....C............................."......".$...$.6&&6>424>LDDL_Z_\|\|....C............................."......".$...$.6&&6>424>LDDL_Z_\|\|.......a...."................................................................................&Ww1.J..e%...[........z.j..1....!....$r.N.....zV..Be.n...W.<.Y~'Yx6;eU.....w.x;...Y..v.r...:....Fm...Z.+...\|C.U.....m".W...j......~.N.....$.c^}...X....`.3.<.!.Q..%[T.E...'kB.9...CHoG...k.B2d....

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1700
Entropy (8bit):	5.33845854465642
Encrypted:	false
SSDEEP:
MD5:	D4D3BF56F6DCF7B0220086286683B0DB
SHA1:	3F62226BD5AC9DF07A47BACE316C7348E27809DA
SHA-256:	2312D413C757DA161B5B3FE8394ACC86414CC6888937866918B68EAD29222083
SHA-512:	F1259EB6A04CBCFA9C7A0AAFE0B0A8D470F0FD273B9EF96E9C0710391659943D74C552016B70401B2777486FCAEE60121CF879AF30300D4E3D7F45AE90330AFD
Malicious:	false
Reputation:	unknown
URL:	"https://fonts.jimstatic.com/css?display=swap&family=Poppins:600,700"
Preview:	/* latin-ext /.@font-face {. font-family: 'Poppins';. font-style: normal;. font-weight: 600;. font-display: swap;. src: url(https://fonts.jimstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLEj6Z1JlFc-K.woff2) format('woff2');. unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin /.@font-face {. font-family: 'Poppins';. font-style: normal;. font-weight: 600;. font-display: swap;. src: url(https://fonts.jimstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2) format('woff2');. unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;.}./ latin-ext */.@font-face {. font-family: 'Poppins';. font-style: normal;. font-weight: 700;. font-display: swap;. src: url(https://fonts.jimsta

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18536, version 1.0
Category:	downloaded
Size (bytes):	18536
Entropy (8bit):	7.986571198050597
Encrypted:	false
SSDEEP:
MD5:	8EFF0B8045FD1959E117F85654AE7770
SHA1:	227FEE13CEB7C410B5C0BB8000258B6643CB6255
SHA-256:	89978E658E840B927DDDB5CB3A835C7D8526ECE79933BD9F3096B301FE1A8571
SHA-512:	2E4FB65CAAB06F02E341E9BA4FB217D682338881DABA3518A0DF8DF724E0496E1AF613DB8E2F65B42B9E82703BA58916B5F5ABB68C807C78A88577030A6C2058
Malicious:	false
Reputation:	unknown
URL:	https://fonts.jimstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......Hh..........H..............................Z..\|.`..J.T..<.....H..U..Z...x.6.$..0. ..t. ..I....p.0.VU.......1....AQ...d..x.....R..4.-.c..C$fUc.c..IX..@..~g.xs.....%...O...eJ.w..U.\|.......%..{.......U+..T#.S......`.n.....V.w.4..~P"..zk.%..../........=3...F.........V.FL..;Bc.........A.Uk.U1.b!Y.BH.DL...s.s...F.m.9a..GJ..1..#.`m5..DI..X5#.........B.Akm.....&..0...{.L.....G......-(.......O4.@3....=......f..l...$.....j..NO...e.Y.tJ2J>F.(.c....08..e...~....D2S7s:.G'Gm........!.7.........r.c.`,.....~.).......c>1.......Y.g2^...T-1.7./r./....>...g.ov@u.?.U.+._...'M..,.,g....!g..9."..yBF.#r+.Ps...%.d=....U...5.b.$:`.4R.II.<A....Q)....e...k.....M.8.z....+.....5}..F........F.d._...].~-](.Lf....Y..W....;-z...;. .@x._v../.%UIm....=s...P.C....G...^..Q.!g.!b._.P....at..?.}....t.z...O(..Y6..R.2.X....k.R..K.gw(.F.K?m..R...7....dj..7. .r.U..be.4......8.].w.B..B......Y..:..8.N..U...NEm...\.^q..f}.......{..6.". ...y-.Y...N.+.M E..`......R.$T

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8802), with no line terminators
Category:	dropped
Size (bytes):	8802
Entropy (8bit):	5.736411872124196
Encrypted:	false
SSDEEP:
MD5:	FC503C267CE6C69E4AE4859909D1BEAF
SHA1:	F0764C65A5155C4C3B7BBB94D7E663E43EED6665
SHA-256:	E2F3BBD6A9E1342A5D8BD63BE287A302F9E7B86258671915CB667A0ABB16C780
SHA-512:	C6CB1AF687FA2628AF7C659A3D997A30405751CC1BAEC458A716FD2B73B075E050FDD7D7A474486B397F36C56D7B787FED777856D8CEFAF85A70A544AFFC7F4E
Malicious:	false
Reputation:	unknown
Preview:	window._cf_chl_opt={cFPWv:'b'};~function(W,h,i,n,o,y,z,B){W=b,function(c,d,V,e,f){for(V=b,e=c();!![];)try{if(f=-parseInt(V(497))/1+parseInt(V(441))/2(parseInt(V(417))/3)+parseInt(V(455))/4(parseInt(V(403))/5)+-parseInt(V(413))/6(parseInt(V(472))/7)+parseInt(V(482))/8(parseInt(V(401))/9)+parseInt(V(438))/10+-parseInt(V(516))/11*(-parseInt(V(490))/12),f===d)break;else e.push(e.shift())}catch(E){e.push(e.shift())}}(a,926538),h=this\|\|self,i=h[W(463)],n={},n[W(519)]='o',n[W(430)]='s',n[W(410)]='u',n[W(471)]='z',n[W(468)]='n',n[W(405)]='I',n[W(481)]='b',o=n,h[W(514)]=function(E,F,G,H,a8,J,K,L,M,N,O){if(a8=W,F===null\|\|F===void 0)return H;for(J=x(F),E[a8(483)][a8(419)]&&(J=J[a8(451)](E[a8(483)][a8(419)](F))),J=E[a8(462)][a8(486)]&&E[a8(442)]?E[a8(462)][a8(486)](new E[(a8(442))](J)):function(P,a9,Q){for(a9=a8,P[a9(446)](),Q=0;Q<P[a9(499)];P[Q+1]===P[Q]?P[a9(423)](Q+1,1):Q+=1);return P}(J),K='nAsAaAb'.split('A'),K=K[a8(407)][a8(522)](K),L=0;L<J[a8(499)];M=J[L],N=v(E,F,M),K(N)?(O='s'===N&&!E[

Static File Info

⊘No static file info

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://disruptivc-dot-yamm-track.appspot.com/Redirect?ukey=1-0q8XPD2_exH3GZm9N9GPlcuW7DeTrX4WZWK6ta6DkQ-0&key=YAMMID-76523483&link=https://construction-sealants-ltd.jimdosite.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Static File Info

Windows Analysis Report
https://disruptivc-dot-yamm-track.appspot.com/Redirect?ukey=1-0q8XPD2_exH3GZm9N9GPlcuW7DeTrX4WZWK6ta6DkQ-0&key=YAMMID-76523483&link=https://construction-sealants-ltd.jimdosite.com