Edit tour

Windows Analysis Report
https://track2.mccarthysearch.com/9155296/c?p=UJEwZLRSuPVlnD1ICTWZusB5H46ZFxhQFeZmgv_N89FzkqdhuHSGoPyB5qZfahmny00oVnRJ_XGR4M89Ovy-j3JZN_nz1Nb-BfHfDXVFwrd4A8njKtxWHgVV9KpuZ3ad6Xn31h13Ok4dSqgAUkhmVH1KUMKOlrKi5AYGmafMXkrBRxU_B4vy7NXVbEVJ970TwM25LbuS_B0xuuC5g8ehQDyYNyEV1WCghuhx_ZKmrGeOOXDf8HkQ-KOwv_tecp

Overview

General Information

Sample URL:	https://track2.mccarthysearch.com/9155296/c?p=UJEwZLRSuPVlnD1ICTWZusB5H46ZFxhQFeZmgv_N89FzkqdhuHSGoPyB5qZfahmny00oVnRJ_XGR4M89Ovy-j3JZN_nz1Nb-BfHfDXVFwrd4A8njKtxWHgVV9KpuZ3ad6Xn31h13Ok4dSqgAUkhmVH1KUM
Analysis ID:	1583926

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious Javascript

HTML page contains obfuscated javascript

Detected non-DNS traffic on DNS port

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6352 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7044 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1968,i,2718016349913209263,3236409034383620178,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6708 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://track2.mccarthysearch.com/9155296/c?p=UJEwZLRSuPVlnD1ICTWZusB5H46ZFxhQFeZmgv_N89FzkqdhuHSGoPyB5qZfahmny00oVnRJ_XGR4M89Ovy-j3JZN_nz1Nb-BfHfDXVFwrd4A8njKtxWHgVV9KpuZ3ad6Xn31h13Ok4dSqgAUkhmVH1KUMKOlrKi5AYGmafMXkrBRxU_B4vy7NXVbEVJ970TwM25LbuS_B0xuuC5g8ehQDyYNyEV1WCghuhx_ZKmrGeOOXDf8HkQ-KOwv_tecp8TMdskXzay5lvoS31gB-nWxsjPaZ8f84KWvabQB4eF73ffpyNcTpJues_4IHHPjEKJ9ritMRTaHbFdQGNT_n13X_E7no0nMmaegQjwo4kKGu6oR02iG2c_6ucy3I6d8vsNl324Pjhx3M20dDmfZAju1roW9lGyO1LfgEnp1iSAFpx4kA7frEmKGzJYNX_cZrwVBoH8vvIYauXGnXBrZacRhuZGGbOjW2HHr9KF-0q7xjdgG2hxjWZ2H9zjubJGDnUjHRfiIr_-0bem1pLFqziEmy0450LGuXV23cQ6GD8yuK9tuRwMIF0sbkhVqONC0e6TsXlkUuTRAVWBbLlRPcygJ-CbukwvFtAxobVQ8-PpIuGj97DYFnmbfbJrrZDtH57TpdP4AxtW5k74BKSXvb1B6JX0p7Oyr1kXxLs_OrNPdAdrf8gXR35D9W7WeQ2zhPEqP0Mv5sJx4DlYh6Y4FqgPfCRFcDcL7Cy3HSlJ0XYfv-ae4o-hdX_0rJPqEG_-Bn2yj60YPDYpE8KDIgC_ZMwlNLdK4pAK6vSt4NWDncuV5y7QDqt97ribjd4U3AOvQTKW9r_eMky9-IC9hkSPrg2S0ZBgA9ITW3AQ3v-lq94cAwt1v1RLaFgsy67l_7lni1gYsZaQdOsFJsDpCFYaZsTMcVz2QAnQ_2UidhzlUekPl5xh9LNe9o77rO1FolZslooaXxCf2U2RZmvUA6NCNiGZ8KSsoUYTnqAHenvBJVJwMWd66yD2O60rC3Ic2qOQ1KOF9AB6-iFTvQFxtSTjS2hFwi7N97LeQtVYKhdzZuq2SasgJg0JPnZiFv_FSbgmiodqx9rz_lWIqWQNoQVht-oO2BfFxSF_aedAmm2MuQAL7z8UjBf_deiKwQyfKOyA6ZkAJ14F9xwhNm9F7B4PBgDtocqJQBjw5Cf1jCBSAs3nSYP2_nzofJuQSXd-YD9PIzkkmJw7Nqux7IgJ6p1z2Hsf6i3zShVdZY3g2mmA1xR1FV1LoSYwcRBqZt3pv0UDjuqCEoiqKDuyT0rkhqTRLo29uuM588Lna16PFSgSLoLUhnJ2rx8NLQQc5TqrsGjlN-ulCwTEyA0C9Epz9mxq14yDjw==" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected suspicious Javascript

Source: 0.0.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://mccarthysearch.com/job?payload=NJfBeBSc1Jy... This script exhibits high-risk behaviors, including the use of obfuscated URLs and redirecting the user to a suspicious domain (mccarthysearch.com). The obfuscated URL payload suggests the potential for data exfiltration or other malicious activities. Overall, this script demonstrates a high risk of malicious intent and should be further investigated.
Source: 0.14.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://www.google.com/search?q=t+you+are+human+by... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. While the script may have a legitimate purpose, such as analytics or tracking, the aggressive and opaque nature of its implementation raises significant security concerns. Further investigation is warranted to determine the true intent and potential impact of this script.

HTML page contains obfuscated javascript

Source: https://www.linkedin.com/jobs/view/4113208945?trk=li_appcast_Global_careers_jobsgtm_b0587650-1732-4923-875c-4ab8eda8e3f7_job-dist&utm_medium=jobdist&mcid=6810586802156523521&utm_source=appcast&ePP=CwEAAAGUI9YZDbXkdUPTqq4WOu9Ki8FR2B4fKA2pldNTPhCR0csT0apDGVx3p70IABnptZ4WcGgmEyfHH7TZngnaGifQVNs4iHurzP0Xpg&ccuid=58928025643	HTTP Parser: var _0x26bb58=_0x3a5d;function _0x2511(){var _0x2338e3=['__proto__','http:','location','substr','qA
Source: https://www.linkedin.com/jobs/view/4113208945?trk=li_appcast_Global_careers_jobsgtm_b0587650-1732-4923-875c-4ab8eda8e3f7_job-dist&utm_medium=jobdist&mcid=6810586802156523521&utm_source=appcast&ePP=CwEAAAGUI9YZDbXkdUPTqq4WOu9Ki8FR2B4fKA2pldNTPhCR0csT0apDGVx3p70IABnptZ4WcGgmEyfHH7TZngnaGifQVNs4iHurzP0Xpg&ccuid=58928025643	HTTP Parser: var _0x26bb58=_0x3a5d;function _0x2511(){var _0x2338e3=['__proto__','http:','location','substr','qA

Source: https://www.google.com/search?q=t+you+are+human+by+completing+the&sourceid=chrome&ie=UTF-8

HTTP Parser: Total embedded image size: 15542

Source: https://mccarthysearch.com/job?payload=NJfBeBSc1JyEGOKT2ICyEt9ELz2JQ_04W45jLzeSP6Toh5Jv2gyOkOQ0F9fpwLkinxVtwlymsvxxMF9RhL27sHbCKMDE4O6_tB2mtt93K5dFYlaNWbeeODbw-amW4X1_CX-c4VClHASkypsi10A7moRAGUI9fZ9Am11F4gEMVawMT8RSUCE7X5iE3vWkqFqRImpEWlJAjChZbceMW8AKoCEWU0RQbInIfZ9y6i9FJpDRzoQFYg6UoXhi14XZBeBrekAgED1NFUZRa2RobNfHlVWXZPfEnVMnuykHk-G-m7r32sZflocH0dbCOxyh7kqk1RgASL1Bp98cHrZBs3GXrtV4dnUDVAJ4OGjVjA0gk5EgCDZDitfuwRrysfg1-2zOi3dkF4kJyOwsePzPqOW5s6bW2Eo8r8Ff0jL_D7rwJQFQJzo-j-5nYxQbthJvhP7fXbpRQ0weC2DoABCBc64YtMaKrGPHwoGtf8LjAnzh3hipjeZ8h8wzJG0nZUoybZUXFBHp5xrs6_dVDFqNgEPXqBUjujENywMA5vRgiuEp6brKAA-mkIQKXKFqqNhNliCdYf-1BcscmTwY_huCAyraOxXulv-_pivbuCvIx_zRCNSeJakek98GqMWIw2Rva_qjRnDBIamTx8Pidt9M6CTISkUg4ONNAnB097804yciOOG-eP-_5SSUjlqT9OyfI_XHxqVu9wH4ZyfautXzDPuyQDlLsNZ4uA0tGz3-l0nI8hd7GyLUCwdG3NP4VhkRkJSabOyKBouHOECa35erYWbhzv_6GKlDibu1TctBUfDgsiNLbeHRlkRrWC_XkwBVyzd5wr-svZ1YcKTgHbw082VYWA.oqub3cwoiXeLwNytJ5ZfEw

Source: https://mccarthysearch.com/job?payload=NJfBeBSc1JyEGOKT2ICyEt9ELz2JQ_04W45jLzeSP6Toh5Jv2gyOkOQ0F9fpwLkinxVtwlymsvxxMF9RhL27sHbCKMDE4O6_tB2mtt93K5dFYlaNWbeeODbw-amW4X1_CX-c4VClHASkypsi10A7moRAGUI9fZ9Am11F4gEMVawMT8RSUCE7X5iE3vWkqFqRImpEWlJAjChZbceMW8AKoCEWU0RQbInIfZ9y6i9FJpDRzoQFYg6UoXhi14XZBeBrekAgED1NFUZRa2RobNfHlVWXZPfEnVMnuykHk-G-m7r32sZflocH0dbCOxyh7kqk1RgASL1Bp98cHrZBs3GXrtV4dnUDVAJ4OGjVjA0gk5EgCDZDitfuwRrysfg1-2zOi3dkF4kJyOwsePzPqOW5s6bW2Eo8r8Ff0jL_D7rwJQFQJzo-j-5nYxQbthJvhP7fXbpRQ0weC2DoABCBc64YtMaKrGPHwoGtf8LjAnzh3hipjeZ8h8wzJG0nZUoybZUXFBHp5xrs6_dVDFqNgEPXqBUjujENywMA5vRgiuEp6brKAA-mkIQKXKFqqNhNliCdYf-1BcscmTwY_huCAyraOxXulv-_pivbuCvIx_zRCNSeJakek98GqMWIw2Rva_qjRnDBIamTx8Pidt9M6CTISkUg4ONNAnB097804yciOOG-eP-_5SSUjlqT9OyfI_XHxqVu9wH4ZyfautXzDPuyQDlLsNZ4uA0tGz3-l0nI8hd7GyLUCwdG3NP4VhkRkJSabOyKBouHOECa35erYWbhzv_6GKlDibu1TctBUfDgsiNLbeHRlkRrWC_XkwBVyzd5wr-svZ1YcKTgHbw082VYWA.oqub3cwoiXeLwNytJ5ZfEw	HTTP Parser: No favicon
Source: https://www.google.com/search?q=t+you+are+human+by+completing+the&sourceid=chrome&ie=UTF-8	HTTP Parser: No favicon
Source: https://www.google.com/search?q=t+you+are+human+by+completing+the&sourceid=chrome&ie=UTF-8	HTTP Parser: No favicon
Source: https://www.google.com/search?q=t+you+are+human+by+completing+the&sourceid=chrome&ie=UTF-8	HTTP Parser: No favicon
Source: https://www.google.com/search?q=t+you+are+human+by+completing+the&sourceid=chrome&ie=UTF-8	HTTP Parser: No favicon
Source: https://www.google.com/search?q=t+you+are+human+by+completing+the&sourceid=chrome&ie=UTF-8	HTTP Parser: No favicon
Source: https://www.google.com/search?q=t+you+are+human+by+completing+the&sourceid=chrome&ie=UTF-8	HTTP Parser: No favicon
Source: https://mccarthysearch.com/job?payload=NJfBeBSc1JyEGOKT2ICyEt9ELz2JQ_04W45jLzeSP6Toh5Jv2gyOkOQ0F9fpwLkinxVtwlymsvxxMF9RhL27sHbCKMDE4O6_tB2mtt93K5dFYlaNWbeeODbw-amW4X1_CX-c4VClHASkypsi10A7moRAGUI9fZ9Am11F4gEMVawMT8RSUCE7X5iE3vWkqFqRImpEWlJAjChZbceMW8AKoCEWU0RQbInIfZ9y6i9FJpDRzoQFYg6UoXhi14XZBeBrekAgED1NFUZRa2RobNfHlVWXZPfEnVMnuykHk-G-m7r32sZflocH0dbCOxyh7kqk1RgASL1Bp98cHrZBs3GXrtV4dnUDVAJ4OGjVjA0gk5EgCDZDitfuwRrysfg1-2zOi3dkF4kJyOwsePzPqOW5s6bW2Eo8r8Ff0jL_D7rwJQFQJzo-j-5nYxQbthJvhP7fXbpRQ0weC2DoABCBc64YtMaKrGPHwoGtf8LjAnzh3hipjeZ8h8wzJG0nZUoybZUXFBHp5xrs6_dVDFqNgEPXqBUjujENywMA5vRgiuEp6brKAA-mkIQKXKFqqNhNliCdYf-1BcscmTwY_huCAyraOxXulv-_pivbuCvIx_zRCNSeJakek98GqMWIw2Rva_qjRnDBIamTx8Pidt9M6CTISkUg4ONNAnB097804yciOOG-eP-_5SSUjlqT9OyfI_XHxqVu9wH4ZyfautXzDPuyQDlLsNZ4uA0tGz3-l0nI8hd7GyLUCwdG3NP4VhkRkJSabOyKBouHOECa35erYWbhzv_6GKlDibu1TctBUfDgsiNLbeHRlkRrWC_XkwBVyzd5wr-svZ1YcKTgHbw082VYWA.oqub3cwoiXeLwNytJ5ZfEw	HTTP Parser: No favicon
Source: https://www.google.com/search?q=t+you+are+human+by+completing+the&sourceid=chrome&ie=UTF-8	HTTP Parser: No favicon
Source: https://mccarthysearch.com/job?payload=NJfBeBSc1JyEGOKT2ICyEt9ELz2JQ_04W45jLzeSP6Toh5Jv2gyOkOQ0F9fpwLkinxVtwlymsvxxMF9RhL27sHbCKMDE4O6_tB2mtt93K5dFYlaNWbeeODbw-amW4X1_CX-c4VClHASkypsi10A7moRAGUI9fZ9Am11F4gEMVawMT8RSUCE7X5iE3vWkqFqRImpEWlJAjChZbceMW8AKoCEWU0RQbInIfZ9y6i9FJpDRzoQFYg6UoXhi14XZBeBrekAgED1NFUZRa2RobNfHlVWXZPfEnVMnuykHk-G-m7r32sZflocH0dbCOxyh7kqk1RgASL1Bp98cHrZBs3GXrtV4dnUDVAJ4OGjVjA0gk5EgCDZDitfuwRrysfg1-2zOi3dkF4kJyOwsePzPqOW5s6bW2Eo8r8Ff0jL_D7rwJQFQJzo-j-5nYxQbthJvhP7fXbpRQ0weC2DoABCBc64YtMaKrGPHwoGtf8LjAnzh3hipjeZ8h8wzJG0nZUoybZUXFBHp5xrs6_dVDFqNgEPXqBUjujENywMA5vRgiuEp6brKAA-mkIQKXKFqqNhNliCdYf-1BcscmTwY_huCAyraOxXulv-_pivbuCvIx_zRCNSeJakek98GqMWIw2Rva_qjRnDBIamTx8Pidt9M6CTISkUg4ONNAnB097804yciOOG-eP-_5SSUjlqT9OyfI_XHxqVu9wH4ZyfautXzDPuyQDlLsNZ4uA0tGz3-l0nI8hd7GyLUCwdG3NP4VhkRkJSabOyKBouHOECa35erYWbhzv_6GKlDibu1TctBUfDgsiNLbeHRlkRrWC_XkwBVyzd5wr-svZ1YcKTgHbw082VYWA.oqub3cwoiXeLwNytJ5ZfEw	HTTP Parser: No favicon
Source: https://mccarthysearch.com/job?payload=NJfBeBSc1JyEGOKT2ICyEt9ELz2JQ_04W45jLzeSP6Toh5Jv2gyOkOQ0F9fpwLkinxVtwlymsvxxMF9RhL27sHbCKMDE4O6_tB2mtt93K5dFYlaNWbeeODbw-amW4X1_CX-c4VClHASkypsi10A7moRAGUI9fZ9Am11F4gEMVawMT8RSUCE7X5iE3vWkqFqRImpEWlJAjChZbceMW8AKoCEWU0RQbInIfZ9y6i9FJpDRzoQFYg6UoXhi14XZBeBrekAgED1NFUZRa2RobNfHlVWXZPfEnVMnuykHk-G-m7r32sZflocH0dbCOxyh7kqk1RgASL1Bp98cHrZBs3GXrtV4dnUDVAJ4OGjVjA0gk5EgCDZDitfuwRrysfg1-2zOi3dkF4kJyOwsePzPqOW5s6bW2Eo8r8Ff0jL_D7rwJQFQJzo-j-5nYxQbthJvhP7fXbpRQ0weC2DoABCBc64YtMaKrGPHwoGtf8LjAnzh3hipjeZ8h8wzJG0nZUoybZUXFBHp5xrs6_dVDFqNgEPXqBUjujENywMA5vRgiuEp6brKAA-mkIQKXKFqqNhNliCdYf-1BcscmTwY_huCAyraOxXulv-_pivbuCvIx_zRCNSeJakek98GqMWIw2Rva_qjRnDBIamTx8Pidt9M6CTISkUg4ONNAnB097804yciOOG-eP-_5SSUjlqT9OyfI_XHxqVu9wH4ZyfautXzDPuyQDlLsNZ4uA0tGz3-l0nI8hd7GyLUCwdG3NP4VhkRkJSabOyKBouHOECa35erYWbhzv_6GKlDibu1TctBUfDgsiNLbeHRlkRrWC_XkwBVyzd5wr-svZ1YcKTgHbw082VYWA.oqub3cwoiXeLwNytJ5ZfEw	HTTP Parser: No favicon
Source: https://mccarthysearch.com/job?payload=NJfBeBSc1JyEGOKT2ICyEt9ELz2JQ_04W45jLzeSP6Toh5Jv2gyOkOQ0F9fpwLkinxVtwlymsvxxMF9RhL27sHbCKMDE4O6_tB2mtt93K5dFYlaNWbeeODbw-amW4X1_CX-c4VClHASkypsi10A7moRAGUI9fZ9Am11F4gEMVawMT8RSUCE7X5iE3vWkqFqRImpEWlJAjChZbceMW8AKoCEWU0RQbInIfZ9y6i9FJpDRzoQFYg6UoXhi14XZBeBrekAgED1NFUZRa2RobNfHlVWXZPfEnVMnuykHk-G-m7r32sZflocH0dbCOxyh7kqk1RgASL1Bp98cHrZBs3GXrtV4dnUDVAJ4OGjVjA0gk5EgCDZDitfuwRrysfg1-2zOi3dkF4kJyOwsePzPqOW5s6bW2Eo8r8Ff0jL_D7rwJQFQJzo-j-5nYxQbthJvhP7fXbpRQ0weC2DoABCBc64YtMaKrGPHwoGtf8LjAnzh3hipjeZ8h8wzJG0nZUoybZUXFBHp5xrs6_dVDFqNgEPXqBUjujENywMA5vRgiuEp6brKAA-mkIQKXKFqqNhNliCdYf-1BcscmTwY_huCAyraOxXulv-_pivbuCvIx_zRCNSeJakek98GqMWIw2Rva_qjRnDBIamTx8Pidt9M6CTISkUg4ONNAnB097804yciOOG-eP-_5SSUjlqT9OyfI_XHxqVu9wH4ZyfautXzDPuyQDlLsNZ4uA0tGz3-l0nI8hd7GyLUCwdG3NP4VhkRkJSabOyKBouHOECa35erYWbhzv_6GKlDibu1TctBUfDgsiNLbeHRlkRrWC_XkwBVyzd5wr-svZ1YcKTgHbw082VYWA.oqub3cwoiXeLwNytJ5ZfEw	HTTP Parser: No favicon
Source: https://mccarthysearch.com/job?payload=NJfBeBSc1JyEGOKT2ICyEt9ELz2JQ_04W45jLzeSP6Toh5Jv2gyOkOQ0F9fpwLkinxVtwlymsvxxMF9RhL27sHbCKMDE4O6_tB2mtt93K5dFYlaNWbeeODbw-amW4X1_CX-c4VClHASkypsi10A7moRAGUI9fZ9Am11F4gEMVawMT8RSUCE7X5iE3vWkqFqRImpEWlJAjChZbceMW8AKoCEWU0RQbInIfZ9y6i9FJpDRzoQFYg6UoXhi14XZBeBrekAgED1NFUZRa2RobNfHlVWXZPfEnVMnuykHk-G-m7r32sZflocH0dbCOxyh7kqk1RgASL1Bp98cHrZBs3GXrtV4dnUDVAJ4OGjVjA0gk5EgCDZDitfuwRrysfg1-2zOi3dkF4kJyOwsePzPqOW5s6bW2Eo8r8Ff0jL_D7rwJQFQJzo-j-5nYxQbthJvhP7fXbpRQ0weC2DoABCBc64YtMaKrGPHwoGtf8LjAnzh3hipjeZ8h8wzJG0nZUoybZUXFBHp5xrs6_dVDFqNgEPXqBUjujENywMA5vRgiuEp6brKAA-mkIQKXKFqqNhNliCdYf-1BcscmTwY_huCAyraOxXulv-_pivbuCvIx_zRCNSeJakek98GqMWIw2Rva_qjRnDBIamTx8Pidt9M6CTISkUg4ONNAnB097804yciOOG-eP-_5SSUjlqT9OyfI_XHxqVu9wH4ZyfautXzDPuyQDlLsNZ4uA0tGz3-l0nI8hd7GyLUCwdG3NP4VhkRkJSabOyKBouHOECa35erYWbhzv_6GKlDibu1TctBUfDgsiNLbeHRlkRrWC_XkwBVyzd5wr-svZ1YcKTgHbw082VYWA.oqub3cwoiXeLwNytJ5ZfEw	HTTP Parser: No favicon
Source: https://www.whatjobs.com/coopob__cpl___2591_2909134__1007?utm_source=1007&utm_medium=feed&keyword=Regional-Information-Security&location=Auburn-Hills&geoID=35330&sp=smtp_com	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49878 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.16:49850 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49850 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49850 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49850 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49850 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49850 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49850 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49850 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49850 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49850 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: track2.mccarthysearch.com
Source: global traffic	DNS traffic detected: DNS query: mccarthysearch.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: dns-tunnel-check.googlezip.net
Source: global traffic	DNS traffic detected: DNS query: tunnel.googlezip.net
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: i.ytimg.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: static.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: ogs.google.com
Source: global traffic	DNS traffic detected: DNS query: assets.mccarthysearch.com
Source: global traffic	DNS traffic detected: DNS query: ep1.adtrafficquality.google
Source: global traffic	DNS traffic detected: DNS query: ep2.adtrafficquality.google
Source: global traffic	DNS traffic detected: DNS query: www.whatjobs.com
Source: global traffic	DNS traffic detected: DNS query: static.whatjobs.com
Source: global traffic	DNS traffic detected: DNS query: click.appcast.io
Source: global traffic	DNS traffic detected: DNS query: s.go-mpulse.net
Source: global traffic	DNS traffic detected: DNS query: www.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: static.licdn.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1968,i,2718016349913209263,3236409034383620178,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://track2.mccarthysearch.com/9155296/c?p=UJEwZLRSuPVlnD1ICTWZusB5H46ZFxhQFeZmgv_N89FzkqdhuHSGoPyB5qZfahmny00oVnRJ_XGR4M89Ovy-j3JZN_nz1Nb-BfHfDXVFwrd4A8njKtxWHgVV9KpuZ3ad6Xn31h13Ok4dSqgAUkhmVH1KUMKOlrKi5AYGmafMXkrBRxU_B4vy7NXVbEVJ970TwM25LbuS_B0xuuC5g8ehQDyYNyEV1WCghuhx_ZKmrGeOOXDf8HkQ-KOwv_tecp8TMdskXzay5lvoS31gB-nWxsjPaZ8f84KWvabQB4eF73ffpyNcTpJues_4IHHPjEKJ9ritMRTaHbFdQGNT_n13X_E7no0nMmaegQjwo4kKGu6oR02iG2c_6ucy3I6d8vsNl324Pjhx3M20dDmfZAju1roW9lGyO1LfgEnp1iSAFpx4kA7frEmKGzJYNX_cZrwVBoH8vvIYauXGnXBrZacRhuZGGbOjW2HHr9KF-0q7xjdgG2hxjWZ2H9zjubJGDnUjHRfiIr_-0bem1pLFqziEmy0450LGuXV23cQ6GD8yuK9tuRwMIF0sbkhVqONC0e6TsXlkUuTRAVWBbLlRPcygJ-CbukwvFtAxobVQ8-PpIuGj97DYFnmbfbJrrZDtH57TpdP4AxtW5k74BKSXvb1B6JX0p7Oyr1kXxLs_OrNPdAdrf8gXR35D9W7WeQ2zhPEqP0Mv5sJx4DlYh6Y4FqgPfCRFcDcL7Cy3HSlJ0XYfv-ae4o-hdX_0rJPqEG_-Bn2yj60YPDYpE8KDIgC_ZMwlNLdK4pAK6vSt4NWDncuV5y7QDqt97ribjd4U3AOvQTKW9r_eMky9-IC9hkSPrg2S0ZBgA9ITW3AQ3v-lq94cAwt1v1RLaFgsy67l_7lni1gYsZaQdOsFJsDpCFYaZsTMcVz2QAnQ_2UidhzlUekPl5xh9LNe9o77rO1FolZslooaXxCf2U2RZmvUA6NCNiGZ8KSsoUYTnqAHenvBJVJwMWd66yD2O60rC3Ic2qOQ1KOF9AB6-iFTvQFxtSTjS2hFwi7N97LeQtVYKhdzZuq2SasgJg0JPnZiFv_FSbgmiodqx9rz_lWIqWQNoQVht-oO2BfFxSF_aedAmm2MuQAL7z8UjBf_deiKwQyfKOyA6ZkAJ14F9xwhNm9F7B4PBgDtocqJQBjw5Cf1jCBSAs3nSYP2_nzofJuQSXd-YD9PIzkkmJw7Nqux7IgJ6p1z2Hsf6i3zShVdZY3g2mmA1xR1FV1LoSYwcRBqZt3pv0UDjuqCEoiqKDuyT0rkhqTRLo29uuM588Lna16PFSgSLoLUhnJ2rx8NLQQc5TqrsGjlN-ulCwTEyA0C9Epz9mxq14yDjw=="
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1968,i,2718016349913209263,3236409034383620178,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Name	IP	Active	Malicious	Reputation
ep1.adtrafficquality.google	142.250.185.226	true	false	high
i.ytimg.com	172.217.18.22	true	false	high
ep2.adtrafficquality.google	142.250.186.161	true	false	high
assets.mccarthysearch.com	18.173.205.38	true	false	unknown
static.doubleclick.net	172.217.18.6	true	false	high
youtube-ui.l.google.com	216.58.206.78	true	false	high
c0-smtp-co-public-a0ff7d03b229680a.elb.ca-central-1.amazonaws.com	15.222.112.179	true	false	unknown
mccarthysearch.com	52.20.100.110	true	true	unknown
play.google.com	142.250.186.110	true	false	high
googleads.g.doubleclick.net	142.250.185.162	true	false	high
www3.l.google.com	142.250.186.46	true	false	high
dns-tunnel-check.googlezip.net	216.239.34.159	true	false	high
tunnel.googlezip.net	216.239.34.157	true	false	high
challenges.cloudflare.com	104.18.95.41	true	false	high
www.google.com	142.250.186.68	true	false	high
cs1404.wpc.epsiloncdn.net	152.199.21.118	true	false	unknown
static.whatjobs.com	104.22.26.151	true	false	unknown
www.whatjobs.com	104.22.27.151	true	false	unknown
static.licdn.com	unknown	unknown	false	high
s.go-mpulse.net	unknown	unknown	false	high
www.linkedin.com	unknown	unknown	false	high
ogs.google.com	unknown	unknown	false	high
click.appcast.io	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
track2.mccarthysearch.com	unknown	unknown	false	unknown

Name	Malicious	Reputation
https://mccarthysearch.com/job?payload=NJfBeBSc1JyEGOKT2ICyEt9ELz2JQ_04W45jLzeSP6Toh5Jv2gyOkOQ0F9fpwLkinxVtwlymsvxxMF9RhL27sHbCKMDE4O6_tB2mtt93K5dFYlaNWbeeODbw-amW4X1_CX-c4VClHASkypsi10A7moRAGUI9fZ9Am11F4gEMVawMT8RSUCE7X5iE3vWkqFqRImpEWlJAjChZbceMW8AKoCEWU0RQbInIfZ9y6i9FJpDRzoQFYg6UoXhi14XZBeBrekAgED1NFUZRa2RobNfHlVWXZPfEnVMnuykHk-G-m7r32sZflocH0dbCOxyh7kqk1RgASL1Bp98cHrZBs3GXrtV4dnUDVAJ4OGjVjA0gk5EgCDZDitfuwRrysfg1-2zOi3dkF4kJyOwsePzPqOW5s6bW2Eo8r8Ff0jL_D7rwJQFQJzo-j-5nYxQbthJvhP7fXbpRQ0weC2DoABCBc64YtMaKrGPHwoGtf8LjAnzh3hipjeZ8h8wzJG0nZUoybZUXFBHp5xrs6_dVDFqNgEPXqBUjujENywMA5vRgiuEp6brKAA-mkIQKXKFqqNhNliCdYf-1BcscmTwY_huCAyraOxXulv-_pivbuCvIx_zRCNSeJakek98GqMWIw2Rva_qjRnDBIamTx8Pidt9M6CTISkUg4ONNAnB097804yciOOG-eP-_5SSUjlqT9OyfI_XHxqVu9wH4ZyfautXzDPuyQDlLsNZ4uA0tGz3-l0nI8hd7GyLUCwdG3NP4VhkRkJSabOyKBouHOECa35erYWbhzv_6GKlDibu1TctBUfDgsiNLbeHRlkRrWC_XkwBVyzd5wr-svZ1YcKTgHbw082VYWA.oqub3cwoiXeLwNytJ5ZfEw	false	unknown
https://www.google.com/search?q=t+you+are+human+by+completing+the&sourceid=chrome&ie=UTF-8	false	unknown
https://www.whatjobs.com/coopob__cpl___2591_2909134__1007?utm_source=1007&utm_medium=feed&keyword=Regional-Information-Security&location=Auburn-Hills&geoID=35330&sp=smtp_com	false	unknown
https://www.linkedin.com/	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
172.217.16.134	unknown	United States	15169	GOOGLEUS	false
142.250.186.67	unknown	United States	15169	GOOGLEUS	false
152.199.21.118	cs1404.wpc.epsiloncdn.net	United States	15133	EDGECASTUS	false
142.250.186.150	unknown	United States	15169	GOOGLEUS	false
142.250.185.226	ep1.adtrafficquality.google	United States	15169	GOOGLEUS	false
142.250.185.225	unknown	United States	15169	GOOGLEUS	false
3.208.181.175	unknown	United States	14618	AMAZON-AESUS	false
52.20.100.110	mccarthysearch.com	United States	14618	AMAZON-AESUS	true
172.64.146.215	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.186.110	play.google.com	United States	15169	GOOGLEUS	false
142.250.184.227	unknown	United States	15169	GOOGLEUS	false
142.250.184.228	unknown	United States	15169	GOOGLEUS	false
142.250.184.195	unknown	United States	15169	GOOGLEUS	false
142.250.186.78	unknown	United States	15169	GOOGLEUS	false
142.250.186.34	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.184.194	unknown	United States	15169	GOOGLEUS	false
95.101.54.240	unknown	European Union	34164	AKAMAI-LONGB	false
172.217.18.4	unknown	United States	15169	GOOGLEUS	false
74.125.71.84	unknown	United States	15169	GOOGLEUS	false
172.217.18.3	unknown	United States	15169	GOOGLEUS	false
172.217.18.6	static.doubleclick.net	United States	15169	GOOGLEUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.67.38.241	unknown	United States	13335	CLOUDFLARENETUS	false
172.217.18.2	unknown	United States	15169	GOOGLEUS	false
13.107.42.14	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.106	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.22.27.151	www.whatjobs.com	United States	13335	CLOUDFLARENETUS	false
104.22.26.151	static.whatjobs.com	United States	13335	CLOUDFLARENETUS	false
142.250.184.238	unknown	United States	15169	GOOGLEUS	false
172.217.16.195	unknown	United States	15169	GOOGLEUS	false
142.250.185.74	unknown	United States	15169	GOOGLEUS	false
142.250.186.46	www3.l.google.com	United States	15169	GOOGLEUS	false
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
216.58.206.78	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
216.58.206.34	unknown	United States	15169	GOOGLEUS	false
142.250.181.234	unknown	United States	15169	GOOGLEUS	false
142.250.181.232	unknown	United States	15169	GOOGLEUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583926
Start date and time:	2025-01-03 21:23:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://track2.mccarthysearch.com/9155296/c?p=UJEwZLRSuPVlnD1ICTWZusB5H46ZFxhQFeZmgv_N89FzkqdhuHSGoPyB5qZfahmny00oVnRJ_XGR4M89Ovy-j3JZN_nz1Nb-BfHfDXVFwrd4A8njKtxWHgVV9KpuZ3ad6Xn31h13Ok4dSqgAUkhmVH1KUMKOlrKi5AYGmafMXkrBRxU_B4vy7NXVbEVJ970TwM25LbuS_B0xuuC5g8ehQDyYNyEV1WCghuhx_ZKmrGeOOXDf8HkQ-KOwv_tecp8TMdskXzay5lvoS31gB-nWxsjPaZ8f84KWvabQB4eF73ffpyNcTpJues_4IHHPjEKJ9ritMRTaHbFdQGNT_n13X_E7no0nMmaegQjwo4kKGu6oR02iG2c_6ucy3I6d8vsNl324Pjhx3M20dDmfZAju1roW9lGyO1LfgEnp1iSAFpx4kA7frEmKGzJYNX_cZrwVBoH8vvIYauXGnXBrZacRhuZGGbOjW2HHr9KF-0q7xjdgG2hxjWZ2H9zjubJGDnUjHRfiIr_-0bem1pLFqziEmy0450LGuXV23cQ6GD8yuK9tuRwMIF0sbkhVqONC0e6TsXlkUuTRAVWBbLlRPcygJ-CbukwvFtAxobVQ8-PpIuGj97DYFnmbfbJrrZDtH57TpdP4AxtW5k74BKSXvb1B6JX0p7Oyr1kXxLs_OrNPdAdrf8gXR35D9W7WeQ2zhPEqP0Mv5sJx4DlYh6Y4FqgPfCRFcDcL7Cy3HSlJ0XYfv-ae4o-hdX_0rJPqEG_-Bn2yj60YPDYpE8KDIgC_ZMwlNLdK4pAK6vSt4NWDncuV5y7QDqt97ribjd4U3AOvQTKW9r_eMky9-IC9hkSPrg2S0ZBgA9ITW3AQ3v-lq94cAwt1v1RLaFgsy67l_7lni1gYsZaQdOsFJsDpCFYaZsTMcVz2QAnQ_2UidhzlUekPl5xh9LNe9o77rO1FolZslooaXxCf2U2RZmvUA6NCNiGZ8KSsoUYTnqAHenvBJVJwMWd66yD2O60rC3Ic2qOQ1KOF9AB6-iFTvQFxtSTjS2hFwi7N97LeQtVYKhdzZuq2SasgJg0JPnZiFv_FSbgmiodqx9rz_lWIqWQNoQVht-oO2BfFxSF_aedAmm2MuQAL7z8UjBf_deiKwQyfKOyA6ZkAJ14F9xwhNm9F7B4PBgDtocqJQBjw5Cf1jCBSAs3nSYP2_nzofJuQSXd-YD9PIzkkmJw7Nqux7IgJ6p1z2Hsf6i3zShVdZY3g2mmA1xR1FV1LoSYwcRBqZt3pv0UDjuqCEoiqKDuyT0rkhqTRLo29uuM588Lna16PFSgSLoLUhnJ2rx8NLQQc5TqrsGjlN-ulCwTEyA0C9Epz9mxq14yDjw==
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@27/103@93/513

Input	Output
URL: https://track2.mccarthysearch.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://track2.mccarthysearch.com
URL: https://mccarthysearch.com/job?payload=NJfBeBSc1Jy... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script exhibits high-risk behaviors, including the use of obfuscated URLs and redirecting the user to a suspicious domain (mccarthysearch.com). The obfuscated URL payload suggests the potential for data exfiltration or other malicious activities. Overall, this script demonstrates a high risk of malicious intent and should be further investigated." }
function redirect(params) { window.location.replace('https://mccarthysearch.com/job?payload=NJfBeBSc1JyEGOKT2ICyEt9ELz2JQ_04W45jLzeSP6Toh5Jv2gyOkOQ0F9fpwLkinxVtwlymsvxxMF9RhL27sHbCKMDE4O6_tB2mtt93K5dFYlaNWbeeODbw-amW4X1_CX-c4VClHASkypsi10A7moRAGUI9fZ9Am11F4gEMVawMT8RSUCE7X5iE3vWkqFqRImpEWlJAjChZbceMW8AKoCEWU0RQbInIfZ9y6i9FJpDRzoQFYg6UoXhi14XZBeBrekAgED1NFUZRa2RobNfHlVWXZPfEnVMnuykHk-G-m7r32sZflocH0dbCOxyh7kqk1RgASL1Bp98cHrZBs3GXrtV4dnUDVAJ4OGjVjA0gk5EgCDZDitfuwRrysfg1-2zOi3dkF4kJyOwsePzPqOW5s6bW2Eo8r8Ff0jL_D7rwJQFQJzo-j-5nYxQbthJvhP7fXbpRQ0weC2DoABCBc64YtMaKrGPHwoGtf8LjAnzh3hipjeZ8h8wzJG0nZUoybZUXFBHp5xrs6_dVDFqNgEPXqBUjujENywMA5vRgiuEp6brKAA-mkIQKXKFqqNhNliCdYf-1BcscmTwY_huCAyraOxXulv-_pivbuCvIx_zRCNSeJakek98GqMWIw2Rva_qjRnDBIamTx8Pidt9M6CTISkUg4ONNAnB097804yciOOG-eP-_5SSUjlqT9OyfI_XHxqVu9wH4ZyfautXzDPuyQDlLsNZ4uA0tGz3-l0nI8hd7GyLUCwdG3NP4VhkRkJSabOyKBouHOECa35erYWbhzv_6GKlDibu1TctBUfDgsiNLbeHRlkRrWC_XkwBVyzd5wr-svZ1YcKTgHbw082VYWA.oqub3cwoiXeLwNytJ5ZfEw' + '&token=' + params); }
URL: https://challenges.cloudflare.com/cdn-cgi/challeng... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This script appears to be related to Cloudflare's challenge system, which is a legitimate security mechanism used to protect websites from abuse. The script contains configuration options for Cloudflare's challenge system, but does not exhibit any high-risk behaviors. The script is likely used for legitimate purposes and does not pose a significant security risk." }
(function(){ window._cf_chl_opt={ cvId: '3', cZone: 'challenges.cloudflare.com', cTplV: 5, chlApivId: '0', chlApiWidgetId: 'w7mch', chlApiSitekey: '0x4AAAAAAAYqpBCP4VGvMThh', chlApiMode: 'managed', chlApiSize: 'normal', chlApiRcV: 'rGJlq.38CBPPomk4hST1uHmuqVxWHzNoiJAgAh2HYOQ-1735935856-1.3.1.1-43h315Xb4YZmsbMEsdR8JNj59V9sRfnT85_u2NiBUBc', chlApiTimeoutEncountered: 0, chlApiOverru
URL: https://challenges.cloudflare.com/cdn-cgi/challeng... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The provided JavaScript snippet appears to be a Cloudflare challenge script, which is a common security mechanism used to protect websites from bots and other automated threats. While the script contains some behaviors that could be considered moderate-risk, such as external data transmission and the use of legacy APIs, it does not demonstrate any clear malicious intent. The script's purpose is to facilitate a challenge-response interaction between the client and the Cloudflare server, which is a legitimate security practice. Therefore, the overall risk score is assessed as medium, requiring further review but not necessarily indicating a high-risk scenario." }
(function(){ window._cf_chl_opt={ cvId: '3', cZone: 'challenges.cloudflare.com', cTplV: 5, chlApivId: '0', chlApiWidgetId: 'w7mch', chlApiSitekey: '0x4AAAAAAAYqpBCP4VGvMThh', chlApiMode: 'managed', chlApiSize: 'normal', chlApiRcV: 'rGJlq.38CBPPomk4hST1uHmuqVxWHzNoiJAgAh2HYOQ-1735935856-1.3.1.1-43h315Xb4YZmsbMEsdR8JNj59V9sRfnT85_u2NiBUBc', chlApiTimeoutEncountered: 0, chlApiOverrunBudgetMs:10000, chlTimeoutMs:120000, cK:[], cType: 'chl_api_m', cRay: '8fc5b620aad7428e', cH: 'fIqxBsCc00p6oewm4lxIWhDf88yDglRwwXq9f2ZOt3E-1735935856-1.1.1.1-_TU1fdoaug4Z1Q_BimMOyf4OHTPWR0WpzaOk7A_xd5HcZLp5kw03jOZ2Er.GIPaj', cFPWv: 'g', cLt: 'n', chlApiFailureFeedbackEnabled:true, chlApiLoopFeedbackEnabled:false, wOL:false, wT: 'dark', wS: 'normal', md: 'hahhu66O.eokamRflEZ2tMngG.J6c3OWCETbyughQgE-1735935856-1.1.1.1-EAyCRpXnym3m7rMxtZeJKMOftrzKtqtcXaLD8z_1xeXs9BkfFQGK5d8Wr3N6NGLed_vqqOMKfRr7.GK7fCPgTvKjXQUY9kA6eBOHYBKFhy3.9O4hF.baQD0da3KXDDfNQFIf.zHjX4Qx1.5EFkZ5Mr4rsLq2M4P67SMjLyxdPBcGXWfxLOw2jUxpUHBuCy5xd1FQRvkKH.ISDRLPHhu.FzlG1fFGRcKVCiAfvv5olAByGmwVWqSTqEyOnFv4JLKMwdRl96G9FWs8uruu9CqEcNWK_r.T9_iNMl9DgQszy3BHjNC5YngfCJuMuduYsgkwWetQANLJzeEjWC31UDGQeE6w9ZKWwrw4AbC07JJcoVSAQO0RTAs2CYAjriP_ktYT2awofvxTLlDkgs9wTiqqnbTg_WiVRQzl5fRsj81jjSf0CT_zcEtU8ieK5kc_7U2ipX1VxM.oRIHvgYBsGFQ8NEyqLfEozxPjSEdsy487oF3opRNaH7Ooo0r6vf8FjrjekjpzAy3ddIp3LlVbsa7j8KRTZ8pPLziJH7G0cWOmEcA3ah6T_cx3WBVYAfsmpG1_KjYPEUHGXK3f0AuhSPpxwSRFBNzxGs5gagzo5ZvOTNH269Usgc_oJV1kTXFoH4pwTRfAcxB0Wq6paDmnYwyk9CBwg8g3o.uWqEJLcO_tybeDRE.y3Ifnu3mdV8G0S.r0iGR0MKTnOOM2L.nL.eH.8_DU6F3cAhyLNSf7Izq_aw1.VkedXvJWQdZLQ2aviWv8dfrUacSJf.JFYYGLbXt9W99BsNMGJ0fLHQ0wW6KPMBffBAoW7jGpjjQLZmkGPRSkUPxwsxLgFYn59YPht9dvukHG52UHbejGiB7URO26P_QS41bWrRRf3DXKpF4eeaEkECeUbiGnk.znxoGaPgIDwuPReSdji3nkIXNs6FzJXEGMOKVnpB9FDfaQrO2n75xMRSQb0sPsgpgHr2q0zcOtFTooSics2a3J63E_b4ISxE4wAPYtEEA91m4a8316RjUOb23DlVKBbDdFSse2YOm8ta7wIV2340QNXWi6eiecN9FA7BYPePTQYjla_LQffMxr7HPRUJU.vhzZGGJ18c4zgKqoIPE1qJshTzNBg.POrszDWdw_nOkSkxbXhd.wxyeSXYFWiMO5ba4KnY.TvgIZb_zDTpXolG3AV06_G8vlmK5p5wTccdkVuKrZ1q_Bns1TYlqAP.PpIejdSQnedR.lR8fDtp_nHBz5373IVl3O76UZNoi4vcVHbaRIy4RdEjiH5ZbatBNYlXoCiLX.XWFLouGyqhoDeHi099_rHw9yge6ilYATImZzDdjoSQHW9o_VoSreRjjoz0b9fhmcAl5krDPJUDtNgzTuWQAFIFAhCUG7iX0dleZcF7AfGqZ35qylBKeuiaKAk.Qy.C7aLuzlm_evAdd5zYeOICwlAseILLW7qlLT2_soJsJif7Wgdq_Oj0b2feZfxh6Nc4BDLJDuOOf6WOJfL765_k3_dzGXzLDDvQUJcxdXtDE67WoDvvRA.DoxpmEhBhpJqp76txFUxwuKOPSdAWJ95PGNpfhDMdHXgF64ifx.Yk1YmwH2b1cT', cITimeS: '1735935856', refresh: function(){ if(window['parent']){ window['parent'].postMessage({ source: 'cloudflare-challenge', widgetId: 'w7mch', nextRcV: 'rGJlq.38CBPPomk4hST1uHmuqVxWHzNoiJAgAh2HYOQ-1735935856-1.3.1.1-43h315Xb4YZmsbMEsdR8JNj59V9sRfnT85_u2NiBUBc', event: 'reloadRequest', }, ""); } } }; var handler = function(event) { var e = event.data; if (e.source && e.source === 'cloudflare-challenge' && e.event === 'meow' && e.widgetId === window._cf_chl_opt.chlApiWidgetId) { if(window['parent']){ window['parent'].postMessage({ source: 'cloudflare-challenge', widgetId: window._cf_chl_opt.chlApiWidgetId, event: 'food', seq: e.seq, }, ''); } } }
URL: https://mccarthysearch.com/job?payload=NJfBeBSc1JyEGOKT2ICyEt9ELz2JQ_04W45jLzeSP6Toh5Jv2gyOkOQ0F9fpwLkinxVtwlymsvxxMF9RhL27sHbCKMDE4O6_tB2mtt93K5dFYlaNWbeeODbw-amW4X1_CX-c4VClHASkypsi10A7moRAGUI9fZ9Am11F4gEMVawMT8RSUCE7X5iE3vWkqFqRImpEWlJAjChZbceMW8AKoCEW Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Please verify that you are human by completing the action below before proceeding to the job", "prominent_button_name": "Verifying...", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://mccarthysearch.com/job?payload=NJfBeBSc1JyEGOKT2ICyEt9ELz2JQ_04W45jLzeSP6Toh5Jv2gyOkOQ0F9fpwLkinxVtwlymsvxxMF9RhL27sHbCKMDE4O6_tB2mtt93K5dFYlaNWbeeODbw-amW4X1_CX-c4VClHASkypsi10A7moRAGUI9fZ9Am11F4gEMVawMT8RSUCE7X5iE3vWkqFqRImpEWlJAjChZbceMW8AKoCEW Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: https://challenges.cloudflare.com/cdn-cgi/challeng... Model: Joe Sandbox AI	```json { "risk_score": 6, "reasoning": "The script contains obfuscated code, which is a high-risk indicator (+3 points). It also involves aggressive DOM manipulation, as seen in the repeated use of functions and operations on the DOM (+2 points). The script does not clearly indicate any legitimate context or trusted domain interactions, and the obfuscation suggests potential malicious intent. Therefore, the final risk score is 6, indicating medium risk and warranting further review." }
window._cf_chl_opt.uaO=false;window._cf_chl_opt.qqQL2={"metadata":{"challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support","challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F","challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F"},"translations":{"testing_only_always_pass":"Testing%20only%2C%20always%20pass.","turnstile_overrun_description":"Stuck%20here%3F","human_button_text":"Verify%20you%20are%20human","invalid_sitekey":"Invalid%20sitekey.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists.","testing_only":"Testing%20only.","check_delays":"Verification%20is%20taking%20longer%20than%20expected.%20Check%20your%20Internet%20connection%20and%20%3Ca%20class%3D%22refresh_link%22%3Erefresh%20the%20page%3C%2Fa%3E%20if%20the%20issue%20persists.","turnstile_feedback_report":"Having%20trouble%3F","feedback_report_output_subtitle":"Your%20feedback%20report%20has%20been%20successfully%20submitted","turnstile_footer_terms":"Terms","invalid_domain":"Invalid%20domain.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists.","time_check_cached_warning":"Your%20device%20clock%20is%20set%20to%20a%20wrong%20time%20or%20this%20challenge%20page%20was%20accidentally%20cached%20by%20an%20intermediary%20and%20is%20no%20longer%20available","not_embedded":"This%20challenge%20must%20be%20embedded%20into%20a%20parent%20page.","turnstile_failure":"Error","turnstile_success":"Success%21","turnstile_feedback_description":"Send%20Feedback","turnstile_footer_privacy":"Privacy","outdated_browser":"Your%20browser%20is%20out%20of%20date.%20Update%20your%20browser%20to%20view%20this%20site%20properly.%3Cbr%2F%3E%3Ca%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%20href%3D%22https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support%22%3EClick%20here%20for%20more%20information%3C%2Fa%3E","turnstile_expired":"Expired","turnstile_refresh":"Refresh","turnstile_verifying":"Verifying...","turnstile_iframe_alt":"Widget%20containing%20a%20Cloudflare%20security%20challenge","turnstile_timeout":"Timed%20out"},"polyfills":{"feedback_report_output_subtitle":false},"rtl":false,"lang":"en-us"};~function(gJ,eM,eN,eO,eU,eV,fn,fq,fs,ft,fu,fG,fS,fY,fZ,g0,ga,gl,gp,gw,gA,gB,gC,gG,gH,eS,eT){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=parseInt(gI(1282))/1(-parseInt(gI(798))/2)+parseInt(gI(1425))/3+parseInt(gI(1117))/4(-parseInt(gI(1109))/5)+-parseInt(gI(1093))/6(parseInt(gI(1687))/7)+-parseInt(gI(1781))/8+-parseInt(gI(1231))/9+-parseInt(gI(1841))/10(-parseInt(gI(1302))/11),d===f)break;else e.push(e.shift())}catch(g){e.push(e.shift())}}(a,258608),eM=this\|\|self,eN=eM[gJ(552)],eO=function(gK,d,e,f,g){return gK=gJ,d={'VvzNa':gK(1095),'EvQJn':function(h,i){return h&i},'CJmty':function(h,i){return i^h},'jtftE':function(h,i){return h===i},'HeBKW':gK(1046),'sEYOg':function(h,i){return h-i},'btcid':function(h,i){return h<i},'sReYr':function(h,i){return h==i},'JalSX':function(h,i){return h<<i},'xYMbR':function(h,i){return i&h},'Bpcrv':function(h,i){return h\|i},'pFiMp':function(h,i){return h-i},'fcZAI':function(h,i){return i!==h},'cYWiA':function(h,i){return h>i},'VsuwE':function(h,i){return h-i},'yhzox':function(h,i){return h<<i},'FpNeh':function(h,i){return h-i},'fpYkL':function(h,i){return h<i},'gYMLg':function(h,i){return h(i)},'qiaiE':function(h,i){return h<<i},'CFXJs':function(h,i){return h\|i},'diEey':function(h,i){return h==i},'rnDvj':function(h,i){return h(i)},'QeXWQ':function(h,i){return i==h},'urTWU':function(h,i){return h>i},'XyuZI':function(h,i){return h==i},'DBWZF':function(h,i){return h(i)},'uJwFa':function(h,i){return i!=h},'unWhj':function(h,i){return h(i)},'EqWUj':function(h,i){return h*i},'ldevC':function(h,i){return h<i},'CReFW':function(h,i){return i&h},'wetgS':function(h,i){return h-i},'Scozh':func
URL: https://challenges.cloudflare.com/turnstile/v0/g/8... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script does not exhibit any high-risk or moderate-risk behaviors such as dynamic code execution, data exfiltration, or redirects to suspicious domains. It primarily consists of utility functions and error handling, with no clear malicious intent or interaction with external domains." }
"use strict";(function(){function Wt(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Ht(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Wt(u,o,c,g,h,"next",l)}function h(l){Wt(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Ar(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=null?r:{},Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):Ar(Object(r)).forEach(function(n){Object.defineProperty(e,n,Object.getOwnPropertyDescriptor(r,n))}),e}function Bt(e){if(Array.isArray(e))return e}function jt(e,r){var n=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(n!=null){var o=[],c=!0,u=!1,g,h;try{for(n=n.call(e);!(c=(g=n.next()).done)&&(o.push(g.value),!(r&&o.length===r));c=!0);}catch(l){u=!0,h=l}finally{try{!c&&n.return!=null&&n.return()}finally{if(u)throw h}}return o}}function qt(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}function at(e,r){(r==null\|\|r>e.length)&&(r=e.length);for(var n=0,o=new Array(r);n<r;n++)o[n]=e[n];return o}function zt(e,r){if(e){if(typeof e=="string")return at(e,r);var n=Object.prototype.toString.call(e).slice(8,-1);if(n==="Object"&&e.constructor&&(n=e.constructor.name),n==="Map"\|\|n==="Set")return Array.from(n);if(n==="Arguments"\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(n))return at(e,r)}}function Ae(e,r){return Bt(e)\|\|jt(e,r)\|\|zt(e,r)\|\|qt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(u[0]&1)throw u[1];return u[1]},trys:[],ops:[]},o,c,u,g;return g={next:h(0),throw:h(1),return:h(2)},typeof Symbol=="function"&&(g[Symbol.iterator]=function(){return this}),g;function h(p){return function(E){return l([p,E])}}function l(p){if(o)throw new TypeError("Generator is already executing.");for(;g&&(g=0,p[0]&&(n=0)),n;)try{if(o=1,c&&(u=p[0]&2?c.return:p[0]?c.throw\|\|((u=c.return)&&u.call(c),0):c.next)&&!(u=u.call(c,p[1])).done)return u;switch(c=0,u&&(p=[p[0]&2,u.value]),p[0]){case 0:case 1:u=p;break;case 4:return n.label++,{value:p[1],done:!1};case 5:n.label++,c=p[1],p=[0];continue;case 7:p=n.ops.pop(),n.trys.pop();continue;default:if(u=n.trys,!(u=u.length>0&&u[u.length-1])&&(p[0]===6\|\|p[0]===2)){n=0;continue}if(p[0]===3&&(!u\|\|p[1]>u[0]&&p[1]<u[3])){n.label=p[1];break}if(p[0]===6&&n.label<u[1]){n.label=u[1],u=p;break}if(u&&n.label<u[2]){n.label=u[2],n.ops.push(p);break}u[2]&&n.ops.pop(),n.trys.pop();continue}p=r.call(e,n)}catch(E){p=[6,E],c=0}finally{o=u=0}if(p[0]&5)throw p[1];return{value:p[0]?p[1]:void 0,done:!0}}}var Gt={code:200500,internalRepr:"iframe_load_err",public:!0,retryable:!1,description:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Xt=300020;var De=300030;var Ve=300031;var j;(function(e){e.MANAGED="managed",e.NON_INTERACTIVE="non-interactive",e.INVISIBLE="invisible"})(j\|\|(j={}));var L;(fun
URL: https://mccarthysearch.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://mccarthysearch.com
URL: https://www.google.com/search?q=t+you+are+human+by... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a simple script that updates an element's attribute with the current timestamp. This behavior is consistent with basic DOM manipulation and does not exhibit any high-risk indicators, such as dynamic code execution, data exfiltration, or suspicious redirects. The script is likely benign and used for legitimate purposes." }
(function(){var id='z9PoV';document.getElementById(id).setAttribute("lta",Date.now());})();
URL: https://www.google.com/search?q=t+you+are+human+by... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a simple assignment of the current timestamp to a global variable `_hst`. This behavior is commonly seen in analytics or telemetry scripts and does not demonstrate any high-risk indicators. The risk score is low as the script does not exhibit any malicious or suspicious activities." }
window._hst=Date.now();
URL: https://www.google.com/search?q=t+you+are+human+by... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. While the script may have a legitimate purpose, such as analytics or tracking, the aggressive and opaque nature of its implementation raises significant security concerns. Further investigation is warranted to determine the true intent and potential impact of this script." }
(function(){var p={astyp:'folsrch',cee:'JJ8and',ck:'B2Jtydfkd4Z-rTJZji1e8Ps-3y-AY',cp:'',id:'B2Jtyd',m:1,url:'/async/folsrch?yv\x3d3\x26cs\x3d0\x26ei\x3dfkd4Z-rTJZji1e8Ps-3y-AY\x26async\x3d_basejs:/xjs/_/js/k%3Dxjs.s.en_US.eJ9pz7SMyok.2018.O/am%3DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAEAACgIQAAAAAACgAAAAAAAAAAAAAABIAAAAAAAAECAABEJCAAAEAAAAAMACAAAILAABAgAEAAAAAAAEAAAAIEAEYL__OgAAAAAAAAAAAAQCABEAAAAAAHABABAE0d4AAQAAAAgAAAAMAAAAQAAAAAAAAAUAAAAAAAAAAAQAAAAAAAAABAAAAAABAPoBAAAAAAAAAAAAAAACAAAAAABggAIAAvgBAAAAAACAAwAAAAABAQAAOAYGIAAAAAAAAAD3AcDjAeGQwgIAAAAAAAAAAAAAAAABSBDMgfQXBCAAAAAAAAAAAAAAAAAAAJAiaOJyAwAC/dg%3D0/br%3D1/rs%3DACT90oE9p3Bf3kigy-JLc2NCo4LYUkEfmg,_basecss:/xjs/_/ss/k%3Dxjs.s.cv79PgLUhzo.L.B1.O/am%3DAJA6BAgBAAAgAACAMAxUABAAAAAAAAAAAAAAAAAAAAAAAAAAAEACAAAAhIAAACQAACAAAAAgAgKQMgEAAAQvAABgFwBAAAAA-AAIpKMC0AAAECAABEBCABAEAAgAAsAKAQAAC
URL: https://www.google.com/search?q=t+you+are+human+by... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The provided JavaScript snippet exhibits a mix of behaviors, some of which are potentially concerning but not inherently malicious. The script appears to be related to analytics and performance tracking, with some use of legacy APIs and aggressive DOM manipulation. However, there are no clear indicators of data exfiltration or dynamic code execution, which would be considered high-risk. Overall, the script requires further review due to its complex behavior, but it does not appear to be a high-risk threat." }
(function(){'use strict';var h={push:a=>void a()};var k=function(a){if(Array.isArray(a.g.cbvi))for(const b of a.g.cbvi)b();a.g.cbvi=h},l=function(a){k(a);var b,c;let d;const e=((b=google.stvsc)==null?void 0:b.ns)\|\|((c=window.performance)==null?void 0:(d=c.timing)==null?void 0:d.navigationStart);e&&(a.i.ns=e);b=a.g.t.getAttribute("eid");c=[];for(var f of Object.keys(a.i))c.push(`${f}.${a.i[f]-a.L}`);for(const g of Object.keys(a.j))c.push(`${g}.${a.j[g]-a.L}`);f=`/gen_204?s=async&astyp=${a.g.astyp}&atyp=csi&ei=${b}&rt=${c.join(",")}`;e&&(f+=`&ns=${e}`);a.v&&(f+=`&twt=${a.v}&mwt=${a.D}`);a.C&&(f+=`&lvhr=${a.C}`);a.A&&(f+=`&${"imn"}=${a.A}`);a.B&&(f+=`&${"ima"}=${a.B}`);google.log("","",f)},m=function(a){a.A!==a.H\|\|a.I\|\|(a.i.art=Date.now(),l(a))},n=function(a){a.B===a.M&&k(a)},p=function(a,b,c){var d=a.g.t.querySelectorAll("[data-subtree]");for(const f of d){var e=f.dataset.subtree;e&&(d=`${"saft"}-${e}`,e=`${"sart"}-${e}`,f.contains(b)\|\|b.contains(f))&&(a.j[d]=c,a.j[e]=c)}},q=function(a,b,c){var d=google.cv(b,!1,!0,a.g.t);d&1?(d=Date.now(),c&&(a.C= c),a.i.aaft=d,a.i.aafct=d,p(a,b,d)):d&4&&(a.N=!0,n(a))},r=function(a,b,c,d=!1){b.getAttribute("data-deferred")==="1"?google.rll(b,!0,()=>{r(a,b,c,d)}):d\|\|(b.getAttribute("data-deferred")==="2"&&b.setAttribute("data-deferred","3"),d=!0,t(a,b,c))},u=function(a,b,c){q(a,b,c);b=b.getElementsByTagName("img");for(c=0;c<b.length;c++){const d=b[c];++a.A;const e=d.complete&&!d.getAttribute("data-deferred"),f=d.hasAttribute("data-noaft");if(e\|\|f){++a.H;continue}const g=!!(google.cv(d,!1,!0,a.g.t)&1);g&&++a.B;google.rll(d,!0,()=>{r(a,d,g)});a.i.irfi\|\|(a.i.irfi=Date.now());a.i.irli=Date.now()}},t=function(a,b,c){const d=Date.now();a.i.irfie\|\|(a.i.irfie=d);++a.H;c&&(++a.M,a.i.aaft=d,a.i.aafit=d,p(a,b,d));a.N&&n(a);a.S&&m(a)},v=function(a,b,c){var d=a.g.t.querySelectorAll("[data-subtree]");for(const f of d){var e=f.dataset.subtree;if(!e)continue;d=`${"sirt"}-${e}`;const g=`${"sart"}-${e}`;e=`${"scrt"}-${e}`;b.contains(f)?(a.j[d]\|\|(a.j[d]=c),a.j[g]=c,a.j[e]=c):f.contains(b)&&(a.j[g]=c,a.j[e]=c)}},w=class{constructor(a){this.g= a;this.L=Date.now();this.j={};this.i={};this.M=this.B=this.v=this.H=this.A=this.G=this.D=this.C=0}}; function x(a){a.req=new XMLHttpRequest;a.cbfd=[];a.cbvi=[]}function y(a){x(a);const b=new z(a);google.ia.was(a,()=>{b.g.req.addEventListener("readystatechange",b.J);b.g.req.open("GET",b.g.url);for(const c of Object.keys(b.g.h))b.g.req.setRequestHeader(c,b.g.h[c]);b.i.ipf=Date.now();b.g.req.send()})} var A=function(a){a.s===0&&a.R&&google.drty&&google.drty()},B=function(a){if(!a.O){a.O=!0;if(Array.isArray(a.g.cbfd))for(const b of a.g.cbfd)b();a.g.cbfd=h}},D=function(a,b){a.I=!0;a.i.ft=Date.now();a.v=0;a.g.req.removeEventListener("readystatechange",a.J);a.g.req.abort();l(a);google.fce(a.g.t,a.g.cee,b);B(a)},K=function(a,b,c){const d=b[0];b=b[1];if(!a.T&&d===2&&b==null)return E(a,c),a.T=!0,a.g.t;switch(d){case 1:D(a,Error(c));break;case 2:return F(a,b,c);case 6:return G(a,b,c);case 3:H(a,b,c,!0);break;case 4:a.s++;google.ia.dq.push({astyp:a.g.astyp,cb:()=>{I(c);a.s--;A(a)}});break;case 7:J(a,c);break;case 5:google.ia.dq.push({astyp:a.g.astyp,md:c})}},E=function(a,b){const c=Date.now();a.i.st=c;a.g.t.innerHTML=b;v(a,a.g.t,c);L(a.g.t);a.g.t.setAttribute("eid",a.K[0]);u(a,a.g.t,++a.l)},F=function(a,b,c){b=document.getElementById(b);b.innerHTML=c;a.l++;for(const d of b.children)q(a,d,a.l);v(a,b,Date.now());L(b);return b},G=function(a,b,c){const d=a.g.t.querySelector(`[data-async-ph="${b}"]`);if(d)return M(a,d,c);a.s++;google.ia.dq.push({astyp:a.g.astyp,cb:()=>{M(a,a.g.t.querySelector(`[data-async-ph="${b}"]`),c);a.s--;A(a)}})},H=function(a,b,c,d){let e;const f=(e=document.getElementById(b))!=null?e:a.g.t.querySelector(`img[data-iid="${b}"]`);!f&&d?a.g.cbfd.push(()=>{google.ia.dq.push({astyp:a.g.astyp,cb:()=>{H(a,b,c,!1)}})}):(f.setAttribute("data-deferred","2"),f.src=c)},I=function(a){const b=document.createElement("script");b.textContent=a;document.body.appendChild(b)},J=function(a,b){con
URL: https://www.google.com/search?q=t+you+are+human+by... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a combination of Google-related utility functions and event handlers. It does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or redirects to malicious domains. The code seems to be focused on handling form submissions, click events, and performance-related functionality, which are common and legitimate use cases. While the code uses some legacy APIs like `XDomainRequest`, these pose minor risks and are not inherently malicious. Overall, this script is likely benign and does not demonstrate any suspicious or malicious behavior." }
(function(){var b=window.addEventListener;window.addEventListener=function(a,c,d){a!=="unload"&&b(a,c,d)};}).call(this);(function(){var _g={kEI:'fkd4Z-rTJZji1e8Ps-3y-AY',kEXPI:'31',kBL:'cyF7',kOPI:89978449};(function(){var a;((a=window.google)==null?0:a.stvsc)?google.kEI=_g.kEI:window.google=_g;}).call(this);})();(function(){google.sn='web';google.kHL='en';})();(function(){ var g=this\|\|self;function k(){return window.google&&window.google.kOPI\|\|null};var l,m=[];function n(a){for(var b;a&&(!a.getAttribute\|\|!(b=a.getAttribute("eid")));)a=a.parentNode;return b\|\|l}function p(a){for(var b=null;a&&(!a.getAttribute\|\|!(b=a.getAttribute("leid")));)a=a.parentNode;return b}function q(a){/^http:/i.test(a)&&window.location.protocol==="https:"&&(google.ml&&google.ml(Error("a"),!1,{src:a,glmm:1}),a="");return a} function r(a,b,d,c,h){var e="";b.search("&ei=")===-1&&(e="&ei="+n(c),b.search("&lei=")===-1&&(c=p(c))&&(e+="&lei="+c));var f=b.search("&cshid=")===-1&&a!=="slh";c="&zx="+Date.now().toString();g._cshid&&f&&(c+="&cshid="+g._cshid);(d=d())&&(c+="&opi="+d);return"/"+(h\|\|"gen_204")+"?atyp=i&ct="+String(a)+"&cad="+(b+e+c)};l=google.kEI;google.getEI=n;google.getLEI=p;google.ml=function(){return null};google.log=function(a,b,d,c,h,e){e=e===void 0?k:e;d\|\|(d=r(a,b,e,c,h));if(d=q(d)){a=new Image;var f=m.length;m[f]=a;a.onerror=a.onload=a.onabort=function(){delete m[f]};a.src=d}};google.logUrl=function(a,b){b=b===void 0?k:b;return r("",a,b)};}).call(this);(function(){google.y={};google.sy=[];var d;(d=google).x\|\|(d.x=function(a,b){if(a)var c=a.id;else{do c=Math.random();while(google.y[c])}google.y[c]=[a,b];return!1});var e;(e=google).sx\|\|(e.sx=function(a){google.sy.push(a)});google.lm=[];var f;(f=google).plm\|\|(f.plm=function(a){google.lm.push.apply(google.lm,a)});google.lq=[];var g;(g=google).load\|\|(g.load=function(a,b,c){google.lq.push([[a],b,c])});var h;(h=google).loadAll\|\|(h.loadAll=function(a,b){google.lq.push([a,b])});google.bx=!1;var k;(k=google).lx\|\|(k.lx=function(){});var l=[],m;(m=google).fce\|\|(m.fce=function(a,b,c,n){l.push([a,b,c,n])});google.qce=l;}).call(this);google.f={};(function(){ document.documentElement.addEventListener("submit",function(b){var a;if(a=b.target){var c=a.getAttribute("data-submitfalse");a=c==="1"\|\|c==="q"&&!a.elements.q.value?!0:!1}else a=!1;a&&(b.preventDefault(),b.stopPropagation())},!0);document.documentElement.addEventListener("click",function(b){var a;a:{for(a=b.target;a&&a!==document.documentElement;a=a.parentElement)if(a.tagName==="A"){a=a.getAttribute("data-nohref")==="1";break a}a=!1}a&&b.preventDefault()},!0);}).call(this);(function(){google.hs={h:true,nhs:false,sie:false};})();(function(){google.c={btfi:false,caf:false,cap:2000,cfr:false,cwh:false,dclt:false,di:false,doiu:1,fla:false,fli:false,gl:false,irsf:false,lhc:false,marb:true,mcc:false,pci:true,raf:false,taf:true,timl:false,tprc:false,vis:true,wh0:true,whu:true};})();(function(){ var p=this\|\|self;window.google=window.google\|\|{};var q=window.performance&&window.performance.timing&&"navigationStart"in window.performance.timing,aa=google.stvsc&&google.stvsc.ns,r=q?aa\|\|window.performance.timing.navigationStart:void 0;function u(){return window.performance.now()-(google.stvsc&&google.stvsc.pno\|\|0)}var ba=google.stvsc&&google.stvsc.rs,v=q?ba\|\|window.performance.timing.responseStart:void 0;function ca(a,b,c,d,f){if(!a\|\|!b&&da(a))return 0;if(!a.getBoundingClientRect)return 1;var h=function(l){return l.getBoundingClientRect()};return!b&&ea(a,d,h)\|\|!b&&f&&fa(a,h)?0:ha(a,b,c,d,h)}function fa(a,b){a=b(a);return a.height<=0\|\|a.width<=0?!0:!1} function ea(a,b,c){a:{for(var d=a;d&&d!==b;d=d.parentElement)if(d.style.overflow==="hidden"\|\|d.tagName==="G-EXPANDABLE-CONTENT"&&getComputedStyle(d).getPropertyValue("overflow")==="hidden"){b=d;break a}b=null}if(!b)return!1;a=c(a);c=c(b);return a.bottom<c.top\|\|a.top>=c.bottom\|\|a.right<c.left\|\|a.left>=c.right} function da(a){return a.style.display==="none"?!0:document.defaultView&&document.defaultView.getComputedStyle?(a=doc
URL: https://www.google.com/search?q=t+you+are+human+by+completing+the&sourceid=chrome&ie=UTF-8 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "To prove you are human by completing a task only asked to solve a CAPTCHA (Completely Automated Computers and Humans Apart), which often involves text or images that are easy for humans to decipher but difficult for computers", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.google.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://www.google.com
URL: https://www.google.com/search?q=t+you+are+human+by+completing+the&sourceid=chrome&ie=UTF-8 Model: Joe Sandbox AI	{ "brands": [ "Google" ] }
	{ "brands": [ "Google" ] }
URL: https://www.google.com/search?q=t+you+are+human+by+completing+the&sourceid=chrome&ie=UTF-8 Model: Joe Sandbox AI	```json{ "legit_domain": "google.com", "classification": "wellknown", "reasons": [ "The URL 'www.google.com' matches the legitimate domain name for the brand 'Google'.", "Google is a well-known brand with a strong online presence.", "There are no suspicious elements in the URL such as misspellings, extra characters, or unusual domain extensions." ], "riskscore": 1}
URL: www.google.com Brands: Google Input Fields: unknown
URL: https://www.google.com/search?q=t+you+are+human+by+completing+the&sourceid=chrome&ie=UTF-8 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "To prove you are human by completing a task online, you would usually be asked to solve a CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart), which often involves identifying distorted text or images that are easy for humans to decipher but difficult for automated bots to solve.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.google.com/search?q=t+you+are+human+by+completing+the&sourceid=chrome&ie=UTF-8 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 3 19:24:13 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.0120647726307705
Encrypted:	false
SSDEEP:
MD5:	E01567C8F3CA7F7F3B683133E4F02E5B
SHA1:	E0959A4233BE4E1323D2C5655E9EEF4131FEFB0E
SHA-256:	0AF6ECF3D6F8EF9F2FCDF0A1C93E1A233A1E3757BBDB36B7D1D19E6AD709CC25
SHA-512:	2421CA351FFC63DE1685E9DD00DBB9118F9D57563ADCAAE0C450887A425C5E3210DD912AFC7E302A773F7297BC3669F2A4DED9E05A1565DC8E5CD5EC1484E440
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....I.t.^..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I#Z......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V#Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V#Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V#Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V#Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........G.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 164

Chrome Cache Entry: 165

Chrome Cache Entry: 166

Chrome Cache Entry: 167

Chrome Cache Entry: 168

Chrome Cache Entry: 170

Chrome Cache Entry: 172

Chrome Cache Entry: 173

Chrome Cache Entry: 174

Chrome Cache Entry: 175

Chrome Cache Entry: 176

Chrome Cache Entry: 178

Chrome Cache Entry: 180

Chrome Cache Entry: 181

Chrome Cache Entry: 182

Chrome Cache Entry: 183

Chrome Cache Entry: 184

Chrome Cache Entry: 185

Chrome Cache Entry: 186

Chrome Cache Entry: 190

Chrome Cache Entry: 191

Chrome Cache Entry: 193

Chrome Cache Entry: 196

Chrome Cache Entry: 198

Chrome Cache Entry: 199

Chrome Cache Entry: 204

Chrome Cache Entry: 206

Chrome Cache Entry: 207

Chrome Cache Entry: 209

Chrome Cache Entry: 212

Chrome Cache Entry: 216

Chrome Cache Entry: 217

Chrome Cache Entry: 219

Chrome Cache Entry: 220