Edit tour

Windows Analysis Report
http://keywestlending.com

Overview

General Information

Sample URL:	http://keywestlending.com
Analysis ID:	1583487

Detection

CAPTCHA Scam ClickFix

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detect drive by download via clipboard copy & paste

Yara detected CAPTCHA Scam ClickFix

HTML title does not match URL

Javascript checks online IP of machine

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 1088 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 2976 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2020,i,5894002584542175940,16568051464793512701,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6584 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://keywestlending.com" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
1.2.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security
1.4.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security
1.3.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected CAPTCHA Scam ClickFix

Source: Yara match	File source: 1.2.pages.csv, type: HTML
Source: Yara match	File source: 1.4.pages.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML

Source: https://keywestlending.com/

HTTP Parser: Title: Mortgage Lenders In Georgia | Best Mortgage Companies & Brokers does not match URL

Source: https://cdn-ikpgded.nitrocdn.com/ByAaHzKDrfYwKXVWZvndYbCvpgDAAInZ/assets/static/optimized/rev-b9f34b3/keywestlending.com/wp-content/plugins/wpforms/assets/js/nitro-min-dbb50c4c7710fd8c13804c1b983b9a3e.wpforms.min.js

HTTP Parser: "use strict";var wpforms=window.wpforms||function(i,s,l){var p={cache:{},init:function(){l(p.ready),l(s).on("load",function(){"function"==typeof l.ready.then?l.ready.then(p.load):p.load()}),p.binduiactions(),p.bindoptinmonster()},ready:function(){p.clearurlquery(),p.setuserindentifier(),p.loadvalidation(),p.loaddatepicker(),p.loadtimepicker(),p.loadinputmask(),p.loadsmartphonefield(),p.loadpayments(),p.loadmailcheck(),p.loadchoicesjs(),l(".wpforms-randomize").each(function(){for(var e=l(this),t=e.children();t.length;)e.append(t.splice(math.floor(math.random()*t.length),1)[0])}),l(".wpforms-page-button").prop("disabled",!1),l(i).trigger("wpformsready")},load:function(){},clearurlquery:function(){var e=s.location,t=e.search;-1!==t.indexof("wpforms_form_id=")&&(t=t.replace(/([&?]wpforms_form_id=[0-9]*$|wpforms_form_id=[0-9]*&|[?&]wpforms_form_id=[0-9]*(?=#))/,""),history.replacestate({},null,e.origin+e.pathname+t))},loadvalidation:function(){void 0!==l.fn.validate&&(l(".wpforms-input-temp-name").each(function(e,...

Source: https://keywestlending.com/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-K23S2H6F
Source: https://keywestlending.com/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-K23S2H6F
Source: https://keywestlending.com/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-K23S2H6F
Source: https://keywestlending.com/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-K23S2H6F
Source: https://keywestlending.com/	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-K23S2H6F

Source: https://keywestlending.com/	HTTP Parser: No favicon
Source: https://keywestlending.com/	HTTP Parser: No favicon
Source: https://keywestlending.com/	HTTP Parser: No favicon
Source: https://keywestlending.com/	HTTP Parser: No favicon
Source: https://keywestlending.com/	HTTP Parser: No favicon

Source: https://keywestlending.com/	HTTP Parser: No <meta name="author".. found
Source: https://keywestlending.com/	HTTP Parser: No <meta name="author".. found
Source: https://keywestlending.com/	HTTP Parser: No <meta name="author".. found
Source: https://keywestlending.com/	HTTP Parser: No <meta name="author".. found
Source: https://keywestlending.com/	HTTP Parser: No <meta name="author".. found

Source: https://keywestlending.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://keywestlending.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://keywestlending.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://keywestlending.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://keywestlending.com/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.17:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.108.11.254:443 -> 192.168.2.17:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.17:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.133:443 -> 192.168.2.17:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.42.254:443 -> 192.168.2.17:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.17:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.17:49855 version: TLS 1.2

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: keywestlending.com
Source: global traffic	DNS traffic detected: DNS query: cdn-ikpgded.nitrocdn.com
Source: global traffic	DNS traffic detected: DNS query: nitroscripts.com
Source: global traffic	DNS traffic detected: DNS query: to.getnitropack.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: data-seed-prebsc-1-s1.bnbchain.org
Source: global traffic	DNS traffic detected: DNS query: _8545._https.data-seed-prebsc-1-s1.bnbchain.org
Source: global traffic	DNS traffic detected: DNS query: use.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: mc.yandex.ru
Source: global traffic	DNS traffic detected: DNS query: mc.yandex.com
Source: global traffic	DNS traffic detected: DNS query: s.w.org

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.17:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.108.11.254:443 -> 192.168.2.17:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.17:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.133:443 -> 192.168.2.17:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.42.254:443 -> 192.168.2.17:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.17:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.17:49855 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.win@21/6@42/292

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2020,i,5894002584542175940,16568051464793512701,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://keywestlending.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2020,i,5894002584542175940,16568051464793512701,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Persistence and Installation Behavior

Detect drive by download via clipboard copy & paste

Source: screenshot	OCR Text: x e about:blank Martgage Lenders In Georgia I E keywestlending.cam Complete these Verification Steps To better prove you are not a robot. please: 1. Press & hold the Windows Key C + R 2. In the verification window, press Ctrl + V. 3. Press Enter on your keyboard to finish. You will observe and agree: am a robot retA9tOiA 10; VERIFY finish verification. 1444 ENG p Type here to search SG 02/01/2025
Source: Chrome DOM: 1.4	OCR Text: Complete these Verification Steps To better prove you are not a robot. please: I. Press & hold the Windows Key + R 2. In the verification window, press Ctrl + V 3. Press Enter on your keyboard to finish. You will observe and agree: robot reCA9tOiA JO; Perform the steps above to VERIFY finish verification.
Source: screenshot	OCR Text: x e about:blank Martgage Lenders In Georgia I E keywestlending.cam Complete these Verification Steps To better prove you are not a robot. please: 1. Press & hold the Windows Key C + R 2. In the verification window, press Ctrl + V. 3. Press Enter on your keyboard to finish. You will observe and agree: am a robot retA9tOiA 10; VERIFY finish verification. 14:43 ENG p Type here to search SG 02/01/2025

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
http://keywestlending.com	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
mc.yandex.ru	93.158.134.119	true	false	high
a37dd8b3f3000a75e.awsglobalaccelerator.com	15.197.152.159	true	false	unknown
keywestlending.com	104.219.248.99	true	false	unknown
cdn-ikpgded.nitrocdn.com	172.64.154.105	true	false	unknown
www.google.com	142.250.185.164	true	false	high
nitroscripts.com	172.64.154.248	true	false	high
s.w.org	192.0.77.48	true	false	high
to.getnitropack.com	104.18.39.246	true	false	unknown
use.fontawesome.com	unknown	unknown	false	high
data-seed-prebsc-1-s1.bnbchain.org	unknown	unknown	false	high
mc.yandex.com	unknown	unknown	false	high
_8545._https.data-seed-prebsc-1-s1.bnbchain.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://keywestlending.com/	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.142.245	unknown	United States	13335	CLOUDFLARENETUS	false
87.250.250.119	unknown	Russian Federation	13238	YANDEXRU	false
192.0.77.48	s.w.org	United States	2635	AUTOMATTICUS	false
64.233.166.84	unknown	United States	15169	GOOGLEUS	false
172.217.23.99	unknown	United States	15169	GOOGLEUS	false
93.158.134.119	mc.yandex.ru	Russian Federation	13238	YANDEXRU	false
142.250.185.164	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.110	unknown	United States	15169	GOOGLEUS	false
104.18.39.246	to.getnitropack.com	United States	13335	CLOUDFLARENETUS	false
142.250.74.196	unknown	United States	15169	GOOGLEUS	false
142.250.185.67	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.16.206	unknown	United States	15169	GOOGLEUS	false
104.219.248.99	keywestlending.com	United States	22612	NAMECHEAP-NETUS	false
142.250.185.232	unknown	United States	15169	GOOGLEUS	false
142.250.185.138	unknown	United States	15169	GOOGLEUS	false
15.197.152.159	a37dd8b3f3000a75e.awsglobalaccelerator.com	United States	7430	TANDEMUS	false
142.250.185.136	unknown	United States	15169	GOOGLEUS	false
104.18.33.8	unknown	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.164	unknown	United States	15169	GOOGLEUS	false
77.88.21.119	unknown	Russian Federation	13238	YANDEXRU	false
172.64.154.105	cdn-ikpgded.nitrocdn.com	United States	13335	CLOUDFLARENETUS	false
172.64.154.248	nitroscripts.com	United States	13335	CLOUDFLARENETUS	false
142.250.184.238	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583487
Start date and time:	2025-01-02 20:42:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://keywestlending.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@21/6@42/292

Warnings

Exclude process from analysis (whitelisted): TextInputHost.exe
Excluded IPs from analysis (whitelisted): 172.217.23.99, 142.250.186.110, 64.233.166.84, 142.250.74.206, 172.217.16.206
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, redirector.gvt1.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: http://keywestlending.com

LLM Input / Output

Input	Output
URL: http://keywestlending.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: http://keywestlending.com
URL: https://keywestlending.com/... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script demonstrates moderate-risk behaviors, including external data transmission and aggressive DOM manipulation. While it appears to have a legitimate purpose related to handling iframe messages, the use of the `nitro-og-src` attribute and the ability to remove overlays raises some concerns. Further review may be necessary to determine the full extent of the script's functionality and potential risks." }
(function(){var t={childList:false,attributes:true,subtree:false,attributeFilter:["src"],attributeOldValue:true};var e=null;var r=[];function n(t){let n=r.indexOf(t);if(n>-1){r.splice(n,1);e.disconnect();a()}t.src=t.getAttribute("nitro-og-src");t.parentNode.querySelector(".nitro-removable-overlay")?.remove()}function i(){if(!e){e=new MutationObserver(function(t,e){t.forEach(t=>{if(t.type=="attributes"&&t.attributeName=="src"){let r=t.target;let n=r.getAttribute("nitro-og-src");let i=r.src;if(i!=n&&t.oldValue!==null){e.disconnect();let o=i.replace(t.oldValue,"");if(i.indexOf("data:")===0&&["?","&"].indexOf(o.substr(0,1))>-1){if(n.indexOf("?")>-1){r.setAttribute("nitro-og-src",n+"&"+o.substr(1))}else{r.setAttribute("nitro-og-src",n+"?"+o.substr(1))}}r.src=t.oldValue;a()}}})})}return e}function o(e){i().observe(e,t)}function a(){r.forEach(o)}window.addEventListener("message",function(t){if(t.data.action&&t.data.action==="playBtnClicked"){var e=document.getElementsByTagName("iframe");for(var r=0;r<e.length;r++){if(t.source===e[r].contentWindow){n(e[r])}}}});document.addEventListener("DOMContentLoaded",function(){document.querySelectorAll("iframe[nitro-og-src]").forEach(t=>{r.push(t)});a()})})();
URL: https://keywestlending.com/... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a simple device detection and DOM manipulation script, which is a common practice for responsive web design. It checks the user agent string for mobile device identifiers and updates the HTML element's class list accordingly. This behavior is generally benign and does not exhibit any high-risk indicators." }
(function(){var a=false;var e=document.documentElement.classList;var i=navigator.userAgent.toLowerCase();var n=["android","iphone","ipad"];var r=n.length;var o;var d=null;for(var t=0;t<r;t++){o=n[t];if(i.indexOf(o)>-1)d=o;if(e.contains(o)){a=true;e.remove(o)}}if(a&&d){e.add(d);if(d=="iphone"\|\|d=="ipad"){e.add("ios")}}})();
URL: https://keywestlending.com/... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a browser compatibility check and redirect for Internet Explorer and Trident-based browsers. It checks the user agent string and, if the user is on an affected browser, it appends a 'nonitro' parameter to the current URL. This behavior is likely a legitimate feature or workaround for a specific web application, and does not demonstrate any high-risk indicators. The script is considered low-risk with a score of 3." }
if(navigator.userAgent.match(/MSIE\|Internet Explorer/i)\|\|navigator.userAgent.match(/Trident\/7\..*?rv:11/i)){var e=document.location.href;if(!e.match(/[?&]nonitro/)){if(e.indexOf("?")==-1){if(e.indexOf("#")==-1){document.location.href=e+"?nonitro=1"}else{document.location.href=e.replace("#","?nonitro=1#")}}else{if(e.indexOf("#")==-1){document.location.href=e+"&nonitro=1"}else{document.location.href=e.replace("#","&nonitro=1#")}}}}
URL: https://keywestlending.com/... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script appears to be related to the NitroPack service, which is a web optimization and performance tool. While it sends some data to a third-party domain, the behavior is consistent with typical analytics and telemetry functionality. The script does not exhibit any high-risk indicators like dynamic code execution or data exfiltration. However, the use of the `sendBeacon` API and the interaction with an external domain warrant further review to ensure the script's behavior is transparent and legitimate." }
(()=>{window.NitroPack=window.NitroPack\|\|{coreVersion:"9429066",isCounted:!1};let e=document.createElement("script");if(e.src="https://nitroscripts.com/ByAaHzKDrfYwKXVWZvndYbCvpgDAAInZ",e.async=!0,e.id="nitro-script",document.head.appendChild(e),!window.NitroPack.isCounted){window.NitroPack.isCounted=!0;let t=()=>{navigator.sendBeacon("https://to.getnitropack.com/p",JSON.stringify({siteId:"ByAaHzKDrfYwKXVWZvndYbCvpgDAAInZ",url:window.location.href,isOptimized:!!window.IS_NITROPACK,coreVersion:"9429066",missReason:window.NPTelemetryMetadata?.missReason\|\|"",pageType:window.NPTelemetryMetadata?.pageType\|\|"",isEligibleForOptimization:!!window.NPTelemetryMetadata?.isEligibleForOptimization}))};(()=>{let e=()=>new Promise(e=>{"complete"===document.readyState?e():window.addEventListener("load",e)}),i=()=>new Promise(e=>{document.prerendering?document.addEventListener("prerenderingchange",e,{once:!0}):e()}),a=async()=>{await i(),await e(),t()};a()})(),window.addEventListener("pageshow",e=>{if(e.persisted){let i=document.prerendering\|\|self.performance?.getEntriesByType?.("navigation")[0]?.activationStart>0;"visible"!==document.visibilityState\|\|i\|\|t()}})}})();
URL: https://keywestlending.com/... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a polyfill for the CSS preload feature, which is a legitimate and common practice to improve web performance. The script does not exhibit any high-risk behaviors, such as dynamic code execution, data exfiltration, or redirects to malicious domains. The script's purpose is to ensure that CSS resources are loaded efficiently, which is a common and expected functionality for web pages. While the script uses some legacy APIs like `XDomainRequest`, these pose only minor risks and are not inherently malicious. Overall, this script is likely benign and can be considered low risk." }
(function(e){"use strict";if(!e.loadCSS){e.loadCSS=function(){}}var t=loadCSS.relpreload={};t.support=function(){var t;try{t=e.document.createElement("link").relList.supports("preload")}catch(e){t=false}return function(){return t}}();t.bindMediaToggle=function(e){var t=e.media\|\|"all";function a(){e.media=t}if(e.addEventListener){e.addEventListener("load",a)}else if(e.attachEvent){e.attachEvent("onload",a)}setTimeout(function(){e.rel="stylesheet";e.media="only x"});setTimeout(a,3e3)};t.poly=function(){if(t.support()){return}var a=e.document.getElementsByTagName("link");for(var n=0;n<a.length;n++){var o=a[n];if(o.rel==="preload"&&o.getAttribute("as")==="style"&&!o.getAttribute("data-loadcss")){o.setAttribute("data-loadcss",true);t.bindMediaToggle(o)}}};if(!t.support()){t.poly();var a=e.setInterval(t.poly,500);if(e.addEventListener){e.addEventListener("load",function(){t.poly();e.clearInterval(a)})}else if(e.attachEvent){e.attachEvent("onload",function(){t.poly();e.clearInterval(a)})}}if(typeof exports!=="undefined"){exports.loadCSS=loadCSS}else{e.loadCSS=loadCSS}})(typeof global!=="undefined"?global:this);
URL: https://keywestlending.com/... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The provided JavaScript snippet appears to be a part of the Nitro web optimization framework. While it includes some potentially risky behaviors, such as dynamic code execution and data transmission, the overall context suggests it is likely a legitimate script with a focus on performance optimization and event handling. The script does not exhibit clear signs of malicious intent, but it could benefit from further review to ensure proper implementation and data handling practices." }
(()=>{if(window.NPRL!=undefined)return;(function(e){var t=e.prototype;t.after\|\|(t.after=function(){var e,t=arguments,n=t.length,r=0,i=this,o=i.parentNode,a=Node,c=String,u=document;if(o!==null){while(r<n){(e=t[r])instanceof a?(i=i.nextSibling)!==null?o.insertBefore(e,i):o.appendChild(e):o.appendChild(u.createTextNode(c(e)));++r}}})})(Element);var e,t;e=t=function(){var t=false;var r=window.URL\|\|window.webkitURL;var i=true;var o=true;var a=2;var c=null;var u=null;var d=window.nitroGtmExcludes!=undefined;var s=d?JSON.parse(atob(window.nitroGtmExcludes)).map(e=>new RegExp(e)):[];var l;var f;var m=null;var v=null;var p=null;var g={touch:["touchmove","touchend"],default:["mousemove","click","keydown","wheel"]};var h=true;var E=[];var y=false;var w=[];var b=0;var S=0;var N=false;var L=0;var R=null;var T=false;var O=false;var A=false;var C=[];var P=[];var I=[];var M=[];var k=false;var x={};var j=new Map;var _="noModule"in HTMLScriptElement.prototype;var B=requestAnimationFrame\|\|mozRequestAnimationFrame\|\|webkitRequestAnimationFrame\|\|msRequestAnimationFrame;function q(e,t){if(!x[e]){x[e]=[]}x[e].push(t)}function D(e,t){if(x[e]){var n=0,r=x[e];for(var n=0;n<r.length;n++){r[n].call(this,t)}}}function H(){(function(e,t){var r=null;var i=function(e){r(e)};var o=null;var a={};var c=null;var u=null;var d=0;e.addEventListener(t,function(r){if(["load","DOMContentLoaded"].indexOf(t)!=-1){if(u){K(function(){e.triggerNitroEvent(t)})}c=true}else if(t=="readystatechange"){d++;n.ogReadyState=d==1?"interactive":"complete";if(u&&u>=d){n.documentReadyState=n.ogReadyState;K(function(){e.triggerNitroEvent(t)})}}});e.addEventListener(t+"Nitro",function(e){if(["load","DOMContentLoaded"].indexOf(t)!=-1){if(!c){e.preventDefault();e.stopImmediatePropagation()}else{}u=true}else if(t=="readystatechange"){u=n.documentReadyState=="interactive"?1:2;if(d<u){e.preventDefault();e.stopImmediatePropagation()}}});switch(t){case"load":o="onload";break;case"readystatechange":o="onreadystatechange";break;case"pageshow":o="onpageshow";break;default:o=null;break}if(o){Object.defineProperty(e,o,{get:function(){return r},set:function(n){if(typeof n!=="function"){r=null;e.removeEventListener(t+"Nitro",i)}else{if(!r){e.addEventListener(t+"Nitro",i)}r=n}}})}Object.defineProperty(e,"addEventListener"+t,{value:function(r){if(r!=t\|\|!n.startedScriptLoading\|\|document.currentScript&&document.currentScript.hasAttribute("nitro-exclude")){}else{arguments[0]+="Nitro"}e.ogAddEventListener.apply(e,arguments);a[arguments[1]]=arguments[0]}});Object.defineProperty(e,"removeEventListener"+t,{value:function(t){var n=a[arguments[1]];arguments[0]=n;e.ogRemoveEventListener.apply(e,arguments)}});Object.defineProperty(e,"triggerNitroEvent"+t,{value:function(t,n){n=n\|\|e;var r=new Event(t+"Nitro",{bubbles:true});r.isNitroPack=true;Object.defineProperty(r,"type",{get:function(){return t},set:function(){}});Object.defineProperty(r,"target",{get:function(){return n},set:function(){}});e.dispatchEvent(r)}});if(typeof e.triggerNitroEvent==="undefined"){(function(){var t=e.addEventListener;var n=e.removeEventListener;Object.defineProperty(e,"ogAddEventListener",{value:t});Object.defineProperty(e,"ogRemoveEventListener",{value:n});Object.defineProperty(e,"addEventListener",{value:function(n){var r="addEventListener"+n;if(typeof e[r]!=="undefined"){e[r].apply(e,arguments)}else{t.apply(e,arguments)}},writable:true});Object.defineProperty(e,"removeEventListener",{value:function(t){var r="removeEventListener"+t;if(typeof e[r]!=="undefined"){e[r].apply(e,arguments)}else{n.apply(e,arguments)}}});Object.defineProperty(e,"triggerNitroEvent",{value:function(t,n){var r="triggerNitroEvent"+t;if(typeof e[r]!=="undefined"){e[r].apply(e,arguments)}}})})()}}).apply(null,arguments)}H(window,"load");H(window,"pageshow");H(window,"DOMContentLoaded");H(document,"DOMContentLoaded");H(document,"readystatechange");try{var U=new Worker(r.createObjectURL(new Blob([document.getElementById("nitro-web-worker").textContent],{type:"text/javas
URL: https://keywestlending.com/... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a simple scroll position tracking utility, which is a common and legitimate practice. It uses the browser's `sessionStorage` to store the user's scroll position on the current page, and it retrieves this position when the page is loaded. This behavior is typical for features like 'scroll to last position' functionality. The script does not exhibit any high-risk indicators, such as dynamic code execution, data exfiltration, or suspicious redirects. The only low-risk indicator is the use of the legacy `XDomainRequest` API, which poses a minor risk but is not inherently malicious. Overall, this script seems to be a benign utility with no clear signs of malicious intent." }
var NPSH,NitroScrollHelper;NPSH=NitroScrollHelper=function(){let e=null;const o=window.sessionStorage.getItem("nitroScrollPos");function t(){let e=JSON.parse(window.sessionStorage.getItem("nitroScrollPos"))\|\|{};if(typeof e!=="object"){e={}}e[document.URL]=window.scrollY;window.sessionStorage.setItem("nitroScrollPos",JSON.stringify(e))}window.addEventListener("scroll",function(){if(e!==null){clearTimeout(e)}e=setTimeout(t,200)},{passive:true});let r={};r.getScrollPos=()=>{if(!o){return 0}const e=JSON.parse(o);return e[document.URL]\|\|0};r.isScrolled=()=>{return r.getScrollPos()>document.documentElement.clientHeight*.5};return r}();
URL: https://keywestlending.com/... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a part of the 'lazysizes' library, which is a popular and widely-used lazy-loading library for images and iframes. The code does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or redirects to malicious domains. The behaviors observed are primarily related to lazy-loading functionality, which is a common and legitimate practice. While the code uses some legacy APIs like `XDomainRequest`, these pose minor risks and are not inherently malicious. Overall, this script is likely benign and used for legitimate purposes." }
(function(e,t){if(typeof module=="object"&&module.exports){module.exports=lazySizes}else{e.lazySizes=t(e,e.document,Date)}})(window,function e(e,t,r){"use strict";if(!e.IntersectionObserver\|\|!t.getElementsByClassName\|\|!e.MutationObserver){return}var i,n;var a=t.documentElement;var s=e.HTMLPictureElement;var o="addEventListener";var l="getAttribute";var c=e[o].bind(e);var u=e.setTimeout;var f=e.requestAnimationFrame\|\|u;var d=e.requestIdleCallback\|\|u;var v=/^picture$/i;var m=["load","error","lazyincluded","_lazyloaded"];var g=Array.prototype.forEach;var p=function(e,t){return e.classList.contains(t)};var z=function(e,t){e.classList.add(t)};var h=function(e,t){e.classList.remove(t)};var y=function(e,t,r){var i=r?o:"removeEventListener";if(r){y(e,t)}m.forEach(function(r){e[i](r,t)})};var b=function(e,r,n,a,s){var o=t.createEvent("CustomEvent");if(!n){n={}}n.instance=i;o.initCustomEvent(r,!a,!s,n);e.dispatchEvent(o);return o};var C=function(t,r){var i;if(!s&&(i=e.picturefill\|\|n.pf)){i({reevaluate:true,elements:[t]})}else if(r&&r.src){t.src=r.src}};var w=function(e,t){return(getComputedStyle(e,null)\|\|{})[t]};var E=function(e,t,r){r=r\|\|e.offsetWidth;while(r<n.minSize&&t&&!e._lazysizesWidth){r=t.offsetWidth;t=t.parentNode}return r};var A=function(){var e,r;var i=[];var n=function(){var t;e=true;r=false;while(i.length){t=i.shift();t[0].apply(t[1],t[2])}e=false};return function(a){if(e){a.apply(this,arguments)}else{i.push([a,this,arguments]);if(!r){r=true;(t.hidden?u:f)(n)}}}}();var x=function(e,t){return t?function(){A(e)}:function(){var t=this;var r=arguments;A(function(){e.apply(t,r)})}};var L=function(e){var t;var i=0;var a=n.throttleDelay;var s=n.ricTimeout;var o=function(){t=false;i=r.now();e()};var l=d&&s>49?function(){d(o,{timeout:s});if(s!==n.ricTimeout){s=n.ricTimeout}}:x(function(){u(o)},true);return function(e){var n;if(e=e===true){s=33}if(t){return}t=true;n=a-(r.now()-i);if(n<0){n=0}if(e\|\|n<9){l()}else{u(l,n)}}};var T=function(e){var t,i;var n=99;var a=function(){t=null;e()};var s=function(){var e=r.now()-i;if(e<n){u(s,n-e)}else{(d\|\|a)(a)}};return function(){i=r.now();if(!t){t=u(s,n)}}};var _=function(){var i,s;var o,f,d,m;var E;var T=new Set;var _=new Map;var M=/^img$/i;var R=/^iframe$/i;var W="onscroll"in e&&!/glebot/.test(navigator.userAgent);var O=0;var S=0;var F=function(e){O--;if(S){S--}if(e&&e.target){y(e.target,F)}if(!e\|\|O<0\|\|!e.target){O=0;S=0}if(G.length&&O-S<1&&O<3){u(function(){while(G.length&&O-S<1&&O<4){J({target:G.shift()})}})}};var I=function(e){if(E==null){E=w(t.body,"visibility")=="hidden"}return E\|\|!(w(e.parentNode,"visibility")=="hidden"&&w(e,"visibility")=="hidden")};var P=function(e){z(e.target,n.loadedClass);h(e.target,n.loadingClass);h(e.target,n.lazyClass);y(e.target,D)};var B=x(P);var D=function(e){B({target:e.target})};var $=function(e,t){try{e.contentWindow.location.replace(t)}catch(r){e.src=t}};var k=function(e){var t;var r=e[l](n.srcsetAttr);if(t=n.customMedia[e[l]("data-media")\|\|e[l]("media")]){e.setAttribute("media",t)}if(r){e.setAttribute("srcset",r)}};var q=x(function(e,t,r,i,a){var s,o,c,f,m,p;if(!(m=b(e,"lazybeforeunveil",t)).defaultPrevented){if(i){if(r){z(e,n.autosizesClass)}else{e.setAttribute("sizes",i)}}o=e[l](n.srcsetAttr);s=e[l](n.srcAttr);if(a){c=e.parentNode;f=c&&v.test(c.nodeName\|\|"")}p=t.firesLoad\|\|"src"in e&&(o\|\|s\|\|f);m={target:e};if(p){y(e,F,true);clearTimeout(d);d=u(F,2500);z(e,n.loadingClass);y(e,D,true)}if(f){g.call(c.getElementsByTagName("source"),k)}if(o){e.setAttribute("srcset",o)}else if(s&&!f){if(R.test(e.nodeName)){$(e,s)}else{e.src=s}}if(o\|\|f){C(e,{src:s})}}A(function(){if(e._lazyRace){delete e._lazyRace}if(!p\|\|e.complete){if(p){F(m)}else{O--}P(m)}})});var H=function(e){if(n.isPaused)return;var t,r;var a=M.test(e.nodeName);var o=a&&(e[l](n.sizesAttr)\|\|e[l]("sizes"));var c=o=="auto";if(c&&a&&(e.src\|\|e.srcset)&&!e.complete&&!p(e,n.errorClass)){return}t=b(e,"lazyunveilread").detail;if(c){N.updateElem(e,true,e.offsetWidth)}O++;if((r=G.indexOf(e))!=-1){G.splice(r,1)}_.delete
URL: https://keywestlending.com/... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a configuration for the 'lazysizes' library, which is a popular lazy-loading library for images and other media. The script sets various configuration options for the library, such as the class name for lazy-loaded elements, the attribute names for lazy-loaded source and srcset, and some performance-related settings. This behavior is common for lazy-loading implementations and does not indicate any high-risk or malicious activities. The script also includes some event listeners to handle the loading of styles and the overall page load, which is a typical setup for a lazy-loading solution. Overall, this script seems to be a legitimate and benign implementation of a common web performance optimization technique." }
window.nitro_lazySizesConfig=window.nitro_lazySizesConfig\|\|{};window.nitro_lazySizesConfig.lazyClass="nitro-lazy";nitro_lazySizesConfig.srcAttr="nitro-lazy-src";nitro_lazySizesConfig.srcsetAttr="nitro-lazy-srcset";nitro_lazySizesConfig.expand=10;nitro_lazySizesConfig.expFactor=1;nitro_lazySizesConfig.hFac=1;nitro_lazySizesConfig.loadMode=1;nitro_lazySizesConfig.ricTimeout=50;nitro_lazySizesConfig.loadHidden=true;(function(){var t=null;var e=false;var a=false;var i=window.scrollY;var r=Date.now();function n(){window.removeEventListener("scroll",n);window.nitro_lazySizesConfig.expand=300}function o(t){let e=t.timeStamp-r;let a=Math.abs(i-window.scrollY)/e;let n=Math.max(a*200,300);r=t.timeStamp;i=window.scrollY;window.nitro_lazySizesConfig.expand=n}window.addEventListener("scroll",o,{passive:true});window.addEventListener("NitroStylesLoaded",function(){e=true});window.addEventListener("load",function(){a=true});document.addEventListener("lazybeforeunveil",function(t){var e=false;var a=t.target.getAttribute("nitro-lazy-bg");var i=t.target.getAttribute("data-nitro-fragment-id");if(a){let i=t.target.style.backgroundImage.replace("data:image/gif;base64,R0lGODlhAQABAIABAAAAAP///yH5BAEAAAEALAAAAAABAAEAAAICTAEAOw==",a.replace(/$/g,"%28").replace(/$/g,"%29"));if(i===t.target.style.backgroundImage){i="url("+a.replace(/$/g,"%28").replace(/$/g,"%29")+")"}let r=t.target.style.backgroundImage;let n=["initial","inherit"].indexOf(r.toLowerCase())===-1;if(r&&n){i=r+", "+i}t.target.style.backgroundImage=i;e=true}if(t.target.tagName=="VIDEO"){if(t.target.hasAttribute("nitro-lazy-poster")){t.target.setAttribute("poster",t.target.getAttribute("nitro-lazy-poster"))}else if(!t.target.hasAttribute("poster")){t.target.setAttribute("preload","metadata")}e=true}if(i){if(!window.loadNitroFragment(i,"lazy")){t.preventDefault();return false}}if(t.target.classList.contains("av-animated-generic")){t.target.classList.add("avia_start_animation","avia_start_delayed_animation");e=true}if(!e){var r=t.target.tagName.toLowerCase();if(r!=="img"&&r!=="iframe"){t.target.querySelectorAll("img[nitro-l
URL: https://keywestlending.com/... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The provided JavaScript snippet exhibits some moderate-risk behaviors, but also has some contextual factors that suggest it may be a legitimate script. The key points are: - It uses the `PerformanceObserver` API to monitor the Largest Contentful Paint (LCP) metric, which is a common performance monitoring practice. This is a low-risk behavior. - It sets up event listeners for `touchstart` and `mouseover` on the document, which could be used for user interaction tracking. This is a moderate-risk behavior. - It logs various events and data to an object called `NP_PPL`, which could be used for analytics or telemetry purposes. This is a moderate-risk behavior. - It checks for a specific cookie value (`9d63262f59cd9b3378f01392c`) to determine if the logging should be enabled. This suggests the script may have a legitimate purpose. - It includes some checks to ensure the URLs being prefetched are on the same domain and not excluded, which helps mitigate potential risks. Overall, the script appears to be focused on performance monitoring and user interaction tracking, which are common practices. However, the lack of transparency around the data being collected and the use of the `NP_PPL` object warrant further review. A risk score of 4 is assigned due to the moderate-risk behaviors, but the script may be legitimate with proper context." }
(function(){const e=document.createElement("link");if(!(e.relList&&e.relList.supports&&e.relList.supports("prefetch"))){return}let t=document.cookie.includes("9d63262f59cd9b3378f01392c");let n={initNP_PPL:function(){if(window.NP_PPL!==undefined)return;window.NP_PPL={prefetches:[],lcpEvents:[],other:[]}},logPrefetch:function(e,n,r){let o=JSON.parse(window.sessionStorage.getItem("nitro_prefetched_urls"));if(o===null)o={};if(o[e]===undefined){o[e]={type:n,initiator:r};window.sessionStorage.setItem("nitro_prefetched_urls",JSON.stringify(o))}if(!t)return;window.NP_PPL.prefetches.push({url:e,type:n,initiator:r,timestamp:performance.now()})},logLcpEvent:function(e,n=null){if(!t)return;window.NP_PPL.lcpEvents.push({message:e,data:n,timestamp:performance.now()})},logOther:function(e,n=null){if(!t)return;window.NP_PPL.other.push({message:e,data:n,timestamp:performance.now()})}};if(t){n.initNP_PPL()}let r=0;const o=300;let l=".keywestlending.com";let c=new RegExp(l+"$");function a(){return performance.now()-r>o}function u(){let e;let t=performance.now();const r={capture:true,passive:true};document.addEventListener("touchstart",o,r);document.addEventListener("mouseover",l,r);function o(e){t=performance.now();const n=e.target.closest("a");if(!n\|\|!s(n)){return}g(n.href,"TOUCH")}function l(r){n.logOther("mouseoverListener() called",r);if(performance.now()-t<1111){return}const o=r.target.closest("a");if(!o\|\|!s(o)){return}o.addEventListener("mouseout",c,{passive:true});e=setTimeout(function(){n.logOther("mouseoverTimer CALLBACK called",r);g(o.href,"HOVER");e=undefined},85)}function c(t){if(t.relatedTarget&&t.target.closest("a")==t.relatedTarget.closest("a")){return}if(e){clearTimeout(e);e=undefined}}}function f(){if(!PerformanceObserver.supportedEntryTypes.includes("largest-contentful-paint")){n.logLcpEvent("PerformanceObserver does not support LCP events in this browser.");return}let e=new PerformanceObserver(e=>{n.logLcpEvent("LCP_DETECTED",e.getEntries().at(-1).element);C=e.getEntries().at(-1).element});let t=function(e){k=window.requestIdleCallback(O);window.removeEventListener("load",t)};I.forEach(e=>{window.addEventListener(e,P,{once:true})});e.observe({type:"largest-contentful-paint",buffered:true});window.addEventListener("load",t)}function s(e){if(!e){n.logOther("Link Not Prefetchable: empty link element.",e);return false}if(!e.href){n.logOther("Link Not Prefetchable: empty href attribute.",e);return false}let t=e.href;let r=null;try{r=new URL(t)}catch(t){n.logOther("Link Not Prefetchable: "+t,e);return false}let o="."+r.hostname.replace("www.","");if(!["http:","https:"].includes(e.protocol)){n.logOther("Link Not Prefetchable: missing protocol in the URL.",e);return false}if(e.protocol=="http:"&&location.protocol=="https:"){n.logOther("Link Not Prefetchable: URL is HTTP but the current page is HTTPS.",e);return false}if(e.getAttribute("href").charAt(0)=="#"\|\|e.hash&&e.pathname+e.search==location.pathname+location.search){n.logOther("Link Not Prefetchable: URL is the current location but with a hash.",e);return false}if(c.exec(o)===null){n.logOther("Link Not Prefetchable: Different domain.",e);return false}for(i=0;i<x.length;i++){if(t.match(x[i])!==null){n.logOther("Link Not Prefetchable: Excluded URL "+t+".",{link:e,regex:x[i]});return false}}return true}function p(){let e=navigator.connection;if(!e){return false}if(e.saveData){n.logOther("Data Saving Mode detected.");return true}return false}function d(){if(M!==null){return M}M=p();return M}if(!window.requestIdleCallback){window.requestIdleCallback=function(e,t){var t=t\|\|{};var n=1;var r=t.timeout\|\|n;var o=performance.now();return setTimeout(function(){e({get didTimeout(){return t.timeout?false:performance.now()-o-n>r},timeRemaining:function(){return Math.max(0,n+(performance.now()-o))}})},n)}}if(!window.cancelIdleCallback){window.cancelIdleCallback=function(e){clearTimeout(e)}}let h=function(e,t){n.logLcpEvent("MUTATION_DETECTED",e);clearTimeout(R);R=setTimeout(T,500,e)};let m=function(
URL: https://keywestlending.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "FASTER, FAIR & MORE FLEXIBLE MORTGAGE LENDING NEAR YOU", "prominent_button_name": "APPLY NOW", "text_input_field_labels": [ "Loan Purpose", "Select Services", "How will this property be used?", "Estimated Credit Score" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://keywestlending.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://keywestlending.com
URL: https://keywestlending.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "FASTER, FAIR & MORE FLEXIBLE MORTGAGE LENDING NEAR YOU", "prominent_button_name": "APPLY NOW", "text_input_field_labels": [ "Loan Purpose", "Select Services", "How will this property be used?", "Estimated Credit Score" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://keywestlending.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://keywestlending.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://keywestlending.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Verification Steps", "prominent_button_name": "VERIFY", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://keywestlending.com/ Model: Joe Sandbox AI	{ "brands": [ "Keywest Lending" ] }
	{ "brands": [ "Keywest Lending" ] }
URL: https://keywestlending.com/ Model: Joe Sandbox AI	{ "brands": [ "Keywest Lending" ] }
	{ "brands": [ "Keywest Lending" ] }
URL: https://keywestlending.com/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://keywestlending.com/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://keywestlending.com/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 2 18:43:28 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.990463375642503
Encrypted:	false
SSDEEP:
MD5:	2E4CFBFC9FF519EFA9094C6AF12F11BC
SHA1:	08D2567E5D1E731E7C450555C3E84F1E4DA7B329
SHA-256:	5E2277506120530A3145345A04FF9C1E52CE9C4F5659BC57E57C9ECA7768E7BB
SHA-512:	0F4AEBA0F6EC2D4D0948AB12B46823149748D59E02B5154D95F6B81EE5B2943501FD2DDC76DBD6F1976F1B0DA12B54D3777E33EA50A8D83C421D21F09ADD589A
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........N]......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I"Zd.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V"Zm.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V"Zm.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V"Zm............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V"Zo............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........2..k.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 2 18:43:28 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.006128292100634
Encrypted:	false
SSDEEP:
MD5:	DB58F6377EBB181DEFB618E978A6CBA9
SHA1:	62942D4C5B91F1149ADC2B8D08313C6CBE197BE4
SHA-256:	261EBDC39CF59F93A26E271B82EFCE1957F876B0AF3810C42B2F42620E71AD44
SHA-512:	EEE278894626697A0EE7E651004FB54BA8B5DF9EFB2B071CBDEC363C51E247EA0709609E8AD283C846FB04DC4C821D048D92AA9B5F093AD95B70476EF879D58B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......y.N]......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I"Zd.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V"Zm.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V"Zm.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V"Zm............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V"Zo............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........2..k.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.016721789337651
Encrypted:	false
SSDEEP:
MD5:	B711CF2D780068F1B02C8B3BB75C48C1
SHA1:	F6965C89FF286AF100A86CF955A3F12DFB8EAFCC
SHA-256:	73C18ED20A05C88F91864CB4A7B94C5BE32B0E6BAFF079B0A813BE7F40367DE7
SHA-512:	F42D76DC1F2AA8BBA7366CBC028B77C9F105125DD27598E3DFEB636C69A989DE69959E207464E29587CEE888B9060B57F4692DE38A6EB62F53EA7D274F7D2BF2
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I"Zd.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V"Zm.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V"Zm.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V"Zm............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........2..k.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 2 18:43:28 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.000604912027974
Encrypted:	false
SSDEEP:
MD5:	999B96C6E7D84F61234DD9CFBAA7118B
SHA1:	176BC716AFE0C1E5DFED196EFBA66730D977014C
SHA-256:	FFAA75F3B251B67DA40D28614D694B82BD56859858B148A53F2E8EA48F76B262
SHA-512:	C5F27CF667A726499C6B8AC58B79A54C23DBF9B855532B99C4DCE71AC2AF5141B18B9CC4B984A7D5C3FCC795A0646D3249C922B8FFC1A2A5BE543D9DD8B748E2
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....iVi.N]......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I"Zd.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V"Zm.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V"Zm.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V"Zm............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V"Zo............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........2..k.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 2 18:43:28 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.993965260376326
Encrypted:	false
SSDEEP:
MD5:	832ED8A0D74FA8688C719286C8318647
SHA1:	CF2AFE8D263F3FD3405234AEBBC9DBAE690ED736
SHA-256:	A9E7BB19C0720CF16A4A4CC4DB5F81D4BECCFEA57D5ECEBAC4D389D611E6EBFA
SHA-512:	D9DA808ADF99A1746F24362B3F3173BCA94608B399B246F6BAA749D959DF2CB01A6A1DB3B1CEEC6CAF49812F0E3650CDC4535B82FE8ECB5E4C1BEDC9DD6B1738
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....g..N]......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I"Zd.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V"Zm.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V"Zm.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V"Zm............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V"Zo............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........2..k.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 2 18:43:28 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.005595417877058
Encrypted:	false
SSDEEP:
MD5:	B4933AC2A5EBA325B45CD15718AF9E43
SHA1:	4F090B834799DDDF9A4E674EDF46BAA8E0D6330B
SHA-256:	22DAAA1EF42D595CBF557A864C8D2E5CE919A1191809D89F3561606CE6EEB28D
SHA-512:	EEFC4DFF1D9CCC64765AD3767BBDC76E44683F138780716202F676A1D9D6D2A46C6AE77A98AFF5DE762A93B32805ED7401384AE04D353EB0CA3DA9E5156F200C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.N]......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I"Zd.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V"Zm.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V"Zm.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V"Zm............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V"Zo............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........2..k.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Static File Info

⊘No static file info

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://keywestlending.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Static File Info

Windows Analysis Report
http://keywestlending.com