Edit tour

Windows Analysis Report
https://sugarwish.com/receiver/card/ss-GEDN-82KAK

Overview

General Information

Sample URL:	https://sugarwish.com/receiver/card/ss-GEDN-82KAK
Analysis ID:	1580404

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML body contains low number of good links

HTML body with high number of embedded SVGs detected

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 4216 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6716 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1964,i,14436916823865315338,4553588838499282733,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2088 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sugarwish.com/receiver/card/ss-GEDN-82KAK" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://sugarwish.com/receiver/general-info

HTTP Parser: Number of links: 0

Source: https://sugarwish.com/receiver/general-info

HTTP Parser: Total embedded SVG size: 476984

Source: https://sugarwish.com/receiver/general-info

HTTP Parser: Base64 decoded: {"version":3,"sources":["webpack://./src/components/IframeWrapper.css"],"names":[],"mappings":"AAAA,uBAEE,YAAa,CACb,iBAAkB,CAClB,qBACF,CAEA,sCACE,oBACF,CAEA,qCACE,mCAAyC,CAEzC,QAAS,CADT,iBAAkB,CAElB,aAAc,CACd,cAAe,CACf,4BAA8B,CAC9B,cAAe,CACf,eAAmB,CACnB,W...

Source: https://sugarwish.com/receiver/general-info	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-NZK8CPN
Source: https://sugarwish.com/receiver/general-info	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11101509411?random=1735043322116&cv=11&fst=1735043322116&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45je4cc1v875994607z8812882157za200zb812882157&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fsugarwish.com%2Freceiver%2Fgeneral-info&ref=https%3A%2F%2Fsugarwish.com%2Freceiver%2Fchoose%2Fcookies&hn=www.googleadservices.com&frm=0&tiba=Received%20a%20Sugarwish%20%7C%20General%20Info&npa=0&pscdl=noapi&auid=1100398865.1735043237&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://sugarwish.com/receiver/general-info	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-NZK8CPN
Source: https://sugarwish.com/receiver/general-info	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11101509411?random=1735043322116&cv=11&fst=1735043322116&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45je4cc1v875994607z8812882157za200zb812882157&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fsugarwish.com%2Freceiver%2Fgeneral-info&ref=https%3A%2F%2Fsugarwish.com%2Freceiver%2Fchoose%2Fcookies&hn=www.googleadservices.com&frm=0&tiba=Received%20a%20Sugarwish%20%7C%20General%20Info&npa=0&pscdl=noapi&auid=1100398865.1735043237&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://sugarwish.com/receiver/general-info	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11101509411?random=1735043328037&cv=11&fst=1735043328037&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45je4cc1v875994607za200zb812882157&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fsugarwish.com%2Freceiver%2Fgeneral-info&ref=https%3A%2F%2Fsugarwish.com%2Freceiver%2Fchoose%2Fcookies&hn=www.googleadservices.com&frm=0&tiba=Received%20a%20Sugarwish%20%7C%20General%20Info&did=dMmY1Mm&gdid=dMmY1Mm&npa=0&pscdl=noapi&auid=1100398865.1735043237&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dform_start
Source: https://sugarwish.com/receiver/general-info	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-NZK8CPN
Source: https://sugarwish.com/receiver/general-info	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11101509411?random=1735043322116&cv=11&fst=1735043322116&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45je4cc1v875994607z8812882157za200zb812882157&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fsugarwish.com%2Freceiver%2Fgeneral-info&ref=https%3A%2F%2Fsugarwish.com%2Freceiver%2Fchoose%2Fcookies&hn=www.googleadservices.com&frm=0&tiba=Received%20a%20Sugarwish%20%7C%20General%20Info&npa=0&pscdl=noapi&auid=1100398865.1735043237&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Source: https://sugarwish.com/receiver/general-info	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/11101509411?random=1735043328037&cv=11&fst=1735043328037&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45je4cc1v875994607za200zb812882157&gcd=13t3t3t3t5l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fsugarwish.com%2Freceiver%2Fgeneral-info&ref=https%3A%2F%2Fsugarwish.com%2Freceiver%2Fchoose%2Fcookies&hn=www.googleadservices.com&frm=0&tiba=Received%20a%20Sugarwish%20%7C%20General%20Info&did=dMmY1Mm&gdid=dMmY1Mm&npa=0&pscdl=noapi&auid=1100398865.1735043237&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dform_start

Source: https://sugarwish.com/receiver/card/ss-GEDN-82KAK	HTTP Parser: No favicon
Source: https://sugarwish.com/receiver/card/ss-GEDN-82KAK	HTTP Parser: No favicon
Source: https://sugarwish.com/receiver/card/ss-GEDN-82KAK	HTTP Parser: No favicon
Source: https://sugarwish.com/receiver/card/ss-GEDN-82KAK	HTTP Parser: No favicon
Source: https://sugarwish.com/verify-age-and-state	HTTP Parser: No favicon
Source: https://sugarwish.com/verify-age-and-state	HTTP Parser: No favicon
Source: https://sugarwish.com/receiver/wine-selected	HTTP Parser: No favicon
Source: https://sugarwish.com/receiver/choose/cookies	HTTP Parser: No favicon
Source: https://sugarwish.com/receiver/choose/cookies	HTTP Parser: No favicon
Source: https://sugarwish.com/receiver/choose/cookies	HTTP Parser: No favicon
Source: https://sugarwish.com/receiver/choose/cookies	HTTP Parser: No favicon
Source: https://sugarwish.com/receiver/choose/cookies	HTTP Parser: No favicon
Source: https://sugarwish.com/receiver/general-info	HTTP Parser: No favicon
Source: https://sugarwish.com/receiver/general-info	HTTP Parser: No favicon

Source: https://sugarwish.com/receiver/general-info	HTTP Parser: No <meta name="author".. found
Source: https://sugarwish.com/receiver/general-info	HTTP Parser: No <meta name="author".. found
Source: https://sugarwish.com/receiver/general-info	HTTP Parser: No <meta name="author".. found

Source: https://sugarwish.com/receiver/general-info	HTTP Parser: No <meta name="copyright".. found
Source: https://sugarwish.com/receiver/general-info	HTTP Parser: No <meta name="copyright".. found
Source: https://sugarwish.com/receiver/general-info	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49933 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50

Source: global traffic	DNS traffic detected: DNS query: sugarwish.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: live-sugarwish.s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: desk.zoho.com
Source: global traffic	DNS traffic detected: DNS query: geo.cookie-script.com
Source: global traffic	DNS traffic detected: DNS query: cea3c1ac507443e5876ac8d9858fc60b.js.ubembed.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: cdn.attn.tv
Source: global traffic	DNS traffic detected: DNS query: static.zohocdn.com
Source: global traffic	DNS traffic detected: DNS query: assets.ubembed.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: erywms.sugarwish.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: sugarwish-us.attn.tv
Source: global traffic	DNS traffic detected: DNS query: events.attentivemobile.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: unpkg.com
Source: global traffic	DNS traffic detected: DNS query: faro-collector-prod-us-east-0.grafana.net
Source: global traffic	DNS traffic detected: DNS query: sw-live-cms.s3.us-east-1.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: kit.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: manage.sugarwish.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1964,i,14436916823865315338,4553588838499282733,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sugarwish.com/receiver/card/ss-GEDN-82KAK"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1964,i,14436916823865315338,4553588838499282733,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

IP	Domain	Country	ASN	ASN Name	Malicious
172.64.147.188	unknown	United States	13335	CLOUDFLARENETUS	false
34.204.136.250	unknown	United States	14618	AMAZON-AESUS	false
64.233.167.157	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
172.217.19.226	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
104.18.187.31	unknown	United States	13335	CLOUDFLARENETUS	false
104.17.248.203	unknown	United States	13335	CLOUDFLARENETUS	false
103.103.196.108	unknown	India	56201	ZOHO-INZohoCorporationPvtLtdIN	false
172.217.17.46	google.com	United States	15169	GOOGLEUS	false
142.250.181.130	unknown	United States	15169	GOOGLEUS	false
108.158.75.27	duihxgfnjg37f.cloudfront.net	United States	16509	AMAZON-02US	false
54.231.192.33	unknown	United States	16509	AMAZON-02US	false
35.169.201.214	sugarwish.com	United States	14618	AMAZON-AESUS	false
95.85.19.25	unknown	European Union	14061	DIGITALOCEAN-ASNUS	false
142.250.181.138	unknown	United States	15169	GOOGLEUS	false
104.18.39.181	unknown	United States	13335	CLOUDFLARENETUS	false
3.219.203.34	unknown	United States	14618	AMAZON-AESUS	false
104.18.39.221	unknown	United States	13335	CLOUDFLARENETUS	false
104.17.249.203	unpkg.com	United States	13335	CLOUDFLARENETUS	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
172.217.21.35	unknown	United States	15169	GOOGLEUS	false
172.217.17.40	unknown	United States	15169	GOOGLEUS	false
172.217.21.36	unknown	United States	15169	GOOGLEUS	false
3.12.75.59	faro-collector-prod-us-east-0.grafana.net	United States	16509	AMAZON-02US	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
216.239.36.181	unknown	United States	15169	GOOGLEUS	false
54.205.15.246	manage.sugarwish.com	United States	14618	AMAZON-AESUS	false
216.239.32.181	analytics-alv.google.com	United States	15169	GOOGLEUS	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
142.250.181.142	unknown	United States	15169	GOOGLEUS	false
172.217.19.234	unknown	United States	15169	GOOGLEUS	false
108.158.75.86	unknown	United States	16509	AMAZON-02US	false
104.18.43.135	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.181.104	unknown	United States	15169	GOOGLEUS	false
52.217.102.16	s3-r-w.us-east-1.amazonaws.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.19.162	td.doubleclick.net	United States	15169	GOOGLEUS	false
52.216.42.57	s3-w.us-east-1.amazonaws.com	United States	16509	AMAZON-02US	false
204.141.33.104	support.zoho.com	United States	2639	ZOHO-ASUS	false
199.67.80.86	h2-stratus.zohocdn.com	United States	19142	UNASSIGNED	false
188.226.136.4	geo.cookie-script.com	European Union	14061	DIGITALOCEAN-ASNUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580404
Start date and time:	2024-12-24 13:26:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://sugarwish.com/receiver/card/ss-GEDN-82KAK
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.win@20/159@146/446

Input	Output
URL: https://sugarwish.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://sugarwish.com
URL: https://www.googletagmanager.com/static/service_wo... Model: Joe Sandbox AI	{ "risk_score": 5, "reasoning": "The script contains a mix of behaviors that require further review. It uses some legacy APIs like `XDomainRequest`, which pose minor risks, but also has more concerning behaviors like sending data to external domains and using obfuscated code. The script's overall intent is not entirely clear, so it should be analyzed more closely." }
'use strict';class m{constructor(a){this.j=a;this.g={};this.h={};this.i=0;this.id=String(Math.floor(Number.MAX_SAFE_INTEGERMath.random()))}}function n(a){return a.performance&&a.performance.now()\|\|Date.now()} var p=function(a,b){class d{constructor(c,g,f){this.failureType=c;this.data=g;this.g=f;this.h=new m(n(f))}s(c,g){const f=c.clientId;if(c.type===0){c.isDead=!0;var e=this.h,h=n(this.g);e.g[f]==null&&(e.g[f]=0,e.h[f]=h,e.i++);e.g[f]++;c.stats={targetId:e.id,clientCount:e.i,totalLifeMs:Math.round(h-e.j),heartbeatCount:e.g[f],clientLifeMs:Math.round(h-e.h[f])}}c.failure={failureType:this.failureType,data:this.data};g(c)}}return new d(5,a,b)};/ Copyright Google LLC SPDX-License-Identifier: Apache-2.0 / let q=globalThis.trustedTypes,r;function t(){let a=null;if(!q)return a;try{const b=d=>d;a=q.createPolicy("goog#html",{createHTML:b,createScript:b,createScriptURL:b})}catch(b){}return a};var u=class{constructor(a){this.g=a}toString(){return this.g+""}};function v(a){const b=a;var d;r===void 0&&(r=t());d=r;return new u(d?d.createScriptURL(b):b)}function w(a){if(a instanceof u)return a.g;throw Error("");};function x(a,...b){if(b.length===0)return v(a[0]);let d=a[0];for(let c=0;c<b.length;c++)d+=encodeURIComponent(b[c])+a[c+1];return v(d)}function y(a){var b=x`sw.js`,d=w(b).toString();const c=d.split(/[?#]/),g=/[?]/.test(d)?"?"+c[1]:"";return z(c[0],g,/[#]/.test(d)?"#"+(g?c[2]:c[1]):"",a)} function z(a,b,d,c){function g(e,h){e!=null&&(Array.isArray(e)?e.forEach(l=>g(l,h)):(b+=f+encodeURIComponent(h)+"="+encodeURIComponent(e),f="&"))}let f=b.length?"&":"?";c.constructor===Object&&(c=Object.entries(c));Array.isArray(c)?c.forEach(e=>g(e[1],e[0])):c.forEach(g);return v(a+b+d)};const A=/Chrome\/(\d+)/;var C=function(a){const b=a.origin;if(b){var d=a.o?"swe.js":"sw.js",c=a.g?x`/static/service_worker/${a.g}/${d}?origin=${b}`:x`/gtm/static/${d}?origin=${b}`,g=new Map([["origin",b]]);a.h&&g.set("path",a.h);var f=a.l?y(g):c,e=()=>{const k=A.exec(a.window.navigator.userAgent);return k&&Number(k[1])<119},h=a.window.document.location.href;a.g&&(a.l?h=`${a.h}/_/service_worker`:e()\|\|(h="/static/service_worker"));var l={scope:h};a.g&&(l.updateViaCache="all");a.window.navigator.serviceWorker.register(w(f), l).then(()=>{a.window.navigator.serviceWorker.ready.then(k=>{a.i=k.active;B(a)})},k=>{a.j=p(k==null?void 0:k.toString(),a.window);B(a)});a.window.navigator.serviceWorker.addEventListener("message",k=>{a.window.parent.postMessage(k.data,a.origin)})}},B=function(a){const b=a.m.slice();a.m=[];for(const d of b)a.handleEvent(d)}; (function(a){if((f=>{try{return f!==f.top}catch(e){return!0}})(a.window)){var b=new URL(a.window.document.location.href),d=b.searchParams.get("origin");if(d){a.origin=d;a.l=!!b.searchParams.get("1p");a.o=!!b.searchParams.get("e");a.h=b.searchParams.get("path")\|\|"";var c=b.pathname.match(RegExp("./service_worker/(\\w+)/"));c&&c.length&&(a.g=c[1]);var g=a.window.document.location.ancestorOrigins;g&&g[0]!==a.origin\|\|(C(a),a.window.addEventListener("message",f=>{a.handleEvent(f)}))}}})(new class{constructor(a){this.window= a;this.origin="";this.o=this.l=!1;this.h="";this.j=this.i=null;this.m=[];this.g=""}handleEvent(a){a.origin===this.origin&&(this.i?this.i.postMessage(a.data):this.j?this.j.s(a.data,b=>{this.window.parent.postMessage(b,this.origin)}):this.m.push(a))}}(window));
URL: https://td.doubleclick.net/td/rul/11101509411?rand... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be related to ad-related functionality, such as managing interest groups and fetching ad content. While it includes some external data transmission and legacy practices, the overall behavior seems to be within the expected scope of ad-related functionality. There are no clear indicators of high-risk activities like dynamic code execution, data exfiltration, or malicious redirects. The risk score is on the lower end, indicating a relatively benign script with some minor concerns." }
var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":2592000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s1100398865.1735043237","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s1100398865.1735043237\u0026ig_key=1sNHMxMTAwMzk4ODY1LjE3MzUwNDMyMzc!2sZ5I1rA!3sAAptDV5lccj9","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1sxqazGA!2sZ5I1rA!3sAAptDV5lccj9"],"userBiddingSignals":[["7618288070","7621668331","8621509508","7618309286","8621592784"],null,1735043244841406],"ads":[{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=162792985130\u0026cr_id=713987686042\u0026cv_id=0\u0026format=${AD_WIDTH}x${AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=r1j8621509508!4s2A","metadata":["162792985130","713987686042",null,"21709817022",null,null,null,null,null,null,"8621509508"],"adRenderId":"8g5t5Wl8ZZ8","buyerReportingId":"1j8621509508!4s2A"},{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=162792985130\u0026cr_id=713987686042\u0026cv_id=0\u0026format=${AD_WIDTH}x${AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=r1j8621592784!4s2A","metadata":["162792985130","713987686042",null,"21709817022",null,null,null,null,null,null,"8621592784"],"adRenderId":"03kk1Qcfxsw","buyerReportingId":"1j8621592784!4s2A"},{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=162792985130\u0026cr_id=713987686042\u0026cv_id=0\u0026format=${AD_WIDTH}x${AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=r1j7621668331!4s2A","metadata":["162792985130","713987686042",null,"21709817022",null,null,null,null,null,null,"7621668331"],"adRenderId":"smS2RvR2edI","buyerReportingId":"1j7621668331!4s2A"},{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=162792985130\u0026cr_id=713987686042\u0026cv_id=0\u0026format=${AD_WIDTH}x${AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=r1j7618288070!4s2A","metadata":["162792985130","713987686042",null,"21709817022",null,null,null,null,null,null,"7618288070"],"adRenderId":"W1edqmJaDrc","buyerReportingId":"1j7618288070!4s2A"},{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=162792985130\u0026cr_id=713987686042\u0026cv_id=0\u0026format=${AD_WIDTH}x${AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=r1j7618309286!4s2A","metadata":["162792985130","713987686042",null,"21709817022",null,null,null,null,null,null,"7618309286"],"adRenderId":"HFwV4vgutC8","buyerReportingId":"1j7618309286!4s2A"},{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=172683777020\u0026cr_id=724840014653\u0026cv_id=0\u0026format=${AD_WIDTH}x${AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=r1j8621509508!4s2A","metadata":["172683777020","724840014653",null,"21709817022",null,null,null,null,null,null,"8621509508"],"adRenderId":"nvZVXsvF6-k","buyerReportingId":"1j8621509508!4s2A"},{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=172683777020\u0026cr_id=725473203275\u0026cv_id=0\u0026format=${AD_WIDTH}x${AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=r1j8621509508!4s2A","metadata":["172683777020","725473203275",null,"21709817022",null,null,null,null,null,null,"8621509508"],"adRenderId":"p1m1zgY8xYU","buyerReportingId":"1j8621509508!4s2A"},{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=172683777020\u0026cr_id=725473203275\u0026cv_id=0\u0026format=${AD_WIDTH}x${AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=r1j8621592784!4s2A","metadata":["172683777020","725473203275",null,"21709817022",null,null,null,null,null,null,"8621592784"],"adRenderId":"snOVMhzCtZU","buyerReportingId":"1j8621592784!4s2A"},{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=172683777020\u0026cr_id=724840014653\u0026cv_id=0\u0026format=${AD_WIDTH}x${AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=r1j8621592784!4s*2A","metada
URL: https://sugarwish.com/js/sugarwish/header-nav.js... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The provided JavaScript code appears to be a desktop and mobile menu implementation, with some moderate-risk indicators. The code uses DOM manipulation to toggle the visibility and state of menu items, which could be considered aggressive but is common in menu functionality. There are no clear indicators of high-risk behaviors, such as dynamic code execution or data exfiltration. However, the code does interact with external domains (e.g., `sugarwish-desktop-nav`) and performs some DOM manipulation, which warrants a medium-risk score." }
/Desktop Menu Code./ (function () { var menuItems1 = document.querySelectorAll('#sugarwish-desktop-nav li.has-submenu'); var body = document.querySelector('body'); var disableBlur = false Array.prototype.forEach.call(menuItems1, function (el, i) { el.querySelector('.nav-link').addEventListener("click", function (event) { if (this.parentNode.classList.contains('has-submenu') && !this.parentNode.classList.contains('selected')) { this.parentNode.classList.add('selected'); body.classList.add('modal-open'); this.parentNode.querySelector('.nav-link').setAttribute('aria-expanded', "true"); disableBlur = true; } else { this.parentNode.classList.remove("selected") this.parentNode.querySelector('.nav-link').setAttribute('aria-expanded', "false"); body.classList.remove('modal-open'); disableBlur = false; } event.preventDefault(); }); var links = document.querySelectorAll('#sugarwish-desktop-nav a'); Array.prototype.forEach.call(links, function (el, i) { el.addEventListener("focus", function () { if (el.closest('li.has-submenu.selected')) { disableBlur = true; } else { disableBlur = false; } }); el.addEventListener("blur", function (event) { setTimeout(function () { var selectedNav = document.querySelector("#sugarwish-desktop-nav li.has-submenu.selected") if (selectedNav && !disableBlur) { selectedNav.classList.remove('selected'); selectedNav.querySelector('.nav-link').setAttribute('aria-expanded', "false"); body.classList.remove('modal-open'); disableBlur = false; } }, 10); }); }); }); // Close Menu when user clicks on overlay. document.addEventListener('click', function (e) { if (e.target == null) return; if (e.target.classList.contains('has-submenu') && e.target.classList.contains('selected')) { e.target.classList.remove('selected'); e.target.querySelector('.nav-link').setAttribute('aria-expanded', "false"); body.classList.remove('modal-open'); } }) } )(); /Desktop Menu Code End./ / Mobile Menu Code. / ( function () { var body = document.querySelector('body'); var menuOpenButton = document.querySelector('.mobile-nav-toggle--open'); var menuCloseButton = document.querySelector('.mobile-nav-toggle--close'); var mobileMenu = document.querySelector('.sugarwish-mobile-menu'); if (menuOpenButton) { menuOpenButton.addEventListener('click', function () { body.classList.add('modal-open'); mobileMenu.classList.add('show-mobile-nav'); }) } if (menuCloseButton) { menuCloseButton.addEventListener('click', function () { body.classList.remove('modal-open'); mobileMenu.classList.remove('show-mobile-nav'); }) } if (mobileMenu) { var mobileSecondaryNavLink = mobileMenu.querySelectorAll('.secondary-nav-link') Array.prototype.forEach.call(mobileSecondaryNavLink, function (el, i) { if (el.parentNode.classList.contains('has-submenu')) { el.addEventListener('click', function () { el.parentNode.classList.toggle('selected'); mobileSeco
URL: https://connect.facebook.net/en_US/fbevents.js... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided code appears to be a legitimate Facebook Pixel implementation, which is a common analytics and tracking tool used by websites. While it includes some low-risk indicators like the use of legacy APIs, the overall behavior is consistent with typical analytics functionality and does not demonstrate any malicious intent. The code is also open-source and provided by Facebook, a reputable technology company. Therefore, this script can be considered low risk." }
/** * Copyright (c) 2017-present, Facebook, Inc. All rights reserved. * * You are hereby granted a non-exclusive, worldwide, royalty-free license to use, * copy, modify, and distribute this software in source code or binary form for use * in connection with the web services and APIs provided by Facebook. * * As with any software that integrates with the Facebook platform, your use of * this software is subject to the Facebook Platform Policy * [http://developers.facebook.com/policy/]. This copyright notice shall be * included in all copies or substantial portions of the software. * * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER * IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. / fbq.version="2.9.179"; fbq._releaseSegment = "stable"; fbq.pendingConfigs=["global_config"]; fbq.__openBridgeRollout = 1.0; (function(a,b,c,d){var e={exports:{}};e.exports;(function(){var f=a.fbq;f.execStart=a.performance&&a.performance.now&&a.performance.now();if(!function(){var b=a.postMessage\|\|function(){};if(!f){b({action:"FB_LOG",logType:"Facebook Pixel Error",logMessage:"Pixel code is not installed correctly on this page"},"");"error"in console&&console.error("Facebook Pixel Error: Pixel code is not installed correctly on this page");return!1}return!0}())return;var g=function(){function a(a,b){var c=[],d=!0,e=!1,f=void 0;try{for(var g=a[typeof Symbol==="function"?Symbol.iterator:"@@iterator"](),a;!(d=(a=g.next()).done);d=!0){c.push(a.value);if(b&&c.length===b)break}}catch(a){e=!0,f=a}finally{try{!d&&g["return"]&&g["return"]()}finally{if(e)throw f}}return c}return function(b,c){if(Array.isArray(b))return b;else if((typeof Symbol==="function"?Symbol.iterator:"@@iterator")in Object(b))return a(b,c);else throw new TypeError("Invalid attempt to destructure non-iterable instance")}}(),h=function(){function a(a,b){for(var c=0;c<b.length;c++){var d=b[c];d.enumerable=d.enumerable\|\|!1;d.configurable=!0;"value"in d&&(d.writable=!0);Object.defineProperty(a,d.key,d)}}return function(b,c,d){c&&a(b.prototype,c);d&&a(b,d);return b}}(),i=typeof Symbol==="function"&&typeof (typeof Symbol==="function"?Symbol.iterator:"@@iterator")==="symbol"?function(a){return typeof a}:function(a){return a&&typeof Symbol==="function"&&a.constructor===Symbol&&a!==(typeof Symbol==="function"?Symbol.prototype:"@@prototype")?"symbol":typeof a};function j(a,b){if(!a)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return b&&(typeof b==="object"\|\|typeof b==="function")?b:a}function k(a,b){if(typeof b!=="function"&&b!==null)throw new TypeError("Super expression must either be null or a function, not "+typeof b);a.prototype=Object.create(b&&b.prototype,{constructor:{value:a,enumerable:!1,writable:!0,configurable:!0}});b&&(Object.setPrototypeOf?Object.setPrototypeOf(a,b):a.__proto__=b)}function l(a,b,c){b in a?Object.defineProperty(a,b,{value:c,enumerable:!0,configurable:!0,writable:!0}):a[b]=c;return a}function m(a){if(Array.isArray(a)){for(var b=0,c=Array(a.length);b<a.length;b++)c[b]=a[b];return c}else return Array.from(a)}function n(a,b){if(!(a instanceof b))throw new TypeError("Cannot call a class as a function")}f.__fbeventsModules\|\|(f.__fbeventsModules={},f.__fbeventsResolvedModules={},f.getFbeventsModules=function(a){f.__fbeventsResolvedModules[a]\|\|(f.__fbeventsResolvedModules[a]=f.__fbeventsModules[a]());return f.__fbeventsResolvedModules[a]},f.fbIsModuleLoaded=function(a){return!!f.__fbeventsModules[a]},f.ensureModuleRegistered=function(b,a){f.fbIsModuleLoaded(b)\|\|(f.__fbeventsModules[b]=a)}); f.ensureModuleRegistered("generateUUID",function(){ return function(f,g,h,i){var j={
URL: https://sugarwish.com/receiver/card/ss-GEDN-82KAK... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a legitimate script that handles form validation and dynamic content replacement. It does not contain any high-risk indicators like dynamic code execution, data exfiltration, or suspicious redirects. The script is primarily focused on client-side functionality, such as replacing placeholders in an ecard message and validating a form. While it uses some legacy practices like `XDomainRequest`, these pose minor risks and are not inherently malicious. Overall, the script seems to be implementing common web development patterns without any clear signs of malicious intent." }
$(document).ready(function () { var ecardBody = $('#ecard-body'); if (ecardBody.length > 0) { var message = ecardBody.html(); message = message.replace(/{name}/g, 'Chase Curtin'); message = message.replace(/{NAME}/g, 'Chase Curtin'); $('#ecard-body').html(message); } function validateForm() { $("#state-select-form").validate({ errorClass: 'invalid-feedback', errorElement: 'div', highlight: function (element, errorClass, validClass) { $(element).removeClass('is-valid').addClass('is-invalid') }, unhighlight: function (element, errorClass, validClass) { $(element).removeClass('is-invalid').addClass('is-valid') }, rules: { receiver_state: { required: true, }, }, messages: { receiver_state: { required: 'state is required', }, } }); } $('#choose-my-candy-btn').on('click', function (e) { e.preventDefault(); validateForm(); if ($("#state-select-form").valid()) { $("#state-select-form").submit(); } }); }); var gift_code_local = JSON.parse(localStorage.getItem('ss-GEDN-82KAK')); let navigationEntries = window.performance.getEntriesByType("navigation") let lastNavigationEntry = navigationEntries[navigationEntries.length - 1] if (lastNavigationEntry.type === "back_forward") { $('#no_back_modal').modal('show'); } else { console.log('Navigation was not initiated by a browser back or forward action.'); }
URL: https://geo.cookie-script.com/s/1a0247ce31a2be54a4... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script appears to be a cookie consent management script that handles the loading and activation of various content elements based on user consent. While it uses some legacy APIs like `XDomainRequest` and performs data transmission to third-party domains, the overall behavior seems to be in the context of legitimate cookie consent and analytics functionality. However, the script could be improved by using more modern APIs and providing better transparency around the data being transmitted." }
!function(){var t=function(){var t='[data-cookiescript="accepted"]',e=function(t,e){try{var a;"function"==typeof Event?a=new CustomEvent(t,{bubbles:!0,cancelable:!0,detail:e}):(a=document.createEvent("CustomEvent")).initCustomEvent(t,!0,!0,e),window.document.dispatchEvent(a)}catch(r){console.warn("Warning: You browser not support dispatch event")}},a=function(t,e){t.insertAdjacentElement("afterend",e),t.parentNode.removeChild(t)},r=function(t,e){t.insertAdjacentHTML("afterend",e),t.parentNode.removeChild(t)},o=function(t,e){var a=!1;return t.indexOf(e)>=0&&(a=!0),a},i=function(){if(window.google_tag_data&&window.google_tag_data.ics&&window.google_tag_data.ics.entries){var t=Object.keys(window.google_tag_data.ics.entries);if(t.length>0)return t}return!1},n=function(t){window.dataLayer=window.dataLayer\|\|[],window.gtag=window.gtag\|\|function(){dataLayer.push(arguments)};var e=i();window.gtag&&(gtag("consent",t,{ad_storage:"granted"}),gtag("consent",t,{analytics_storage:"granted"}),e?(o(e,"ad_personalization")&&gtag("consent",t,{ad_personalization:"granted"}),o(e,"ad_user_data")&&gtag("consent",t,{ad_user_data:"granted"})):(gtag("consent",t,{ad_personalization:"granted"}),gtag("consent",t,{ad_user_data:"granted"})),gtag("consent",t,{functionality_storage:"granted"}),gtag("consent",t,{personalization_storage:"granted"}),gtag("consent",t,{security_storage:"granted"}))};void 0===window.CookieScript&&(!function(){window.dataLayer=window.dataLayer\|\|[],window.gtag=window.gtag\|\|function(){dataLayer.push(arguments)};var t=!1,e=!1;if(window.google_tag_data&&window.google_tag_data.ics&&(t=!0===window.google_tag_data.ics.usedDefault),window.dataLayer)for(let a=0;a<window.dataLayer.length;a++)"consent"===window.dataLayer[a][0]&&"default"===window.dataLayer[a][1]&&(e=!0);t\|\|gtag("set","developer_id.dMmY1Mm",!0),!t&&!e&&n("default")}(),function(t){var e=document.querySelectorAll("img"+t);if(e)for(var a=0;a<e.length;a++){var r=e[a];r.setAttribute("src",r.getAttribute("data-src")),r.removeAttribute("data-src"),r.removeAttribute("data-cookiescript")}}(t),function(t){var e=document.querySelectorAll('script[type="text/plain"]'+t);if(e)for(var r=0;r<e.length;r++){var o=e[r],i=o.cloneNode(!0);i.setAttribute("type","text/javascript"),i.removeAttribute("data-cookiescript"),a(o,i)}}(t),function(t){var e=document.querySelectorAll("iframe"+t);if(e)for(var a=0;a<e.length;a++){var r=e[a];r.setAttribute("src",r.getAttribute("data-src")),r.removeAttribute("data-src"),r.removeAttribute("data-cookiescript")}}(t),function(t){var e=document.querySelectorAll("embed"+t);if(e)for(var a=0;a<e.length;a++){var o=e[a];o.setAttribute("src",o.getAttribute("data-src")),o.removeAttribute("data-src"),o.removeAttribute("data-cookiescript");var i=o.outerHTML;r(o,i)}}(t),function(t){var e=document.querySelectorAll("object"+t);if(e)for(var a=0;a<e.length;a++){var o=e[a];o.setAttribute("data",o.getAttribute("data-data")),o.removeAttribute("data-data"),o.removeAttribute("data-cookiescript");var i=o.outerHTML;r(o,i)}}(t),function(t){var e=document.querySelectorAll("link"+t);if(e)for(var a=0;a<e.length;a++){var r=e[a];r.setAttribute("href",r.getAttribute("data-href")),r.removeAttribute("data-href"),r.removeAttribute("data-cookiescript")}}(t),function(){window.dataLayer=window.dataLayer\|\|[];for(var t=["CookieScriptCategory-strict","CookieScriptCategory-targeting","CookieScriptCategory-performance","CookieScriptCategory-functionality","CookieScriptCategory-unclassified","CookieScriptCategory-all"],e=0;e<t.length;e++)window.dataLayer.push({event:t[e]})}(),n("update"),window.fbq&&fbq("consent","grant"),function(){for(var t=["CookieScriptCategory-strict","CookieScriptCategory-targeting","CookieScriptCategory-performance","CookieScriptCategory-functionality","CookieScriptCategory-unclassified","CookieScriptCategory-all"],a=0;a<t.length;a++)e(t[a])}(),e("CookieScriptOutsideGeoLoaded"))};"complete"===document.readyState?t():window.addEventListener("load",t)}();
URL: https://td.doubleclick.net/td/rul/11101509411?rand... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script demonstrates moderate-risk behavior by sending user data to a third-party domain (Google Syndication) via the `navigator.sendBeacon()` API. While the script's intent appears to be related to ad interest group management, the use of the `sendBeacon()` function to report errors raises some concerns about potential data exfiltration. Additionally, the script interacts with the `navigator.joinAdInterestGroup()` and `navigator.leaveAdInterestGroup()` APIs, which could be used for tracking or targeted advertising purposes. Overall, the script requires further review due to its aggressive behavior and potential privacy implications." }
for(let i of ig_list.interestGroups){try{if(i.action==0){navigator.joinAdInterestGroup(i.interestGroupAttributes,i.expirationTimeInSeconds);}else if(i.action==1){navigator.leaveAdInterestGroup(i.interestGroupAttributes);}}catch(e){navigator.sendBeacon(`https://pagead2.googlesyndication.com/pagead/gen_204/?id=turtlex_join_ig&tx_jig=${encodeURIComponent(JSON.stringify(i))}&tx_jem=${e.message}&tx_jen=${e.name}`);}}
URL: https://desk.zoho.com/portal/api/web/inapp/5639100... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a configuration script for a Zoho Help Center widget. It sets up various options and configurations for the help center, including enabling a SalesIQ chat, setting up tabs, and defining the appearance and behavior of the help center. While the script interacts with external domains (Zoho's servers), it does not exhibit any high-risk behaviors like dynamic code execution, data exfiltration, or suspicious redirects. The script seems to be part of a legitimate help center implementation, with some outdated practices like the use of the `XDomainRequest` API. Overall, the risk score is low, as the script's purpose and behavior are consistent with its intended use." }
window.ZohoHCAsap=window.ZohoHCAsap\|\|function(a, b) {window.ZohoHCAsap[a] = b};window.ZohoHCAsap.nonceScript=window.document.querySelector("script[nonce]");if(window.ZohoHCAsap.nonceScript){window.ZohoHCAsap.nonce= window.ZohoHCAsap.nonceScript.nonce \|\| window.ZohoHCAsap.nonceScript.getAttribute("nonce") \|\| false;};window.ZohoHCAsap('_defaultoptions' ,{"_helpCenterUrl":"https://support.sugarwish.com/portal/","chatDetails":{"salesIqChat":{"isEnabled":true,"properties":{"visibility":"EVERYONE","widgetcode":"siq91be5b9b632f8c3f1cc31df2110928f4b1ec8fdcc6db5a12ab17eaaf2a600e0f","chatDepartmentIds":null,"url":"https://salesiq.zoho.com/widget","chatType":"EXTERNAL_SALESIQ"}},"ziaBot":{"isEnabled":false,"properties":{}},"ziaGuides":{"isEnabled":false,"properties":{}}},"departmentId":"-1","tabs":[{"tabName":"HOME","name":"Home","isdefault":true,"position":"0","status":true},{"tabName":"TICKETS","name":"Contact Us","isdefault":false,"position":"1","status":true},{"tabName":"ADDTICKET","name":"Submit a Ticket","isdefault":false,"position":"2","status":false},{"tabName":"KB","name":"FAQs","isdefault":false,"position":"3","status":true},{"tabName":"ZOHOCHAT","name":"Chat","isdefault":false,"position":"4","status":true}],"_helpCenterName":"sugarwish","editorPath":"https://static.zohocdn.com/zoho-desk-editor/","i18NLangFile":"en_US","_orgId":"edbsnfe1838428dcf4de4e84eef583654041a358d529391b3da7741bd85ded12ad872","livechatConfig":{"visibility":"EVERYONE","widgetcode":"siq91be5b9b632f8c3f1cc31df2110928f4b1ec8fdcc6db5a12ab17eaaf2a600e0f","chatDepartmentIds":null,"url":"https://salesiq.zoho.com/widget","chatType":"EXTERNAL_SALESIQ"},"isOldChatConfig":false,"poweredByDomain":"zoho.com","id":"563910000000158175","_staticPath":"https://static.zohocdn.com/helpcenter/asapweb/","lang":"en_US","_version":"https://desk.zoho.com/portal/api/","editorVersion":"5.2.0","isMultilingualEnabledForOrg":true,"_helpCenterDepartmentId":"563910000000006907","editorUrl":"https://static.zohocdn.com/zoho-desk-editor/EV5.2.0/js/ZohoDeskEditor.js","activeLocales":[{"i18nLocaleName":"English","name":"Sugarwish Help Center","locale":"en","type":"DEFAULT","status":"ACCESIBLE_IN_HELPCENTER"}],"_basedomain":"https://desk.zoho.com","communityTopicTypes":{"defaultTopicType":"QUESTION","topicTypes":["ANNOUNCEMENT","QUESTION","IDEA","PROBLEM"]},"myAppPortalId":"733434231","deploymentType":"US","name":"How can we help?","styles":{"customThemeColors":{"button":{"secondaryBg":"#e3e5ea","primaryBg":"#1B575E","primaryTextColor":"#ffffff","secondaryTextColor":"#666"},"accentBg":"#A61C25","fontFamily":"DEFAULT","headerAndFab":{"secoundaryBg":"#78dfe7","primaryBg":"#55C5CE","textColor":"#ffffff"},"footer":{"secoundaryBg":"#4a4a4a","primaryBg":"#595959","primaryTextColor":"#ffffff","separatorBgColor":"#4a4a4a","secoundaryTextColor":"#ffffff"},"text":{"primaryColor":"#444444","secondaryColor":"#555555"},"body":{"secoundaryBg":"#ffffff","borderColor":"#e9e9e9","primaryBg":"#ffffff"}},"shape":"BUBBLE","icon":"ZOHOCHAT","isPoweredByEnabled":false,"theme":"CUSTOMTHEME","position":"BOTTOM RIGHT","boxshadow":{"elevation":"3","isactive":"false","opacity":"4"},"customLauncherIconURL":""},"_preferences":{"isKBWatchListEnabled":true,"isAccountTicketViewable":false,"isArticleUpdatedTimeVisible":true,"isMultiLayoutGridViewEnabled":true,"articleFeedbackFormOnDislike":"show","isSEONoIndexNoFollowSetAcrossAllPages":false,"isSignUpFormCustomized":false,"tocPosition":"top","showFeedbackFormOnDislike":true,"isTicketViewsEnabled":true,"isCustomStatusFilterEnabled":false,"isArticleAuthorInfoVisible":false,"isSelfSignUp":false,"isImageWaitEnabled":false,"isKBEndUsersCommentEnabled":false,"isCommunityEnabled":false,"isKBModerationEnabled":false,"isTocEnabled":true,"isClientDebuggingEnabled":false,"isPayloadEncryptionEnabled":false,"guestUserAccessRestriction":{"submitTicket":false},"signupFormLayout":"STATIC_FORM","isUserDeletionEnabled":true,"isSEOSetAcrossAllPages":true,"isHelpCenterPublic":true,"searchScope":"gl
URL: https://sugarwish.com/receiver/card/ss-GEDN-82KAK Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "WARM HOLIDAY WISHES", "prominent_button_name": "choose my favorites now!", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://sugarwish.com/js/jquery-3.5.1.min.js... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script is a standard jQuery library, which is widely used and trusted. It does not exhibit any high-risk behaviors such as dynamic code execution or data exfiltration. The script primarily involves DOM manipulation and utility functions typical of jQuery, with no malicious intent." }
/! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license / !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[o.call(e)]\|\|"object":typeof e}var f="3.5.1",S=function(e,t){return new S.fn.init(e,t)};function p(e){var t=!!e&&"length"in e&&e.length,n=w(e);return!m(e)&&!x(e)&&("array"===n\|\|0===t\|\|"number"==typeof t&&0<t&&t-1 in e)}S.fn=S.prototype={jquery:f,constructor:S,length:0,toArray:function(){return s.call(this)},get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this.pushStack(s.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},even:function(){return this.pushStack(S.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return this.pushStack(S.grep(this,function(e,t){return t%2}))},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:u,sort:t.sort,splice:t.splice},S.extend=S.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]\|\|{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|m(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(l&&r&&(S.isPlainObject(r)\|\|(i=Array.isArray(r)))?(n=a[t],o=i&&!Array.isArray(n)?[]:i\|\|S.isPlainObject(n)?n:{},i=!1,a[t]=S.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},S.extend({expando:"jQuery"+(f+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.nonce},n)},each:function(e,t){var n,r=0;if(p(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},makeArray:function(e,t){var n=t\|\|[];return null!=e&&(p(Object(e))?S.merge(n,"string"==typeof e?[e]:e):u.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:i.call(t,e,n)},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r=[],i=0,o=e.length,a=!n;i<o;i++)!t(e[i],i)!==a&&r.push(e[i]);return r},map:function(e,t,n){var r,i,o=0,a=[];if(p(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&a.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&a.push(i);return g(a)},guid:1,support:y}),"function"==typeof Symbol&&(S.fn[Symbol.iterator]=t[Symbol.iterator]),S.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(e,t){n["[object "+t+"]"]=t.toLowerCase()});var d=function(n){var e,d,b,o,i,h,f,g,w,u,l,T,C,a,E,v,s,c,y,S="sizzle"+1*new Date,p=n.document,
URL: https://cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script is a known library (Bootstrap v4.6.0) used for UI components, with no high-risk behaviors like dynamic code execution or data exfiltration. It interacts with jQuery, a trusted library, and does not exhibit any suspicious or malicious behavior." }
/! Bootstrap v4.6.0 (https://getbootstrap.com/) * Copyright 2011-2021 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors) * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE) / !function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery")):"function"==typeof define&&define.amd?define(["exports","jquery"],e):e((t="undefined"!=typeof globalThis?globalThis:t\|\|self).bootstrap={},t.jQuery)}(this,(function(t,e){"use strict";function n(t){return t&&"object"==typeof t&&"default"in t?t:{default:t}}var i=n(e);function o(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function r(t,e,n){return e&&o(t.prototype,e),n&&o(t,n),t}function a(){return(a=Object.assign\|\|function(t){for(var e=1;e<arguments.length;e++){var n=arguments[e];for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&(t[i]=n[i])}return t}).apply(this,arguments)}function s(t){var e=this,n=!1;return i.default(this).one(l.TRANSITION_END,(function(){n=!0})),setTimeout((function(){n\|\|l.triggerTransitionEnd(e)}),t),this}var l={TRANSITION_END:"bsTransitionEnd",getUID:function(t){do{t+=~~(1e6Math.random())}while(document.getElementById(t));return t},getSelectorFromElement:function(t){var e=t.getAttribute("data-target");if(!e\|\|"#"===e){var n=t.getAttribute("href");e=n&&"#"!==n?n.trim():""}try{return document.querySelector(e)?e:null}catch(t){return null}},getTransitionDurationFromElement:function(t){if(!t)return 0;var e=i.default(t).css("transition-duration"),n=i.default(t).css("transition-delay"),o=parseFloat(e),r=parseFloat(n);return o\|\|r?(e=e.split(",")[0],n=n.split(",")[0],1e3*(parseFloat(e)+parseFloat(n))):0},reflow:function(t){return t.offsetHeight},triggerTransitionEnd:function(t){i.default(t).trigger("transitionend")},supportsTransitionEnd:function(){return Boolean("transitionend")},isElement:function(t){return(t[0]\|\|t).nodeType},typeCheckConfig:function(t,e,n){for(var i in n)if(Object.prototype.hasOwnProperty.call(n,i)){var o=n[i],r=e[i],a=r&&l.isElement(r)?"element":null===(s=r)\|\|"undefined"==typeof s?""+s:{}.toString.call(s).match(/\s([a-z]+)/i)[1].toLowerCase();if(!new RegExp(o).test(a))throw new Error(t.toUpperCase()+': Option "'+i+'" provided type "'+a+'" but expected type "'+o+'".')}var s},findShadowRoot:function(t){if(!document.documentElement.attachShadow)return null;if("function"==typeof t.getRootNode){var e=t.getRootNode();return e instanceof ShadowRoot?e:null}return t instanceof ShadowRoot?t:t.parentNode?l.findShadowRoot(t.parentNode):null},jQueryDetection:function(){if("undefined"==typeof i.default)throw new TypeError("Bootstrap's JavaScript requires jQuery. jQuery must be included before Bootstrap's JavaScript.");var t=i.default.fn.jquery.split(" ")[0].split(".");if(t[0]<2&&t[1]<9\|\|1===t[0]&&9===t[1]&&t[2]<1\|\|t[0]>=4)throw new Error("Bootstrap's JavaScript requires at least jQuery v1.9.1 but less than v4.0.0")}};l.jQueryDetection(),i.default.fn.emulateTransitionEnd=s,i.default.event.special[l.TRANSITION_END]={bindType:"transitionend",delegateType:"transitionend",handle:function(t){if(i.default(t.target).is(this))return t.handleObj.handler.apply(this,arguments)}};var u="alert",f=i.default.fn[u],d=function(){function t(t){this._element=t}var e=t.prototype;return e.close=function(t){var e=this._element;t&&(e=this._getRootElement(t)),this._triggerCloseEvent(e).isDefaultPrevented()\|\|this._removeElement(e)},e.dispose=function(){i.default.removeData(this._element,"bs.alert"),this._element=null},e._getRootElement=function(t){var e=l.getSelectorFromElement(t),n=!1;return e&&(n=document.querySelector(e)),n\|\|(n=i.default(t).closest(".alert")[0]),n},e._triggerCloseEvent=function(t){var e=i.default.Event("close.bs.alert");return i.default(t).trigger(e),e},e._removeElement=function(t){var e=this;if(i.default(t).removeClass("show"),i.default(t).hasClass("fade")){var n=l.getTransit
URL: https://sugarwish.com/receiver/card/ss-GEDN-82KAK Model: Joe Sandbox AI	{ "brands": [ "Sugarwish" ] }
	{ "brands": [ "Sugarwish" ] }
URL: https://sugarwish.com/receiver/card/ss-GEDN-82KAK Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "WARM HOLIDAY WISHES", "prominent_button_name": "choose my favorites now!", "text_input_field_labels": "Where are you located?", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://sugarwish.com/verify-age-and-state Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "First, a few questions:", "prominent_button_name": "Continue", "text_input_field_labels": [ "Where are you located?" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://sugarwish.com/verify-age-and-state Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "First, a few questions:", "prominent_button_name": "Continue", "text_input_field_labels": [ "Where are you located?" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://sugarwish.com/verify-age-and-state Model: Joe Sandbox AI	{ "brands": [ "Sugarwish" ] }
	{ "brands": [ "Sugarwish" ] }
URL: https://sugarwish.com/verify-age-and-state Model: Joe Sandbox AI	{ "brands": [ "Sugarwish" ] }
	{ "brands": [ "Sugarwish" ] }
URL: https://sugarwish.com/receiver/card/ss-GEDN-82KAK Model: Joe Sandbox AI	{ "brands": [ "Sugarwish" ] }
	{ "brands": [ "Sugarwish" ] }
URL: https://sugarwish.com/receiver/wine-selected Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Chase Curtin sent you a Sugarwish!", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 24 11:27:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9798615447787786
Encrypted:	false
SSDEEP:
MD5:	24D76967E2F4E126B1048362246F1C34
SHA1:	358D24473C94E89F7947EAD494645B8204041E51
SHA-256:	E107EF6F153A03AEF2B1DE602717CAA1E050D5D64573AD8F0A934B656C7C73FE
SHA-512:	61E3F0CDC9FB13EEC8601E93E4F2FD802E825EEB9CB7A3AA610BE499B0C9DE319101DADEFA768ECD00B2A13FF6EBB44E1EC770934A86E40F10493FDF99BA1B0D
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......;'.U..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.YZc....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Ydc....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Ydc....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Ydc..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yec...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........<r.F.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Name	IP	Active	Malicious	Reputation
star-mini.c10r.facebook.com	157.240.196.35	true	false	high
google.com	172.217.17.46	true	false	high
geo.cookie-script.com	188.226.136.4	true	false	high
faro-collector-prod-us-east-0.grafana.net	3.12.75.59	true	false	unknown
manage.sugarwish.com	54.205.15.246	true	false	unknown
support.zoho.com	204.141.33.104	true	false	unknown
h2-stratus.zohocdn.com	199.67.80.86	true	false	high
stats.g.doubleclick.net	64.233.167.157	true	false	high
s3-r-w.us-east-1.amazonaws.com	52.217.102.16	true	false	unknown
s3-w.us-east-1.amazonaws.com	52.216.42.57	true	false	high
scontent.xx.fbcdn.net	157.240.196.15	true	false	high
analytics-alv.google.com	216.239.32.181	true	false	high
googleads.g.doubleclick.net	172.217.19.226	true	false	high
sugarwish.com	35.169.201.214	true	false	high
duihxgfnjg37f.cloudfront.net	108.158.75.27	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
www.google.com	142.250.181.68	true	false	high
td.doubleclick.net	172.217.19.162	true	false	high
unpkg.com	104.17.249.203	true	false	high
assets.ubembed.com	52.84.45.62	true	false	high
cdn.jsdelivr.net	unknown	unknown	false	high
desk.zoho.com	unknown	unknown	false	high
live-sugarwish.s3.amazonaws.com	unknown	unknown	false	unknown
sugarwish-us.attn.tv	unknown	unknown	false	high
cea3c1ac507443e5876ac8d9858fc60b.js.ubembed.com	unknown	unknown	false	unknown
static.zohocdn.com	unknown	unknown	false	high
sw-live-cms.s3.us-east-1.amazonaws.com	unknown	unknown	false	unknown
erywms.sugarwish.com	unknown	unknown	false	high
cdn.attn.tv	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
kit.fontawesome.com	unknown	unknown	false	high
events.attentivemobile.com	unknown	unknown	false	high
connect.facebook.net	unknown	unknown	false	high
analytics.google.com	unknown	unknown	false	high

Name	Malicious	Reputation
https://sugarwish.com/verify-age-and-state	false	unknown
https://sugarwish.com/receiver/general-info	false	unknown
https://sugarwish.com/receiver/wine-selected	false	unknown
https://sugarwish.com/receiver/card/ss-GEDN-82KAK	false	unknown
https://sugarwish.com/receiver/choose/cookies	false	unknown

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://sugarwish.com/receiver/card/ss-GEDN-82KAK

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 204

Chrome Cache Entry: 207

Chrome Cache Entry: 209

Chrome Cache Entry: 211

Chrome Cache Entry: 212

Chrome Cache Entry: 213

Chrome Cache Entry: 214

Chrome Cache Entry: 216

Chrome Cache Entry: 218

Chrome Cache Entry: 219

Chrome Cache Entry: 220

Chrome Cache Entry: 226

Chrome Cache Entry: 228

Chrome Cache Entry: 229

Chrome Cache Entry: 230

Chrome Cache Entry: 231

Chrome Cache Entry: 236

Chrome Cache Entry: 237

Chrome Cache Entry: 238

Chrome Cache Entry: 239

Chrome Cache Entry: 242

Chrome Cache Entry: 244

Chrome Cache Entry: 245

Chrome Cache Entry: 246

Chrome Cache Entry: 247

Chrome Cache Entry: 248

Chrome Cache Entry: 250

Chrome Cache Entry: 251

Chrome Cache Entry: 252

Chrome Cache Entry: 254

Chrome Cache Entry: 255

Chrome Cache Entry: 256

Windows Analysis Report
https://sugarwish.com/receiver/card/ss-GEDN-82KAK