Edit tour

Windows Analysis Report
http://url4659.orders.vanillagift.com/ls/click?upn=u001.4gSefN7qGt7uZc-2BljvSfDuK9c6f7zz-2BRDdNLkOmxp-2BfCpVRV4q5JSM05F18NmhW9aTh4D-2B-2FvKc3l62XSGdMxHErqjDyHVaRGnhWtdaxelWfxz8x2-2FY7A4qgb3tzDonO-2BR4v55hRVWLW8mGedQ4WKyhGmLG6TdN0VE3FuoaMfqbWnIJZADjzcMmwi0-2FbwmmeKkdfIhUk0sBHSi9RcRmdsfuOZwL5O2zEB6UFf

Overview

General Information

Sample URL:	http://url4659.orders.vanillagift.com/ls/click?upn=u001.4gSefN7qGt7uZc-2BljvSfDuK9c6f7zz-2BRDdNLkOmxp-2BfCpVRV4q5JSM05F18NmhW9aTh4D-2B-2FvKc3l62XSGdMxHErqjDyHVaRGnhWtdaxelWfxz8x2-2FY7A4qgb3tzDonO-2BR4
Analysis ID:	1579072

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

AI detected suspicious Javascript

HTML page contains obfuscated javascript

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 5980 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6624 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1988,i,7980607154594454556,4940575554058510068,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2996 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://url4659.orders.vanillagift.com/ls/click?upn=u001.4gSefN7qGt7uZc-2BljvSfDuK9c6f7zz-2BRDdNLkOmxp-2BfCpVRV4q5JSM05F18NmhW9aTh4D-2B-2FvKc3l62XSGdMxHErqjDyHVaRGnhWtdaxelWfxz8x2-2FY7A4qgb3tzDonO-2BR4v55hRVWLW8mGedQ4WKyhGmLG6TdN0VE3FuoaMfqbWnIJZADjzcMmwi0-2FbwmmeKkdfIhUk0sBHSi9RcRmdsfuOZwL5O2zEB6UFf08dp06kJXruK-2BF70HVCIIa3GSMCo48RLkzWG8dEOH-2FBZmckwy2IyrmhGk7TORgwM5bk4PbUxQPoYKq7IdXZDoj7BBWFZXgs6KkXD1kVfgQOsMLEKQeTvK5ATiMGw5YUv9FTPZiWgh4O-2B6hR3uc5gCam5ygOCJsmG3ya5dOP3AzZxmtrQO2ixrFnkLK-2Bkk5ChvTn26C-2BioOkvRUSczMMaDc3goe-2FffK-2FLybPlPtaG8BM0aogkRmbjy7uKwhjOW-2BFQyWewVzg-3DIgAR_79LTZgGyJjQA0yKF2CHqblXBaDJuc2sNW7Piu5vjvmdwcqDrB-2Buw9ZQukwHO-2BFDa1Pj-2BnPyP1wnuiUj8o1jeVFZ-2B0yTi1w6olXhC5xGcnSuX-2FPX8EC9nfY-2B3npShVzZ4Fae90bxak04TDiCsiP7PmtAOagYeRI4FU2qDP2MtD3eIC1vtRjmGkonGMDUW1rPFYKa2pBviC8swsnzOU26q7ssqOo-2FLjO6-2B2IyWprhTXXBsBk2HZWehLV3F8Prl0XOgIIe0Oi6f3V8mliLO9NN8Iw-3D-3D" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://balance.vanillagift.com/loginDetails?tx_transdata=mS3mfNgvBO5POFsK+9NDXeE+AmrHdTUkzn+0qqYHU1UHQxT4AV7kA/laUiNnvz1nh2Ve41JpOnG2O/3gVAD9srI4H0GV+dZ+Ty+fNZPtT0yRAQiWxAx0TxAfaG/KXsBkFXMdvJ2cnll94iffXq56lR1Gm373PDavG1w91MgV8ZY+dZ0VmdonQe20f6nBEKgK&tx_transdataiv=XMNaNYH07u3/yTF4WuUtaQ==&transaction_id=Vanilla817ff2f6-75d3-4f55-bfa7-a50dddd39f74	Joe Sandbox AI: Score: 8 Reasons: The URL 'balance.vanillagift.com' does not match the legitimate domain 'imperva.com'., The brand 'Imperva' is known and typically associated with cybersecurity solutions, not gift card services., The domain 'vanillagift.com' is associated with Vanilla Gift, a brand known for prepaid gift cards, which does not align with Imperva's services., The presence of 'balance' as a subdomain suggests a service related to checking gift card balances, which is unrelated to Imperva., The URL structure and brand association do not align, indicating a potential phishing attempt. DOM: 1.3.pages.csv
Source: https://balance.vanillagift.com/loginDetails?tx_transdata=mS3mfNgvBO5POFsK+9NDXeE+AmrHdTUkzn+0qqYHU1UHQxT4AV7kA/laUiNnvz1nh2Ve41JpOnG2O/3gVAD9srI4H0GV+dZ+Ty+fNZPtT0yRAQiWxAx0TxAfaG/KXsBkFXMdvJ2cnll94iffXq56lR1Gm373PDavG1w91MgV8ZY+dZ0VmdonQe20f6nBEKgK&tx_transdataiv=XMNaNYH07u3/yTF4WuUtaQ==&transaction_id=Vanilla817ff2f6-75d3-4f55-bfa7-a50dddd39f74	Joe Sandbox AI: Score: 8 Reasons: The URL 'balance.vanillagift.com' does not match the legitimate domain 'imperva.com'., The brand 'Imperva' is known and typically associated with cybersecurity solutions, not gift card services., The domain 'vanillagift.com' is associated with Vanilla Gift, a brand known for prepaid gift cards, which does not align with Imperva's services., The presence of 'balance' as a subdomain suggests a service related to checking gift card balances, which is unrelated to Imperva., There is no direct association between the brand 'Imperva' and the domain 'vanillagift.com'. DOM: 1.5.pages.csv

AI detected suspicious Javascript

Source: 0.2.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://balance.vanillagift.com/loginDetails?tx_tr... This script demonstrates high-risk behavior by dynamically loading a script from a suspicious, obfuscated URL. The combination of dynamic code execution, obfuscated URLs, and the potential for data exfiltration or malicious payload delivery indicates a high likelihood of malicious intent.
Source: 1.9..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://balance.vanillagift.com/tis-them-Ported-I-... The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. While the script may have some legitimate purposes, the overall risk level is high due to the potential for malicious activities.
Source: 0.8.i.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://balance.vanillagift.com/_Incapsula_Resourc... This script demonstrates several high-risk behaviors, including data exfiltration and redirects to a suspicious domain. The script sends the user's reCAPTCHA response to an `/_Incapsula_Resource` endpoint, which is likely a domain associated with the Incapsula web application firewall. This behavior could be indicative of a phishing or credential harvesting attempt. Additionally, the script reloads the parent window's page, which could be used to hide malicious activity or redirect the user to a malicious site. Overall, the combination of data exfiltration, suspicious domain interaction, and potential redirection makes this script a high-risk concern.

HTML page contains obfuscated javascript

Source: https://balance.vanillagift.com/runtime.184c0088c4e911ed.js

HTTP Parser: (function(_0x4d39f5,_0x3cd07e){var _0x21227e={_0x17e653:0x9c,_0x16dd27:0xa1,_0x292e68:0xaf,_0x196e5d

Source: https://balance.vanillagift.com/loginDetails?tx_transdata=mS3mfNgvBO5POFsK+9NDXeE+AmrHdTUkzn+0qqYHU1UHQxT4AV7kA/laUiNnvz1nh2Ve41JpOnG2O/3gVAD9srI4H0GV+dZ+Ty+fNZPtT0yRAQiWxAx0TxAfaG/KXsBkFXMdvJ2cnll94iffXq56lR1Gm373PDavG1w91MgV8ZY+dZ0VmdonQe20f6nBEKgK&tx_transdataiv=XMNaNYH07u3/yTF4WuUtaQ==&transaction_id=Vanilla817ff2f6-75d3-4f55-bfa7-a50dddd39f74

HTTP Parser: Base64 decoded: <svg width="58" height="16" viewBox="0 0 58 16" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M0.634903 2.31149H2.94639V0H0.634903V2.31149ZM55.9665 12.8435H54.8109V15.1546H57.1224V12.8435H55.9665Z" fill="...

Source: https://balance.vanillagift.com/loginDetails?tx_transdata=mS3mfNgvBO5POFsK+9NDXeE+AmrHdTUkzn+0qqYHU1UHQxT4AV7kA/laUiNnvz1nh2Ve41JpOnG2O/3gVAD9srI4H0GV+dZ+Ty+fNZPtT0yRAQiWxAx0TxAfaG/KXsBkFXMdvJ2cnll94iffXq56lR1Gm373PDavG1w91MgV8ZY+dZ0VmdonQe20f6nBEKgK&tx_transdataiv=XMNaNYH07u3/yTF4WuUtaQ==&transaction_id=Vanilla817ff2f6-75d3-4f55-bfa7-a50dddd39f74	HTTP Parser: No favicon
Source: https://balance.vanillagift.com/loginDetails?tx_transdata=mS3mfNgvBO5POFsK+9NDXeE+AmrHdTUkzn+0qqYHU1UHQxT4AV7kA/laUiNnvz1nh2Ve41JpOnG2O/3gVAD9srI4H0GV+dZ+Ty+fNZPtT0yRAQiWxAx0TxAfaG/KXsBkFXMdvJ2cnll94iffXq56lR1Gm373PDavG1w91MgV8ZY+dZ0VmdonQe20f6nBEKgK&tx_transdataiv=XMNaNYH07u3/yTF4WuUtaQ==&transaction_id=Vanilla817ff2f6-75d3-4f55-bfa7-a50dddd39f74	HTTP Parser: No favicon
Source: https://balance.vanillagift.com/loginDetails?tx_transdata=mS3mfNgvBO5POFsK+9NDXeE+AmrHdTUkzn+0qqYHU1UHQxT4AV7kA/laUiNnvz1nh2Ve41JpOnG2O/3gVAD9srI4H0GV+dZ+Ty+fNZPtT0yRAQiWxAx0TxAfaG/KXsBkFXMdvJ2cnll94iffXq56lR1Gm373PDavG1w91MgV8ZY+dZ0VmdonQe20f6nBEKgK&tx_transdataiv=XMNaNYH07u3/yTF4WuUtaQ==&transaction_id=Vanilla817ff2f6-75d3-4f55-bfa7-a50dddd39f74	HTTP Parser: No favicon
Source: https://balance.vanillagift.com/loginDetails?tx_transdata=mS3mfNgvBO5POFsK+9NDXeE+AmrHdTUkzn+0qqYHU1UHQxT4AV7kA/laUiNnvz1nh2Ve41JpOnG2O/3gVAD9srI4H0GV+dZ+Ty+fNZPtT0yRAQiWxAx0TxAfaG/KXsBkFXMdvJ2cnll94iffXq56lR1Gm373PDavG1w91MgV8ZY+dZ0VmdonQe20f6nBEKgK&tx_transdataiv=XMNaNYH07u3/yTF4WuUtaQ==&transaction_id=Vanilla817ff2f6-75d3-4f55-bfa7-a50dddd39f74	HTTP Parser: No favicon
Source: https://balance.vanillagift.com/loginDetails?tx_transdata=mS3mfNgvBO5POFsK+9NDXeE+AmrHdTUkzn+0qqYHU1UHQxT4AV7kA/laUiNnvz1nh2Ve41JpOnG2O/3gVAD9srI4H0GV+dZ+Ty+fNZPtT0yRAQiWxAx0TxAfaG/KXsBkFXMdvJ2cnll94iffXq56lR1Gm373PDavG1w91MgV8ZY+dZ0VmdonQe20f6nBEKgK&tx_transdataiv=XMNaNYH07u3/yTF4WuUtaQ==&transaction_id=Vanilla817ff2f6-75d3-4f55-bfa7-a50dddd39f74	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49741 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /ls/click?upn=u001.4gSefN7qGt7uZc-2BljvSfDuK9c6f7zz-2BRDdNLkOmxp-2BfCpVRV4q5JSM05F18NmhW9aTh4D-2B-2FvKc3l62XSGdMxHErqjDyHVaRGnhWtdaxelWfxz8x2-2FY7A4qgb3tzDonO-2BR4v55hRVWLW8mGedQ4WKyhGmLG6TdN0VE3FuoaMfqbWnIJZADjzcMmwi0-2FbwmmeKkdfIhUk0sBHSi9RcRmdsfuOZwL5O2zEB6UFf08dp06kJXruK-2BF70HVCIIa3GSMCo48RLkzWG8dEOH-2FBZmckwy2IyrmhGk7TORgwM5bk4PbUxQPoYKq7IdXZDoj7BBWFZXgs6KkXD1kVfgQOsMLEKQeTvK5ATiMGw5YUv9FTPZiWgh4O-2B6hR3uc5gCam5ygOCJsmG3ya5dOP3AzZxmtrQO2ixrFnkLK-2Bkk5ChvTn26C-2BioOkvRUSczMMaDc3goe-2FffK-2FLybPlPtaG8BM0aogkRmbjy7uKwhjOW-2BFQyWewVzg-3DIgAR_79LTZgGyJjQA0yKF2CHqblXBaDJuc2sNW7Piu5vjvmdwcqDrB-2Buw9ZQukwHO-2BFDa1Pj-2BnPyP1wnuiUj8o1jeVFZ-2B0yTi1w6olXhC5xGcnSuX-2FPX8EC9nfY-2B3npShVzZ4Fae90bxak04TDiCsiP7PmtAOagYeRI4FU2qDP2MtD3eIC1vtRjmGkonGMDUW1rPFYKa2pBviC8swsnzOU26q7ssqOo-2FLjO6-2B2IyWprhTXXBsBk2HZWehLV3F8Prl0XOgIIe0Oi6f3V8mliLO9NN8Iw-3D-3D HTTP/1.1Host: url4659.orders.vanillagift.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: url4659.orders.vanillagift.com
Source: global traffic	DNS traffic detected: DNS query: balance.vanillagift.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: newassets.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: api.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: ssl.kaptcha.com
Source: global traffic	DNS traffic detected: DNS query: cdn.contentful.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49741 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.win@19/6@32/160

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1988,i,7980607154594454556,4940575554058510068,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://url4659.orders.vanillagift.com/ls/click?upn=u001.4gSefN7qGt7uZc-2BljvSfDuK9c6f7zz-2BRDdNLkOmxp-2BfCpVRV4q5JSM05F18NmhW9aTh4D-2B-2FvKc3l62XSGdMxHErqjDyHVaRGnhWtdaxelWfxz8x2-2FY7A4qgb3tzDonO-2BR4v55hRVWLW8mGedQ4WKyhGmLG6TdN0VE3FuoaMfqbWnIJZADjzcMmwi0-2FbwmmeKkdfIhUk0sBHSi9RcRmdsfuOZwL5O2zEB6UFf08dp06kJXruK-2BF70HVCIIa3GSMCo48RLkzWG8dEOH-2FBZmckwy2IyrmhGk7TORgwM5bk4PbUxQPoYKq7IdXZDoj7BBWFZXgs6KkXD1kVfgQOsMLEKQeTvK5ATiMGw5YUv9FTPZiWgh4O-2B6hR3uc5gCam5ygOCJsmG3ya5dOP3AzZxmtrQO2ixrFnkLK-2Bkk5ChvTn26C-2BioOkvRUSczMMaDc3goe-2FffK-2FLybPlPtaG8BM0aogkRmbjy7uKwhjOW-2BFQyWewVzg-3DIgAR_79LTZgGyJjQA0yKF2CHqblXBaDJuc2sNW7Piu5vjvmdwcqDrB-2Buw9ZQukwHO-2BFDa1Pj-2BnPyP1wnuiUj8o1jeVFZ-2B0yTi1w6olXhC5xGcnSuX-2FPX8EC9nfY-2B3npShVzZ4Fae90bxak04TDiCsiP7PmtAOagYeRI4FU2qDP2MtD3eIC1vtRjmGkonGMDUW1rPFYKa2pBviC8swsnzOU26q7ssqOo-2FLjO6-2B2IyWprhTXXBsBk2HZWehLV3F8Prl0XOgIIe0Oi6f3V8mliLO9NN8Iw-3D-3D"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1988,i,7980607154594454556,4940575554058510068,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
4qti24o.impervadns.net	45.60.13.91	true	false	unknown
js.hcaptcha.com	104.19.229.21	true	false	high
api.hcaptcha.com	104.19.229.21	true	false	high
sendgrid.net	167.89.118.95	true	false	high
www.google.com	142.250.181.132	true	false	high
newassets.hcaptcha.com	104.19.230.21	true	false	high
main-d.contentful.map.fastly.net	199.232.83.18	true	false	unknown
colle-elast-1xnsxgci0b78j-8180b06a6c06d9d4.elb.us-west-2.amazonaws.com	35.80.101.90	true	false	unknown
url4659.orders.vanillagift.com	unknown	unknown	false	unknown
ssl.kaptcha.com	unknown	unknown	false	unknown
cdn.contentful.com	unknown	unknown	false	unknown
balance.vanillagift.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://balance.vanillagift.com/loginDetails?tx_transdata=mS3mfNgvBO5POFsK+9NDXeE+AmrHdTUkzn+0qqYHU1UHQxT4AV7kA/laUiNnvz1nh2Ve41JpOnG2O/3gVAD9srI4H0GV+dZ+Ty+fNZPtT0yRAQiWxAx0TxAfaG/KXsBkFXMdvJ2cnll94iffXq56lR1Gm373PDavG1w91MgV8ZY+dZ0VmdonQe20f6nBEKgK&tx_transdataiv=XMNaNYH07u3/yTF4WuUtaQ==&transaction_id=Vanilla817ff2f6-75d3-4f55-bfa7-a50dddd39f74	true		unknown
https://balance.vanillagift.com/loginDetails?tx_transdata=mS3mfNgvBO5POFsK%209NDXeE%20AmrHdTUkzn%200qqYHU1UHQxT4AV7kA%2FlaUiNnvz1nh2Ve41JpOnG2O%2F3gVAD9srI4H0GV%20dZ%20Ty%20fNZPtT0yRAQiWxAx0TxAfaG%2FKXsBkFXMdvJ2cnll94iffXq56lR1Gm373PDavG1w91MgV8ZY%20dZ0VmdonQe20f6nBEKgK&tx_transdataiv=XMNaNYH07u3%2FyTF4WuUtaQ%3D%3D&transaction_id=Vanilla817ff2f6-75d3-4f55-bfa7-a50dddd39f74	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.206	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.17.78	unknown	United States	15169	GOOGLEUS	false
167.89.118.95	sendgrid.net	United States	11377	SENDGRIDUS	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
104.19.229.21	js.hcaptcha.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
45.60.13.91	4qti24o.impervadns.net	United States	19551	INCAPSULAUS	false
104.19.230.21	newassets.hcaptcha.com	United States	13335	CLOUDFLARENETUS	false
172.217.21.35	unknown	United States	15169	GOOGLEUS	false
64.233.162.84	unknown	United States	15169	GOOGLEUS	false
142.250.181.67	unknown	United States	15169	GOOGLEUS	false
172.217.17.42	unknown	United States	15169	GOOGLEUS	false
172.217.19.10	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.24

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579072
Start date and time:	2024-12-20 19:08:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://url4659.orders.vanillagift.com/ls/click?upn=u001.4gSefN7qGt7uZc-2BljvSfDuK9c6f7zz-2BRDdNLkOmxp-2BfCpVRV4q5JSM05F18NmhW9aTh4D-2B-2FvKc3l62XSGdMxHErqjDyHVaRGnhWtdaxelWfxz8x2-2FY7A4qgb3tzDonO-2BR4v55hRVWLW8mGedQ4WKyhGmLG6TdN0VE3FuoaMfqbWnIJZADjzcMmwi0-2FbwmmeKkdfIhUk0sBHSi9RcRmdsfuOZwL5O2zEB6UFf08dp06kJXruK-2BF70HVCIIa3GSMCo48RLkzWG8dEOH-2FBZmckwy2IyrmhGk7TORgwM5bk4PbUxQPoYKq7IdXZDoj7BBWFZXgs6KkXD1kVfgQOsMLEKQeTvK5ATiMGw5YUv9FTPZiWgh4O-2B6hR3uc5gCam5ygOCJsmG3ya5dOP3AzZxmtrQO2ixrFnkLK-2Bkk5ChvTn26C-2BioOkvRUSczMMaDc3goe-2FffK-2FLybPlPtaG8BM0aogkRmbjy7uKwhjOW-2BFQyWewVzg-3DIgAR_79LTZgGyJjQA0yKF2CHqblXBaDJuc2sNW7Piu5vjvmdwcqDrB-2Buw9ZQukwHO-2BFDa1Pj-2BnPyP1wnuiUj8o1jeVFZ-2B0yTi1w6olXhC5xGcnSuX-2FPX8EC9nfY-2B3npShVzZ4Fae90bxak04TDiCsiP7PmtAOagYeRI4FU2qDP2MtD3eIC1vtRjmGkonGMDUW1rPFYKa2pBviC8swsnzOU26q7ssqOo-2FLjO6-2B2IyWprhTXXBsBk2HZWehLV3F8Prl0XOgIIe0Oi6f3V8mliLO9NN8Iw-3D-3D
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@19/6@32/160

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.17.78, 64.233.162.84, 172.217.17.46
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, redirector.gvt1.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: http://url4659.orders.vanillagift.com/ls/click?upn=u001.4gSefN7qGt7uZc-2BljvSfDuK9c6f7zz-2BRDdNLkOmxp-2BfCpVRV4q5JSM05F18NmhW9aTh4D-2B-2FvKc3l62XSGdMxHErqjDyHVaRGnhWtdaxelWfxz8x2-2FY7A4qgb3tzDonO-2BR4v55hRVWLW8mGedQ4WKyhGmLG6TdN0VE3FuoaMfqbWnIJZADjzcMmwi0-2FbwmmeKkdfIhUk0sBHSi9RcRmdsfuOZwL5O2zEB6UFf08dp06kJXruK-2BF70HVCIIa3GSMCo48RLkzWG8dEOH-2FBZmckwy2IyrmhGk7TORgwM5bk4PbUxQPoYKq7IdXZDoj7BBWFZXgs6KkXD1kVfgQOsMLEKQeTvK5ATiMGw5YUv9FTPZiWgh4O-2B6hR3uc5gCam5ygOCJsmG3ya5dOP3AzZxmtrQO2ixrFnkLK-2Bkk5ChvTn26C-2BioOkvRUSczMMaDc3goe-2FffK-2FLybPlPtaG8BM0aogkRmbjy7uKwhjOW-2BFQyWewVzg-3DIgAR_79LTZgGyJjQA0yKF2CHqblXBaDJuc2sNW7Piu5vjvmdwcqDrB-2Buw9ZQukwHO-2BFDa1Pj-2BnPyP1wnuiUj8o1jeVFZ-2B0yTi1w6olXhC5xGcnSuX-2FPX8EC9nfY-2B3npShVzZ4Fae90bxak04TDiCsiP7PmtAOagYeRI4FU2qDP2MtD3eIC1vtRjmGkonGMDUW1rPFYKa2pBviC8swsnzOU26q7ssqOo-2FLjO6-2B2IyWprhTXXBsBk2HZWehLV3F8Prl0XOgIIe0Oi6f3V8mliLO9NN8Iw-3D-3D

LLM Input / Output

Input	Output
URL: http://url4659.orders.vanillagift.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": true, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: http://url4659.orders.vanillagift.com
URL: https://balance.vanillagift.com/sad-I-dring-Busing... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script exhibits several moderate-risk behaviors, including external data transmission, use of fallback domains, and aggressive DOM manipulation. While there are no clear indicators of malicious intent, the overall behavior is concerning and requires further investigation." }
(function(){var nO=[];var mx=[];var ud="c3N7ASqTk3uTcWsrm5sLOyvZoiIaGqNjcaIiGhqjYwqScnqCknraIyuDo0MBY0trS6PqG6Obe5OjaktzS3tzgpN7C4ODcgtrK7NLIyt7I5NLsyuTuysTI5NLsyuTaSuzC2OrC6MrCpKSCsr6EqoyMiqS2dnZm0MLIyuTmnurkxsrm2NLGytqmnqro2N7e1sKk0sLY6pzSxt7IytqmhILq0MLq5vJmTsro6pzSzN7k2tiexsLo0t7c7p7k1srk2qbw2tjkXHCamJCoqKCOyujKsOjK3ObS3tzuysTO2P6ayujCwurI0t7ecNpa6EL2Wt7q5sre7MrkzJLYysLc6NLC2NLC5tSmnpycZujk0tzO0szywErwxsrg6NLe3O7KxM7Y5FLcyMrwysjIhKTKyubK5pbS4Mqw4NLkwujS3tzGkMrG1uSKwtjgmMLyyuTcZIrC2OCYwvLK5NBo2tJAQobo0uzK8IBGntzo5N7YwFBmZFpE0ujSSMLowvRS2sLOyt5uysTg4MLkytzoypjK2src6OaGpJKgqJKcgozk3trGkMLkxp7IyszS2MrcwtrK2t7q5srI3u7c5pCCiJKcjr6YgpyOqoKOir6siqSmkp6cpurE5ujk0tzOyIrswtjspLCGqOTY3EiK7MLY7KSwhqjk2NxiRsLc7MLm/p7M6tzG6NLe3MBM0FTSduzC5MBkyubq2Ojm+mB2TN7k0FL6YHZS+Gp2UtZWUnbkyubq2Ojm1npS9nrSzNBUymR6emBSduTK5urY6ObWemZ2ZMro6uTcwGTK5urY6Ob2esrY5sr25Mro6uTcwGTK5urY6PZ6+uJwYOjAQqTSwtjC0tDCxujqwtjEnurcyNLczsSe8MKmxsrc6OTOxNBgWGRqalhkampSXuDK3MiC6MLEwubKzqSKipy+hJKopo7K6OCk3uje6PLgyt6M4MLk5srSnOjMmJ6CqJqCsL6skoquoJ6kqL6IkpqmhMykwtzW2NLczp7o0NLGxNLcyMbe3OjC0tzK5NqCsL6siqSoirC+qpySjJ6kmr6sioaonqSmupB2vILo6MLG0OaQwsjK5N7q6Mrk0IrSztDo3MLs0s7C6N7k4OTe6N7o8uDK7mRg8NjS3NbgpN7O5MLa5uje4MyY3sLo5mRCpOTC8ubK2Mrc0ura2krswtjqwujK2qiKsOjkwuSOhIKmwtzm2mbK5NLMzsro3q7c4KTe4Mrk6PLcgtrK5sbY0src6PCs0sjK3t5a4Oh2QEbeyMrG5vpEQuzG4lxoZEqgYkqEWN7CyObowuTowuzC0tjYiszoxujeyILowuqkmKDk3uD+ntzewEqk5N7k3GbowsbW0tzcyuTuksjo0OaGpJKgqISS3trK2qimxsLYyujy4Mrk2t7G8NxkisLY4JjC8srkwE6kQEae3Ojk3tj80JLO0Oie7srkzOTe2tqCsL6sgqSykpyOvqyKhqiepKaYnq6+jJiegqiG5MrC6MrSmsLOysiC6MLoipqgnqSCpLKQfLj2vJjC5ujansjSzNLKyOTC3M7K2pLcxuTKwujKwqjo5NLE6ujKyOra4MrcwsTYyuyK5OjK8MKo6OTSxMKk5MLy5MLcyN7a6N7qxtDGwtzGytje3MTcWJ6uvpKcqJzC2sruysTI5NLsyuTmlvLgytxIiujKxujS3tzYiuzK3NLa2qiKqqSepqiSmIqaksbk3ubezOjAUpzoyuTcyujASrDg2N7kyuTapqSKzMrkytzGyuagysbSwtjo8u7KxM7Y1p7W0tjC2qiG6uTkytzo6JLayuJiYOjAQqTSwtjEgtzWzp7o0NLG2ojEqKje6sbQytzI0uTuysTO2P6I6ubK5MKOytzo2orS5PLe6pKG5Obo8tjK6J7qxtDKrMrc6Pa4qsjwYGBaeKrIxMzM+ohagrC+hp6ahJKcioi+qIqwqKqkir6SmoKOir6qnJKopq7KxM7Y/obG3N7ASqTk3uTcRsLq5srOyujGntzoyvDowqjo5NLE6ujK5uzK5OjK8OCe5sKo6OTSxNLc6Mrk5N7OwujK4OTeyOrG6M7AdnZASMrs0sbK2ora3uTy6N7qxtDm6MLk6MbY3ubK4ILo0O6KxM6YpGSK3MjK5NLczsae3OjK8OjGwurmyt7q6Mrk7pLI6NDOnqiQgpqC7MLS2NCK0s7Q6NLc3Mrk0KiamKrc1tze7tzG0NLYyOTK3NLc2NLcysje3J7o6KTCxtbY3sbC6NLew==";var TA=window.atob(ud);var N7=TA.length;var h1=0;while(h1<N7){var TM=TA.charCodeAt(h1);mx.push(TM);h1+=1;}var P3=mx;var s4=P3.length;var Dp=155%s4;var jC=[];var B3=0;while(B3<s4){jC.push(P3[(B3+s4-Dp)%s4]);B3+=1;}var sb=jC;var tM=sb.length;var nj=170%7+1;var EO=0;var B_=[];while(EO<tM){B_.push((sb[EO]>>nj\|sb[EO]<<8-nj)&255);EO+=1;}var S3=B_;var Bm=S3.length;var vm=139%Bm;var Ec=0;var Ez=[];while(Ec<Bm){Ez.push(S3[(Ec+Bm-vm)%Bm]);Ec+=1;}var bG=Ez;var Sd=0;var hd=bG.length;while(Sd<hd){var kt=bG[Sd];var vy=window.String.fromCharCode(kt);nO.push(vy);Sd+=1;}var Kd=nO.join("");var GB=Kd;var Zv=0;var La=[139,170,155,99,130,89,117,133,7,28,0,16,143,70,212,24,182,169,101,7,87,217,110,211,62].length;var xO=[];var yp="KT38F/xG9Uo6Yzcn+vfqPeEeTdnmEOUIAztG/RUPTvNLPmAyH/kTDlL2S2T18P+n8gQsOv0o7Ub7ODZq9+fcHwRG7S1e8uzK0QX4KT/sHxZK1yAsU0Un8QsCSPYiYubuAcTxAydH/SIOU/BMRlE0LAELDkLmSVr37Qvy/fA0N/0XGVXsRT0xOyf3DgRH50dp7u0F5QLbK0gMGxss9ktBVzYx/Q3/SPU8Z+73EOn//Tg7+t7bGrwDCyMI6rvT6yfIB0Xp7d/0AvsYGdwV6y7bKklgQjL6DQpP2T5XxvoP5f3xMk3l9wFEzSkaNSAD2f76ONAiO9TZ6d/m1Ako5wj8PMwZJDcnHdAC70L2Pm35/A7l7/UvQAwbG0ToRUJhQjL9GQtM5T9k98z94/gBJzgBKxw+1DArNxQC2/zqMMMxVNnM9NTl4Qsz5fcBRMglIkEiEt356zzhHk3Z/QHyBPQ+JAcp6lf5OFJbOB/+Hw1I1j5t+dT98vz0Okj5GR1a6EMbXUgs7xMJSsRIbcnsD+P1/To2DR8VSdAbPGA4H/8P61XxQGfm9AXt8fYrAw8bC1XcRUJkODD+7eAYtyZa6fAR7e/uLEz8KBJb7Ek4U0kf9x/8V+cGQsbf+9TV5xop6vsILtQYIDMyE9nz7zbjPGn66AjC/wQ0OAEkECf2TytXOib/DQdM50dp3ur97PzQPDUGKvBG+Ts+MD4A3w4KRvdGWvP74ez1/CtCDCkVSO88QlU7Mq7a0RzdNWq1t9Swves7Gt7870L6QDxVODLeEvxH50tF9+z/6QP4NULeJRtS6EtOXDwk+hwIMug/aOr77/Tx8ik1DCXbF7kZLTYYCuEBAEXJJUfq9QDlAvg0O9slF1nsT002HAXTCeQx1kti9OoUruL0J0DoIgpe7En5NQXezhkJV/RIYbO4/+H+BSdH9x4KUfc/OlA4MvQNCVKiHmf39g6u/vAzOQglICfoSzpcOiz6IQhS8Eho9ej/
URL: https://balance.vanillagift.com/loginDetails?tx_tr... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "This script demonstrates high-risk behavior by dynamically loading a script from a suspicious, obfuscated URL. The combination of dynamic code execution, obfuscated URLs, and the potential for data exfiltration or malicious payload delivery indicates a high likelihood of malicious intent." }
if (!isSpa) { var scriptElement = document.createElement('script'); scriptElement.type = "text/javascript"; scriptElement.src = "/sad-I-dring-Busing-Owled-I-selfe-and-make-strant/13222129928191771016?s=97ps9p1j"; scriptElement.async = true; scriptElement.defer = true; document.head.appendChild(scriptElement); }
URL: https://balance.vanillagift.com/loginDetails?tx_tr... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This script appears to be a simple implementation of a temporary interstitial or block page, which is a common practice for web applications. The script checks a variable `isSpa` to determine whether to show the block page immediately or after a 10-second delay. This behavior is typical for managing user experience, such as during page transitions or loading times, and does not demonstrate any high-risk indicators." }
function showBlockPage() { document.title = "Pardon Our Interruption"; document.getElementsByClassName("container")[0].style.display = "block"; } if (isSpa) { showBlockPage(); } else { window.interstitialTimeout = setTimeout(showBlockPage, 10000); }
URL: https://balance.vanillagift.com/loginDetails?tx_tr... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided code snippet appears to be a simple check for a single-page application (SPA) flag in the URL parameters or a global variable. This is a common practice in web development and does not demonstrate any high-risk behaviors." }
var isSpa = new URLSearchParams(window.location.search).get('X-SPA') === '1' \|\| window.isImpervaSpaSupport;
URL: https://balance.vanillagift.com/loginDetails?tx_tr... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a part of a security or protection mechanism. It checks if a cookie is set and reloads the page if it's not an SPA (Single Page Application). The use of `window.reeseSkipExpirationCheck` suggests this is a legitimate feature and not a malicious script. While the code could be improved for better security practices, it does not exhibit any high-risk indicators and seems to have a legitimate purpose." }
window.onProtectionInitialized = function(protection) { if (protection && protection.cookieIsSet && !protection.cookieIsSet()) { showBlockPage(); return; } if (!isSpa) { window.location.reload(true); } }; window.reeseSkipExpirationCheck = true;
URL: https://balance.vanillagift.com/tis-them-Ported-I-... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. While the script may have some legitimate purposes, the overall risk level is high due to the potential for malicious activities." }
(function(){var dw=[];var tO=0;var MI=[];var Tg=[];var CI="mp60voqwqL7oyvDo6uTKvszS2OjK5L7C3NLm3ujk3uDSxk7GwtjYpsrYytzS6tqM6tzG6NLe3KDk0ubo0tzClt7W0tjCmqiEmKqKvoSSqKbcwtrKyJLoytrCxujqwtiE3urcyNLczoTe8JjKzOjk2t7G8FykysLYoNjC8srkQI5kQIbe3Ojk3thcYsbe3OjK3OiI3sbq2src6MbC3OzC5r7M3tzo5pqCsL6GnpqEkpyKiL6oirCoqqSKvpKago6KvqqckqimqtzS7Mrk5oaKamqaysjS6trsyuToyvCC6Ojk0sSg3tLc6MrkxMLmyqTK2t7syobQ0tjIvspoZGLExGRymqae6ujY3t7W5srk0sya3tze6PLgyobe5ObS7MLmytjMvubK2Mrc0urahMLq0MLq5nJmiqqknqaokpiKroqElpKovoqwqL7oyvDo6uTKvszS2OjK5L7C3NLm3ujk3uDSxrbMXOje6sbQxsLcxsrYgsbk3qCIjFygiIymyuTSzMKCzobe3Ojk3thcgs6G3tzo5N7YxtDS2MjkytzOzsrohMLo6Mrk8u7KxMjk0uzK5FrK7MLY6sLoytjC3M7qws7K5sbC3OzC5r7ext7c3MrG6NLe3NLc3MrkkMrSztDo5MrK5spwaNLc6Mrk5N7Owuje5JqCsL6sgqSykpyOvqyKhqiepKaaioiSqpq+jJiegqjC6sjS3uDk3ujext7YwurI0t5e8FraaMJ20tzIyvCezNzeQIrk5N7kXNzC2srS6MraptL0yoLOytzG8oyEgpiSgqaKiL6YkpyKvq6SiKiQvqSCnI6Kvr7M8Mjk0uzK5L7K7MLY6sLoytjC3M7qws7KYmLg6ECC5NLC2NzeQIrk5N7kXNrK5ubCzsqQko6QvoyYnoKozNLY2MbkzsroqNLaysbC2Nig0MLc6N7atK6CyN7EyozC6sjS3l7a4MrO5sbk0uDomsLk2Mro6Mjq2uDkzsTCUGJgZFhAZGBoWEBgWEBgXG5S5srYytzS6trG6Mbe3OjC0tzK5ODYwujM3uTaxsLc7MLmvsjCyMiEytDC7NLe5MbQ5N7aypqmqpKO3ujQ0saCpJyeoKSejJiegqjg5MrG0ubS3tya0sbk3ubezOhAktzoyuTcyuhAivDg2N7kyuTo3uC+vu7KxMjk0uzK5L7K7MLY6sLoyujCzpzC2srm5KDK5Mze5NrC3MbKnsTmyuTsyuSa5vDa2GRciJ6aiN7G6trK3OiagrC+jKSCjpqKnKi+qpySjJ6kmr6sioaonqSmrsrEjpikytzIyuTS3M6G3tzoyvDo3N7cypTq0sbKkqiC6sjS3pierr6SnKjkwtzI3tqs5NLcyMKKyO7C5MjSwtymxuTS4OiSjKSCmoqCpKSCsr6EqoyMiqTQysLI7srEzti+0t6IiqCokL6Ekqim";var NX=window.atob(CI);var NL=NX.length;var Be=0;while(Be<NL){var Nm=NX.charCodeAt(Be);Tg.push(Nm);Be+=1;}var ok=Tg;var Li=ok.length;var L5=79%Li;while(tO<Li){MI.push(ok[(tO+Li-L5)%Li]);tO+=1;}var as=MI;for(var vr in as){var zH=as[vr];if(as.hasOwnProperty(vr)){dw.push(zH);}}var yJ=dw;var nK=0;var tk=0;var gZ=[147,79,122,114,93,207,122,215,147,184,136,99,48,197,193,232,198,197].length;var pb=0;var XI=113;var Zc=[];var q4="PpWx5H6oErgS2TUQEWGXt23GlQoKT4krNZcNiiJOVracxA71ghlFvOZwbvg6wWk5IXWfwxnuwTJrY7C+TO5EiqKCgkq87T/0wyw0OZNdL7kT6BRYIMCy+iD/iGP/unzu/Wa8J4Pznwuhhe/Eb2jgMWcptxG/IKCc2Az+xhybqBM7SuyilALEx29DX785AYtwD7jkaattD6l36EA45HCe4gSHwF9rZuBiEI4QixNLE0NtMcs8b/D4qW/N22XLGKD48CSe/jSr7EP7PkgyyMaYh68nk7O1eT9M5/AAmZuRY0UbGODcgDzmQoh3AK/zjlCOuBqcb5v74yuRqUsUc4CIHUN1G+VHgABYoACy/jD7VPPHyoi2ID5kBy/XY191peuwGyzoVR8Np6GHfPSo1BSewijXhAOLgjCyoO5AqxtPF/f9WU8Uz/xk7e+hpwXDGOzMuFDq0ijbgBsra2mnzWu1Q7OLxz+tjVeIzzh42ftZd6UPjAx8ZETeqlTP5Et7AthicP7cl8tfz6/ZYSsEm+hw0ZfFLyFLICjEEHAyjuiDMF/zpgDe6CKQU+s7Z8dtAZdU/8BEgWbE/iy+Re2EgDyO9hTXwSdSYslrUYMR6kJTCrsxZe9sG6yYiQvF2wm7YOTckDSu+hzPuEuHjiTy7CbUW/Mnd1Ml6bPEOyiwDVcB69WDTZyZ0OxGKsTTlCc/Qu2jlQutuiJaBs5RaYNpCywsPY9RZx2KyUkZAb0/Z7hWeJKr4lCGgVPREv7KlmrE5B6J/hVVJL70Wgg6NVmVZRXryymmOaa6x+lTIWu1fs6KxmJohLqJIhWhcHI8ltjWgakJvYWfH1WW8QZGEzWnkTupOoL6pkY0/Kb5PiW1CC4strDyuZll0f3Xd2UO0crKtxnP+VudjhZGHtY0eJ5hJr2l4CK0shS/TOyYvUj6rmC71DtCCsR+FIY0twJfL985dbd8T9CUmV/d80WfAICoHBRmmvzjSA//QpgSePZ0g997v4OZMT+w4xQEYc8FvwGnfNDwnDCaulGKsRYqP617TZtZ1ip+ftpwCEK1hm0FlGaglkB+fX2tNQkz86nefRamNzE7lV/5D2ObXyfJkbOArxgkcd99C6XPVNDk5BTqwgjXoDszetxOtDrke9PbF7NdfYdAp0wITb/xx1n/8HwQPNwqTpRjwFNbfjjauDbwA+uP5weB+SO001RomRuF9+V3gBDkkDSq5jRPPBfLjlie6ErMF7P/j2/BpTPoj3xksReFkx2zLISMyCiC+jDvUEeL+miKvG7BsoIKDtZMZPohUh3h9CPkp3zf4Aj4KERi/iyr3HsnckDy1FLQjzcPQ5MVRY8ItzAsPYvJvwGbeBRYJMRD72WO4W6y13XnwRvNFpLqLvpgOPa9bmnhbG54pvzWvbkBtY2XF11uxeJWi4lHcfMt9gZOSqokWL5VYvXMmVfVxwmbBKxUCKQeRkBHxOu3vhinFZtVnhKiIjYEPKpVD+nh8Db4AoxSzWVtgUG/0wGe6VrihymLlTdh5ma6ZgIYpM79OiH9DCZ8oqCG9c11CfkHc7km0RJOG7V/ed9x8hp6ftosYIZVIsGZlCKpk1CHCODYNPROOvCvyDszvvjqcGZUK2uLZ0Mx1R/o2yxoTYsxxx3LEOQATPReOqx3EOP7dsBCcP4g21tnY4MBPbMwR7S0xXfl/zVDrenxVVljU4l+TXJ6c/VnzXtlevKmugKo0DKh+qXpiBqk1nDSAY3ZmWnnA+EaOabmg0XXSZMRli4WerI0WNZJLoGtIJYUJqh2oTlheZlvW5FWKbpKK/1HOftJlj5qH98hGKtlCpWJ3EaM20jaTf3QoQTzD5Aa7UcDfrg6SPZcq5PDl1P5lR/AhxgpbP50O/1/uBhA9Dye4mxvLIuXwhxaML4kzz9zB8vtuS/Us0BEEZs5I3nrdOgEBLgCDpxHdAcvWthiFN4wrzdrNw/hjWforxwEfbsZI50fmDhEXGjS8ijTpFdPRlTC3FbIPk52dpYscGJ9mulBjObwGgRONcXNsXWC0+2WRUaaC10brf+lzr4G2pb4gEqNugUZTIIgDoDWPeGd5d
URL: https://newassets.hcaptcha.com/captcha/v1/b4956db/... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This script appears to be a polyfill for the Promise API, which is a common and legitimate JavaScript functionality. It does not contain any high-risk indicators like dynamic code execution, data exfiltration, or suspicious redirects. The script is focused on implementing the Promise API and related utility functions, which is a standard practice in web development. While it uses some legacy APIs like `setTimeout`, this is not inherently malicious and is often necessary for compatibility. Overall, this script seems to be a benign implementation of a common JavaScript feature." }
/* https://hcaptcha.com/license */ !function(){"use strict";function t(t){var e=this.constructor;return this.then((function(i){return e.resolve(t()).then((function(){return i}))}),(function(i){return e.resolve(t()).then((function(){return e.reject(i)}))}))}function e(t){return new this((function(e,i){if(!t\|\|"undefined"==typeof t.length)return i(new TypeError(typeof t+" "+t+" is not iterable(cannot read property Symbol(Symbol.iterator))"));var n=Array.prototype.slice.call(t);if(0===n.length)return e([]);var r=n.length;function o(t,i){if(i&&("object"==typeof i\|\|"function"==typeof i)){var s=i.then;if("function"==typeof s)return void s.call(i,(function(e){o(t,e)}),(function(i){n[t]={status:"rejected",reason:i},0==--r&&e(n)}))}n[t]={status:"fulfilled",value:i},0==--r&&e(n)}for(var s=0;s<n.length;s++)o(s,n[s])}))}var i=setTimeout,n="undefined"!=typeof setImmediate?setImmediate:null;function r(t){return Boolean(t&&"undefined"!=typeof t.length)}function o(){}function s(t){if(!(this instanceof s))throw new TypeError("Promises must be constructed via new");if("function"!=typeof t)throw new TypeError("not a function");this._state=0,this._handled=!1,this._value=undefined,this._deferreds=[],f(t,this)}function a(t,e){for(;3===t._state;)t=t._value;0!==t._state?(t._handled=!0,s._immediateFn((function(){var i=1===t._state?e.onFulfilled:e.onRejected;if(null!==i){var n;try{n=i(t._value)}catch(r){return void c(e.promise,r)}l(e.promise,n)}else(1===t._state?l:c)(e.promise,t._value)}))):t._deferreds.push(e)}function l(t,e){try{if(e===t)throw new TypeError("A promise cannot be resolved with itself.");if(e&&("object"==typeof e\|\|"function"==typeof e)){var i=e.then;if(e instanceof s)return t._state=3,t._value=e,void h(t);if("function"==typeof i)return void f((n=i,r=e,function(){n.apply(r,arguments)}),t)}t._state=1,t._value=e,h(t)}catch(o){c(t,o)}var n,r}function c(t,e){t._state=2,t._value=e,h(t)}function h(t){2===t._state&&0===t._deferreds.length&&s._immediateFn((function(){t._handled\|\|s._unhandledRejectionFn(t._value)}));for(var e=0,i=t._deferreds.length;e<i;e++)a(t,t._deferreds[e]);t._deferreds=null}function u(t,e,i){this.onFulfilled="function"==typeof t?t:null,this.onRejected="function"==typeof e?e:null,this.promise=i}function f(t,e){var i=!1;try{t((function(t){i\|\|(i=!0,l(e,t))}),(function(t){i\|\|(i=!0,c(e,t))}))}catch(n){if(i)return;i=!0,c(e,n)}}s.prototype["catch"]=function(t){return this.then(null,t)},s.prototype.then=function(t,e){var i=new this.constructor(o);return a(this,new u(t,e,i)),i},s.prototype["finally"]=t,s.all=function(t){return new s((function(e,i){if(!r(t))return i(new TypeError("Promise.all accepts an array"));var n=Array.prototype.slice.call(t);if(0===n.length)return e([]);var o=n.length;function s(t,r){try{if(r&&("object"==typeof r\|\|"function"==typeof r)){var a=r.then;if("function"==typeof a)return void a.call(r,(function(e){s(t,e)}),i)}n[t]=r,0==--o&&e(n)}catch(l){i(l)}}for(var a=0;a<n.length;a++)s(a,n[a])}))},s.allSettled=e,s.resolve=function(t){return t&&"object"==typeof t&&t.constructor===s?t:new s((function(e){e(t)}))},s.reject=function(t){return new s((function(e,i){i(t)}))},s.race=function(t){return new s((function(e,i){if(!r(t))return i(new TypeError("Promise.race accepts an array"));for(var n=0,o=t.length;n<o;n++)s.resolve(t[n]).then(e,i)}))},s._immediateFn="function"==typeof n&&function(t){n(t)}\|\|function(t){i(t,0)},s._unhandledRejectionFn=function(t){"undefined"!=typeof console&&console&&console.warn("Possible Unhandled Promise Rejection:",t)};var d=function(){if("undefined"!=typeof self)return self;if("undefined"!=typeof window)return window;if("undefined"!=typeof global)return global;throw new Error("unable to locate global object")}();function p(t,e,i){return e<=t&&t<=i}function y(t){if(t===undefined)return{};if(t===Object(t))return t;throw TypeError("Could not convert argument to dictionary")}"function"!=typeof d.Promise?d.Promise=s:(d.Promise.prototype["finally"]\|\|(d.Promise.prototype["finally"]=t),d.Promise.allSettled\|
URL: https://js.hcaptcha.com/1/api.js... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This script appears to be a polyfill for the Promise API, which is a common and legitimate JavaScript functionality. It does not contain any high-risk indicators like dynamic code execution, data exfiltration, or suspicious redirects. The script is focused on implementing the Promise API and related utility functions, which is a standard practice in web development. While it uses some legacy APIs like `setTimeout`, this is not inherently malicious and is often necessary for compatibility. Overall, this script seems to be a benign implementation of a common JavaScript feature." }
/* https://hcaptcha.com/license */ !function(){"use strict";function e(e){var t=this.constructor;return this.then((function(n){return t.resolve(e()).then((function(){return n}))}),(function(n){return t.resolve(e()).then((function(){return t.reject(n)}))}))}function t(e){return new this((function(t,n){if(!e\|\|"undefined"==typeof e.length)return n(new TypeError(typeof e+" "+e+" is not iterable(cannot read property Symbol(Symbol.iterator))"));var r=Array.prototype.slice.call(e);if(0===r.length)return t([]);var i=r.length;function o(e,n){if(n&&("object"==typeof n\|\|"function"==typeof n)){var a=n.then;if("function"==typeof a)return void a.call(n,(function(t){o(e,t)}),(function(n){r[e]={status:"rejected",reason:n},0==--i&&t(r)}))}r[e]={status:"fulfilled",value:n},0==--i&&t(r)}for(var a=0;a<r.length;a++)o(a,r[a])}))}var n=setTimeout,r="undefined"!=typeof setImmediate?setImmediate:null;function i(e){return Boolean(e&&"undefined"!=typeof e.length)}function o(){}function a(e){if(!(this instanceof a))throw new TypeError("Promises must be constructed via new");if("function"!=typeof e)throw new TypeError("not a function");this._state=0,this._handled=!1,this._value=undefined,this._deferreds=[],d(e,this)}function s(e,t){for(;3===e._state;)e=e._value;0!==e._state?(e._handled=!0,a._immediateFn((function(){var n=1===e._state?t.onFulfilled:t.onRejected;if(null!==n){var r;try{r=n(e._value)}catch(i){return void l(t.promise,i)}c(t.promise,r)}else(1===e._state?c:l)(t.promise,e._value)}))):e._deferreds.push(t)}function c(e,t){try{if(t===e)throw new TypeError("A promise cannot be resolved with itself.");if(t&&("object"==typeof t\|\|"function"==typeof t)){var n=t.then;if(t instanceof a)return e._state=3,e._value=t,void u(e);if("function"==typeof n)return void d((r=n,i=t,function(){r.apply(i,arguments)}),e)}e._state=1,e._value=t,u(e)}catch(o){l(e,o)}var r,i}function l(e,t){e._state=2,e._value=t,u(e)}function u(e){2===e._state&&0===e._deferreds.length&&a._immediateFn((function(){e._handled\|\|a._unhandledRejectionFn(e._value)}));for(var t=0,n=e._deferreds.length;t<n;t++)s(e,e._deferreds[t]);e._deferreds=null}function h(e,t,n){this.onFulfilled="function"==typeof e?e:null,this.onRejected="function"==typeof t?t:null,this.promise=n}function d(e,t){var n=!1;try{e((function(e){n\|\|(n=!0,c(t,e))}),(function(e){n\|\|(n=!0,l(t,e))}))}catch(r){if(n)return;n=!0,l(t,r)}}a.prototype["catch"]=function(e){return this.then(null,e)},a.prototype.then=function(e,t){var n=new this.constructor(o);return s(this,new h(e,t,n)),n},a.prototype["finally"]=e,a.all=function(e){return new a((function(t,n){if(!i(e))return n(new TypeError("Promise.all accepts an array"));var r=Array.prototype.slice.call(e);if(0===r.length)return t([]);var o=r.length;function a(e,i){try{if(i&&("object"==typeof i\|\|"function"==typeof i)){var s=i.then;if("function"==typeof s)return void s.call(i,(function(t){a(e,t)}),n)}r[e]=i,0==--o&&t(r)}catch(c){n(c)}}for(var s=0;s<r.length;s++)a(s,r[s])}))},a.allSettled=t,a.resolve=function(e){return e&&"object"==typeof e&&e.constructor===a?e:new a((function(t){t(e)}))},a.reject=function(e){return new a((function(t,n){n(e)}))},a.race=function(e){return new a((function(t,n){if(!i(e))return n(new TypeError("Promise.race accepts an array"));for(var r=0,o=e.length;r<o;r++)a.resolve(e[r]).then(t,n)}))},a._immediateFn="function"==typeof r&&function(e){r(e)}\|\|function(e){n(e,0)},a._unhandledRejectionFn=function(e){"undefined"!=typeof console&&console&&console.warn("Possible Unhandled Promise Rejection:",e)};var f=function(){if("undefined"!=typeof self)return self;if("undefined"!=typeof window)return window;if("undefined"!=typeof global)return global;throw new Error("unable to locate global object")}();function p(e,t,n){return t<=e&&e<=n}function m(e){if(e===undefined)return{};if(e===Object(e))return e;throw TypeError("Could not convert argument to dictionary")}"function"!=typeof f.Promise?f.Promise=a:(f.Promise.prototype["finally"]\|\|(f.Promise.prototype["finally"]=e),f.Promise.allSettled\|
URL: https://balance.vanillagift.com/_Incapsula_Resourc... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "This script demonstrates several high-risk behaviors, including data exfiltration and redirects to a suspicious domain. The script sends the user's reCAPTCHA response to an `/_Incapsula_Resource` endpoint, which is likely a domain associated with the Incapsula web application firewall. This behavior could be indicative of a phishing or credential harvesting attempt. Additionally, the script reloads the parent window's page, which could be used to hide malicious activity or redirect the user to a malicious site. Overall, the combination of data exfiltration, suspicious domain interaction, and potential redirection makes this script a high-risk concern." }
var RecaptchaOptions = {theme : 'custom', custom_theme_widget: 'recaptcha_widget'}; var onCaptchaFinished = function(response) { var xhr; if (window.XMLHttpRequest) { xhr = new XMLHttpRequest; } else { xhr = new ActiveXObject("Microsoft.XMLHTTP"); } var msg = "g-recaptcha-response=" + response; xhr.open("POST", "/_Incapsula_Resource?SWCGHOEL=v2&dai=685515134581605902&cts=jaZR8gNTobxWeRvJ79wezpMkHF1IVTkQ2d4ll5Mkt4LXJR9fCMeZJQksuiuxWpDr", true); xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded"); xhr.onreadystatechange = function(){ if (xhr.readyState == 4) { if (xhr.status == 200) { window.parent.location.reload(true); } else { window.parent.location.reload(true); } } } xhr.send(msg); };
URL: https://balance.vanillagift.com/_Incapsula_Resourc... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a legitimate implementation of the reCAPTCHA widget, which is a common security measure used to protect against automated bot activity. The code sets up the reCAPTCHA options and defines a callback function to handle the user's response. While the use of XMLHttpRequest to send the response to a server could be considered a moderate-risk indicator, this is a standard practice for reCAPTCHA integration and does not appear to have any malicious intent. Overall, this script is likely benign and used for legitimate security purposes." }
var RecaptchaOptions = {theme : 'custom', custom_theme_widget: 'recaptcha_widget'}; var onCaptchaFinished = function(response) { var xhr; if (window.XMLHttpRequest) { xhr = new XMLHttpReques
URL: https://balance.vanillagift.com/loginDetails?tx_transdata=mS3mfNgvBO5POFsK+9NDXeE+AmrHdTUkzn+0qqYHU1UHQxT4AV7kA/laUiNnvz1nh2Ve41JpOnG2O/3gVAD9srI4H0GV+dZ+Ty+fNZPtT0yRAQiWxAx0TxAfaG/KXsBkFXMdvJ2cnll94iffXq56lR1Gm373PDavG1w91MgV8ZY+dZ0VmdonQe20f6nBEKgK&tx_t Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Additional security check is required", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://balance.vanillagift.com/loginDetails?tx_transdata=mS3mfNgvBO5POFsK+9NDXeE+AmrHdTUkzn+0qqYHU1UHQxT4AV7kA/laUiNnvz1nh2Ve41JpOnG2O/3gVAD9srI4H0GV+dZ+Ty+fNZPtT0yRAQiWxAx0TxAfaG/KXsBkFXMdvJ2cnll94iffXq56lR1Gm373PDavG1w91MgV8ZY+dZ0VmdonQe20f6nBEKgK&tx_t Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Additional security check is required", "prominent_button_name": "I am human", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://balance.vanillagift.com/loginDetails?tx_transdata=mS3mfNgvBO5POFsK+9NDXeE+AmrHdTUkzn+0qqYHU1UHQxT4AV7kA/laUiNnvz1nh2Ve41JpOnG2O/3gVAD9srI4H0GV+dZ+Ty+fNZPtT0yRAQiWxAx0TxAfaG/KXsBkFXMdvJ2cnll94iffXq56lR1Gm373PDavG1w91MgV8ZY+dZ0VmdonQe20f6nBEKgK&tx_t Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Additional security check is required", "prominent_button_name": "I am human", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://balance.vanillagift.com/loginDetails?tx_transdata=mS3mfNgvBO5POFsK+9NDXeE+AmrHdTUkzn+0qqYHU1UHQxT4AV7kA/laUiNnvz1nh2Ve41JpOnG2O/3gVAD9srI4H0GV+dZ+Ty+fNZPtT0yRAQiWxAx0TxAfaG/KXsBkFXMdvJ2cnll94iffXq56lR1Gm373PDavG1w91MgV8ZY+dZ0VmdonQe20f6nBEKgK&tx_t Model: Joe Sandbox AI	{ "brands": [ "Imperva" ] }
	{ "brands": [ "Imperva" ] }
URL: https://balance.vanillagift.com/loginDetails?tx_transdata=mS3mfNgvBO5POFsK+9NDXeE+AmrHdTUkzn+0qqYHU1UHQxT4AV7kA/laUiNnvz1nh2Ve41JpOnG2O/3gVAD9srI4H0GV+dZ+Ty+fNZPtT0yRAQiWxAx0TxAfaG/KXsBkFXMdvJ2cnll94iffXq56lR1Gm373PDavG1w91MgV8ZY+dZ0VmdonQe20f6nBEKgK&tx_t Model: Joe Sandbox AI	{ "brands": [ "Imperva" ] }
	{ "brands": [ "Imperva" ] }
URL: https://balance.vanillagift.com/loginDetails?tx_transdata=mS3mfNgvBO5POFsK+9NDXeE+AmrHdTUkzn+0qqYHU1UHQxT4AV7kA/laUiNnvz1nh2Ve41JpOnG2O/3gVAD9srI4H0GV+dZ+Ty+fNZPtT0yRAQiWxAx0TxAfaG/KXsBkFXMdvJ2cnll94iffXq56lR1Gm373PDavG1w91MgV8ZY+dZ0VmdonQe20f6nBEKgK&tx_t Model: Joe Sandbox AI	{ "brands": [ "Imperva" ] }
	{ "brands": [ "Imperva" ] }
URL: https://balance.vanillagift.com/loginDetails?tx_transdata=mS3mfNgvBO5POFsK+9NDXeE+AmrHdTUkzn+0qqYHU1UHQxT4AV7kA/laUiNnvz1nh2Ve41JpOnG2O/3gVAD9srI4H0GV+dZ+Ty+fNZPtT0yRAQiWxAx0TxAfaG/KXsBkFXMdvJ2cnll94iffXq56lR1Gm373PDavG1w91MgV8ZY+dZ0VmdonQe20f6nBEKgK&tx_t Model: Joe Sandbox AI	```json{ "legit_domain": "imperva.com", "classification": "known", "reasons": [ "The URL 'balance.vanillagift.com' does not match the legitimate domain 'imperva.com'.", "The brand 'Imperva' is known and typically associated with cybersecurity solutions, not gift card services.", "The domain 'vanillagift.com' is associated with Vanilla Gift, a brand known for prepaid gift cards, which does not align with Imperva's services.", "The presence of 'balance' as a subdomain suggests a service related to checking gift card balances, which is unrelated to Imperva.", "The URL structure and brand association do not align, indicating a potential phishing attempt." ], "riskscore": 8} Google indexed: False
URL: balance.vanillagift.com Brands: Imperva Input Fields: unknown
URL: https://balance.vanillagift.com/loginDetails?tx_transdata=mS3mfNgvBO5POFsK+9NDXeE+AmrHdTUkzn+0qqYHU1UHQxT4AV7kA/laUiNnvz1nh2Ve41JpOnG2O/3gVAD9srI4H0GV+dZ+Ty+fNZPtT0yRAQiWxAx0TxAfaG/KXsBkFXMdvJ2cnll94iffXq56lR1Gm373PDavG1w91MgV8ZY+dZ0VmdonQe20f6nBEKgK&tx_t Model: Joe Sandbox AI	```json{ "legit_domain": "imperva.com", "classification": "known", "reasons": [ "The URL 'balance.vanillagift.com' does not match the legitimate domain 'imperva.com'.", "The brand 'Imperva' is known and typically associated with cybersecurity solutions, not gift card services.", "The domain 'vanillagift.com' is associated with Vanilla Gift, a brand known for prepaid gift cards, which does not align with Imperva's services.", "The presence of 'balance' as a subdomain suggests a service related to checking gift card balances, which is unrelated to Imperva.", "There is no direct association between the brand 'Imperva' and the domain 'vanillagift.com'." ], "riskscore": 8} Google indexed: False
URL: balance.vanillagift.com Brands: Imperva Input Fields: unknown

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 17:08:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9933323820778037
Encrypted:	false
SSDEEP:
MD5:	245BD07E24F258F577A3FF364197A3F3
SHA1:	E6887F4BF7070E0518A09BA4E663C6F448E997E3
SHA-256:	A9BB992A4FEABDADF1801973DBE328E50ECC61D0780B8D9706A6E45DFC9040D1
SHA-512:	D6C72409ABAA0F9FCBB3E4607C3857062DECC4BE6A2FC5BE14C18A17D396A8228518CAD52042F8F02AD4844675BFF49024381E9188A3DEFC0D25A1601DAF98D8
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......5.S..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 17:08:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.008799642249627
Encrypted:	false
SSDEEP:
MD5:	812A2A1DAFEE434EDE52A711C2FFD2EF
SHA1:	6CCE8D6CA280132C45DDA34C46ADF627399D5106
SHA-256:	357C98D67DEFB09F5CF8F315C22FFDFBA70A7BF2AD888D8B437F6B2085A31390
SHA-512:	A517C1DE31FAA62FA8D796E26FA9E9EC1699B2D95D028480FEF324B7E7AEB9676C793F769670572DBCFB02488BA4B7AC482AD259277B8A104D16E09A1209445B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......5.S..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.015795688531286
Encrypted:	false
SSDEEP:
MD5:	86758C2DC88ED2B7DC237BD8590A19AF
SHA1:	513433812548B998AADDDCB855E24A0ED42FED83
SHA-256:	C7EBDD1F4846E58C7EA34885CCBE90A314C5C17E1D38C5A3191BC87F216D73ED
SHA-512:	6B27FF5F60D16353772493241EE86DA961F07F2C1725EDCF432009D295F408846524BF2349299B9364857E2EC6EA477F91C6DAC0FE0BDC21C8F9381A5D807BDF
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 17:08:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.004433210624027
Encrypted:	false
SSDEEP:
MD5:	3CCD27F1519A2840B339DE6AF7365C3E
SHA1:	95E9380B8A21327C8AED8D71D08A273C7B3F6813
SHA-256:	CB573D396B61AF7D0A98E34DD65DFB7F4166FFC6112F62A2493CCE4A1AD502FF
SHA-512:	4B0EA7FDCF5BE0D8DEAEE1C9375D52043E4246BEB4398E9DBF954F802E6D6D5EC03CB8B066AA6BD919501F07E2DE2ADFA8FA758355F62B70E00D285703712140
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....@..5.S..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 17:08:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.995779094708086
Encrypted:	false
SSDEEP:
MD5:	2AD9572D4080C570C0D573A5F9C20F49
SHA1:	937827CC733A2DA8326CE8817E1E6FB2C15B7F4C
SHA-256:	9338B1C411AD5BF7053FEEC5268E5C5F94EE936165FA17B26D9D8DE2B455A0B2
SHA-512:	9E9D08650D25A60DE336E37DA8640F07BFBEF6496BC524AC38A1B2B21C9553416BBFC2CF37D0BD18C6AECF9D38031BB849D6BC1CE93B1D3484D266CFEC1E817D
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......5.S..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 17:08:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.002962177876811
Encrypted:	false
SSDEEP:
MD5:	DC8C6E5171DF9BA7EF2172E713F6A71C
SHA1:	8CCFE4835242DEDF17A3301A4358E61E2B88FCEB
SHA-256:	7A7D51940EF52A88C3ABCD8E885A188615FBDF09E0D6217FE23147061626F7AB
SHA-512:	644A2421572675FC8585195BF2EDD8669F635AC7F096E0B97F001EA5924E37D08C8A7197FA90E5C132348F87974410CBC7D5BE0455AF5B33E79CA9DECA6C3D01
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......5.S..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Static File Info

⊘No static file info

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Static File Info