Windows Analysis Report
https://na2.docusign.net/Signing/EmailStart.aspx?a=411d2d60-71ee-4477-b645-ccd87151891a&etti=24&acct=b31151fe-1c65-4015-aade-ea249bb0ede6&er=8c8c89ec-97a5-4f5f-882c-1f8e280db0ce&ensd=OlmiHSbJ0eI9ZkG%2fXULDaodBOGI8IJu%2bHw6FQ6MJzij7aDyjpUTWeytYGpq%2fEBOjTDkWOuiaWcxRrawwnlYKXPH6Fk6EMtNu%2fTwdy7t%2bXYp

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false,
    "reasoning": "This is a legitimate DocuSign subdomain used for their North American services. The 'na2' prefix is a standard regional identifier used by DocuSign for their infrastructure."
}

URL: https://na2.docusign.net

{
    "risk_score": 1,
    "reasoning": "The provided JavaScript snippet appears to be setting some experiment-related variables, which is a common practice for A/B testing or feature experimentation. There are no high-risk indicators, and the behavior is consistent with legitimate use cases. Therefore, the risk score is low."
}

window.experimentInfo = { experimentName: 'iframeless', variationName: 'mobile' };

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript snippet appears to be a legitimate script that handles the loading and failure scenarios of an application bundle and envelope JSON. It uses standard JavaScript practices, such as timers and conditional checks, to ensure the proper loading of required resources. While it includes some error handling and retry mechanisms, the overall behavior does not indicate any high-risk or malicious activities. The script seems to be part of a larger application and is likely used for its intended purpose."
}

                (function () {
                    var retryTime = 900*1000
                    var loadingTimeout = setTimeout(onLoadTimeout, retryTime);
                    function onLoadTimeout() {
                        var appBundleLoaded = window.DSSigning && window.DSSigning.isReady;
                        var envelopeJsonLoaded = appBundleLoaded && window.DSSigning.isReady();
                        // Handle app bundle load failure
                        if (!appBundleLoaded) {
                            onBundleLoadFailed();
                        }
                        // Handle envelope json load failure
                        else if (!envelopeJsonLoaded) {
                            onEnvelopeLoadFailed();
                        }
                    }
                    function onBundleLoadFailed() {
                        clearTimeout(loadingTimeout);
                        window.DSSigningShowRetry("AppBundleLoadFailed")
                    }
                    function onEnvelopeLoadFailed() {
                        clearTimeout(loadingTimeout);
                        window.DSSigningShowRetry('EnvelopeJsonFailedToLoad', "Envelope JSON Load Timed out after 900 seconds")
                    }
                    window.throwBundleLoadFailed = onBundleLoadFailed;
                })();
            

{
    "risk_score": 1,
    "reasoning": "This script is low risk as it simply retrieves a token from localStorage and assigns it to a global variable. There are no indicators of dynamic code execution, data exfiltration, or other suspicious behaviors."
}

            try {
                var dappToken = localStorage.getItem('DisplayApplianceToken');
                if (dappToken)
                {
                    window.DisplayApplianceAuthToken = dappToken;
                }
            } catch (e) {
            }
        

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a legitimate script that retrieves a client token from localStorage and appends it to the current URL. This behavior is consistent with authentication or authorization workflows, which is a common practice. While the script uses the `window.location.replace()` method, which can be risky if not used properly, in this context, it seems to be a reasonable way to update the URL with the client token. Overall, the script does not exhibit any high-risk indicators and can be considered low-risk."
}

            (function () {                
                window.location.replace(window.location.href + '&persistent_auth_token=' + getClientToken());

                function getClientToken() {
                    try {
                        var token = localStorage.getItem('DocuSignClientToken');
                        if (token) {
                            return encodeURIComponent(token);
                        }
                    } catch (e) {
                    }

                    return 'no_client_token';
                }
            })();
        

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a simple utility that extracts a token from the URL hash and stores it in the browser's local storage. This behavior is relatively benign and does not demonstrate any high-risk indicators. The code is not obfuscated, does not execute dynamic code, and does not appear to exfiltrate sensitive data. While it uses the `localStorage.setItem()` API, which could potentially be misused, in this context, it seems to be a legitimate functionality. Overall, the risk score is low, and the script is likely not malicious."
}

            (function () {
                if (/^#dappToken=/.test(window.location.hash)) {
                    var index = window.location.href.indexOf("#");
                    try {
                        localStorage.setItem('DisplayApplianceToken', window.location.href.substring(index + 1));                        
                        window.location.replace(window.location.href.substring(0, index));
                    } catch (e) {}
                }
            })();
        

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a CDN fallback mechanism, which is a common practice to ensure the availability of resources. While it uses some legacy APIs like `XDomainRequest`, the overall behavior is focused on loading scripts and stylesheets from different CDN URLs, which is a legitimate use case. There are no clear indicators of malicious intent or data exfiltration, and the script seems to be part of a larger application or framework."
}

    (function () {
        
        window.cdnURL = 'https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/24.12.68-5/';
        window.primaryCdnUrl = window.cdnURL;
        window.cdnUrlsAttempted = [window.cdnURL];
        window.cdnDidFallback = false;
        
        window.disableCDNFallbackDueToOverride = false;
            
                window.fallbackCdnUrl = 'https://apps.docusign.com/cdn/production/1ds/widgets/@ds/signing/24.12.68-5/';
            
        // Set a new CDN Url
        window.setCdnUrl = function(url) {
            window.cdnUrlsAttempted && window.cdnUrlsAttempted.push(url);
            window.cdnURL = url;
            window.cdnDidFallback = true;
        }

        // Set the next available cdn URL, return false if there are no more options
        window.setNextCdnUrl = function() {
            if (window.cdnURL === window.primaryCdnUrl && window.fallbackCdnUrl)
            {
                window.setCdnUrl(window.fallbackCdnUrl);
                return true;
            }
            else
            {
                window.setCdnUrl('/Signing/SigningApp/latest/');
                return false;
            }
        }

        
        window.getCDNMonitoringProps = function() {
            return {
                CdnUrl: window.cdnURL,
                PrimaryCdnUrl: window.primaryCdnUrl,
                FallbackCdnUrl: window.fallbackCdnUrl,
                CdnDidFallback: window.cdnDidFallback,
                CdnUrlsAttempted: JSON.stringify(window.cdnUrlsAttempted), // monitoringProperties cannot be objects/arrays
                DisableCDNFallbackDueToOverride: window.disableCDNFallbackDueToOverride
            }
        }

        function createScript(src, onError, onLoad) {
            var scriptEl = document.createElement("script");
            scriptEl.src = src;
            scriptEl.onerror=onError;
            scriptEl.onload=onLoad;
            scriptEl.crossorigin = true;

            document.head.appendChild(scriptEl);
        }

        function createStylesheet(href, onError, onLoad) {
            var styleEl = document.createElement("link");
            styleEl.href = href;
            styleEl.rel = 'stylesheet';
            styleEl.type = "text/css";
            styleEl.onerror=onError;
            styleEl.onload=onLoad;
            styleEl.crossorigin = true;

            document.head.appendChild(styleEl);
        }

        window.tryFallbackToNextCDN = function tryFallbackToNextCDN(bundleName, onFail, onLoad, previousCDNUrl) {
            if (window.disableCDNFallbackDueToOverride) {
                onFail();
                return;
            }
            // if previousCDN URL doesn't match current cdnURL, try to load again without setting setNextCdnUrl to the next value
            var hasAnotherFallback = window.cdnUrl !== previousCDNUrl ? true : window.setNextCdnUrl();
            createScript(window.cdnURL + bundleName, hasAnotherFallback ? tryFallbackToNextCDN.bind(this, bundleName, onFail, onLoad, window.cdnUrl) : onFail, onLoad);
        }
        window.tryFallbackToNextCDNStylesheet = function tryFallbackToNextCDNStylesheet(stylesheetName, onFail, onLoad, previousCDNUrl) {
            if (window.disableCDNFallbackDueToOverride) {
                onFail();
                return;
            }
            // if previousCDN URL doesn't match current cdnURL, try to load again without setting setNextCdnUrl to the next value
            var hasAnotherFallback = window.cdnUrl !== previousCDNUrl ? true : window.setNextCdnUrl();
            createStylesheet(window.cdnURL + stylesheetName, hasAnotherFallback ? tryFallbackToNextCDNStylesheet.bind(this, stylesheetName, onFail, onLoad, window.cdnUrl) : onFail, onLoad);
        }
    })();

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a legitimate error handling and reporting mechanism. It displays an error message to the user and sends a monitoring event to a trusted domain (docucdn-a.akamaihd.net) using the `sendBeacon` API. While the use of `sendBeacon` to transmit data to an external domain is a moderate-risk indicator, the overall behavior and context suggest this is a benign script with no clear malicious intent."
}

                window.DSSigningShowRetry = function (description, errorMessage) {
                    document.body.innerHTML = [
                        '<link rel="stylesheet" type="text/css" href="//docucdn-a.akamaihd.net/olive/latest/css/olive.min.css" />',
                        '<div class="emptyState">',
                        '<i class="icon icon-alert emptyState_icon text-alert"></i>',
                        '<h1 class="p-top-x-small" data-qa="app-load-title">Unable to start signing process</h1>',
                        '<p class="emptyState_text">Please try again.</p>',
                        '<a href="javascript:window.location.reload(true)" class="btn btn-secondary" data-qa="app-load-retry">Retry</a>',
                        '</div>'
                    ].join('');
                    try {
                        window.navigator.sendBeacon(
                            'monitoring?ti=0ad76c2732f84028a6a7c2f993b05b52',
                            JSON.stringify({
                                EventSource: 'AppEvent',
                                MonitoringProperties: Object.assign({
                                    Description: 'ViewSigningPageError' + (description ? '-' + description : ''),
                                    Duration: +(new Date()) - window.DS_PAGE_LOADED_TIME,
                                    Reason: errorMessage
                                }, window.getCDNMonitoringProps ? window.getCDNMonitoringProps() : {})
                            })
                        );
                    } catch (ex) { }
                }
            

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript snippet appears to be a polyfill for the `navigator.sendBeacon()` API, which is a standard feature used for sending analytics or telemetry data to external servers. While the code uses the `XMLHttpRequest` object, which can be considered a legacy practice, it is not inherently malicious and is likely used for a legitimate purpose. The second part of the code checks the user's browser version and compatibility, which is also a common practice to ensure the application works correctly. Overall, the script demonstrates low-risk behaviors and is likely part of a larger application with a legitimate purpose."
}

            
                    (function () {
                        
                        function sendBeacon(url, data) {
                            
                                var event = this.event && this.event.type;
                            var sync = event === 'unload' || event === 'beforeunload';
                            //var xhr = (window.XMLHttpRequest) ? new XMLHttpRequest() : new ActiveXObject('Microsoft.XMLHTTP');
                            var xhr = new XMLHttpRequest()
                            xhr.open('POST', url, !sync);
                            xhr.withCredentials = true;
                            xhr.setRequestHeader('Accept', '*/*');
                            if (typeof data === 'string') {
                                xhr.setRequestHeader('Content-Type', 'text/plain;charset=UTF-8');
                                xhr.responseType = 'text/plain';
                            } else if (data instanceof Blob && data.type) {
                                xhr.setRequestHeader('Content-Type', data.type);
                            }
                            try {
                                xhr.send(data);
                            } catch (error) {
                                return false;
                            }
                            return true;
                        }

                        if (!window.navigator.sendBeacon) {
                            window.navigator.sendBeacon = sendBeacon;
                        }
                    })();
            

        (function () {
            window.suggestedLogicalSession = 'f1162850-dcfe-4fde-9e87-a24d93a62651';
            var minAllowableIEVersion = 12;
            var isUnsupportedBrowser = false;
            var compatibility = false;
            var browserVersion;
            var trueVersion;
            var unsupportedReason = "Unknown";
            if (window.navigator != null && document.querySelectorAll != null) {
                var uaString = window.navigator.userAgent;
                var msieVersion = uaString.match(/MSIE ([1]?[0-9])\.0/i);
                if (msieVersion && msieVersion[1]) {
                    browserVersion = msieVersion[1];
                } else if (uaString.indexOf("Trident") !== -1 && uaString.indexOf("rv:11") !== -1) {
                    browserVersion = 11;
                }
                var trident = navigator.userAgent.match(/Trident\/(\d+)/);
                if (trident) trueVersion = parseInt(trident[1], 10) + 4;

                compatibility = (trueVersion && browserVersion && trueVersion != browserVersion);
                isUnsupportedBrowser = browserVersion && browserVersion < minAllowableIEVersion;
                if (isUnsupportedBrowser)
                    unsupportedReason = "old browser version"
            } else {
                isUnsupportedBrowser = true;
                if (true) {
                    if (window.navigator == null && document.querySelectorAll != null) {
                        unsupportedReason = 'window.navigator = null';
                    } else if (window.navigator != null && document.querySelectorAll == null) {
                        unsupportedReason = 'document.querySelectorAll = null';
                    } else {
                        unsupportedReason = 'window.navigator = null and document.querySelectorAll = null';
                    }
                } else {
                    unsupportedReason = 'window.navigator = null [' + (window.navigator == null) + '], document.querySelectorAll = null [' + (document.querySelectorAll == null) + ']';
                }
            }

            if (isUnsupportedBrowser) {
                var redirectPath;
                if (true) {
                    if (window.navigator != null && document.querySelectorAll != null) {
                        redirectPath = '/signing/error/unsupportedbrowser?ti=0ad76c2732f84028a6a7c2f993b05b52&unsupportedReason=OldBrowser';

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a legitimate implementation of an exit event tracking mechanism. It uses the `sendBeacon` API to send a monitoring event to a specific URL when the user exits the page. The data being sent includes general information like the event source, session duration, and client user agent, which is typical for analytics or telemetry purposes. While the script uses the `sendBeacon` API, which is considered a moderate-risk indicator, the overall behavior and context suggest this is a benign implementation with no clear malicious intent. The risk score is low due to the transparent and common use case of the script."
}

            function sendExitLogEvent() {
                window.navigator.sendBeacon(
                    'monitoring?ti=0ad76c2732f84028a6a7c2f993b05b52',
                    JSON.stringify({
                        EventSource: 'AppEvent',
                        MonitoringProperties: {
                            Description: 'SigningAppBrowserExit',
                            SessionDuration: +(new Date()) - window.DS_PAGE_LOADED_TIME,
                            ClientUserAgent: window.navigator.userAgent
                        }
                    })
                );
            };
            
                function getExitEvent() {
                    switch (true) {
                        case /MSIE|Trident.*rv:/.test(navigator.userAgent):
                            return 'beforeunload';
                        case /iPad|iPhone|iPod/i.test(navigator.userAgent):
                            return 'pagehide';
                        default:
                            return 'unload';
                    }
                };
            
                (function () {
                    var exitEvent = getExitEvent();
                    switch (exitEvent) {
                        case "beforeunload":
                            window.onbeforeunload = sendExitLogEvent;
                            break;
                        default:
                            window.addEventListener(exitEvent, sendExitLogEvent, false);
                            break;
                    }
                })();
        

```json
{
    "risk_score": 1,
    "reasoning": "The script is a modified version of the Mixpanel JS Library, primarily used for analytics. It does not exhibit high-risk behaviors such as dynamic code execution or data exfiltration. The script mentions the removal of sensitive information transmission, indicating a focus on privacy. It uses standard analytics practices without malicious indicators."
}

/*
 * DocuSign modified version of Mixpanel JS Library v2.2.1
 * $initial_referer and $referer have been removed, as not to send any senstive information
 * $initial_referring_domain and referring_domain have been retained.
 *
 * Mixpanel JS Library v2.2.1
 *
 *
 * Copyright 2012, Mixpanel, Inc. All Rights Reserved
 * http://mixpanel.com/
 *
 * Includes portions of Underscore.js
 * http://documentcloud.github.com/underscore/
 * (c) 2011 Jeremy Ashkenas, DocumentCloud Inc.
 * Released under the MIT License.
 */

// ==ClosureCompiler==
// @compilation_level ADVANCED_OPTIMIZATIONS
// @output_file_name mixpanel-2.2.min.js
// ==/ClosureCompiler==

/*
Will export window.mixpanel
*/

/*
SIMPLE STYLE GUIDE:

this.x == public function
this._x == internal - only use within this file
this.__x == private - only use within the class

Globals should be all caps
*/
(function(mixpanel) {
    /*
 * Saved references to long variable names, so that closure compiler can
 * minimize file size.
 */
    var ArrayProto = Array.prototype,
        ObjProto = Object.prototype,
        slice = ArrayProto.slice,
        toString = ObjProto.toString,
        hasOwnProperty = ObjProto.hasOwnProperty,
        windowConsole = window.console,
        navigator = window.navigator,
        document = window.document,
        userAgent = navigator.userAgent;

    /*
 * Constants
 */
    /** @const */ var PRIMARY_INSTANCE_NAME = "mixpanel",
        /** @const */ SET_QUEUE_KEY = "__mps",
        /** @const */ SET_ONCE_QUEUE_KEY = "__mpso",
        /** @const */ ADD_QUEUE_KEY = "__mpa",
        /** @const */ APPEND_QUEUE_KEY = "__mpap",
        /** @const */ SET_ACTION = "$set",
        /** @const */ SET_ONCE_ACTION = "$set_once",
        /** @const */ ADD_ACTION = "$add",
        /** @const */ APPEND_ACTION = "$append",
        // This key is deprecated, but we want to check for it to see whether aliasing is allowed.
        /** @const */ PEOPLE_DISTINCT_ID_KEY = "$people_distinct_id",
        /** @const */ ALIAS_ID_KEY = "__alias",
        /** @const */ RESERVED_PROPERTIES = [
            SET_QUEUE_KEY,
            SET_ONCE_QUEUE_KEY,
            ADD_QUEUE_KEY,
            APPEND_QUEUE_KEY,
            PEOPLE_DISTINCT_ID_KEY,
            ALIAS_ID_KEY
        ];

    /*
 * Dynamic... constants? Is that an oxymoron?
 */
    var HTTP_PROTOCOL =
            "https:" == document.location.protocol ? "https://" : "http://",
        SNIPPET_VERSION = (mixpanel && mixpanel["__SV"]) || 0,
        // http://hacks.mozilla.org/2009/07/cross-site-xmlhttprequest-with-cors/
        // https://developer.mozilla.org/en-US/docs/DOM/XMLHttpRequest#withCredentials
        USE_XHR =
            window.XMLHttpRequest && "withCredentials" in new XMLHttpRequest(),
        // IE<10 does not support cross-origin XHR's but script tags
        // with defer won't block window.onload; ENQUEUE_REQUESTS
        // should only be true for Opera<12
        ENQUEUE_REQUESTS = !USE_XHR && userAgent.indexOf("MSIE") == -1;

    /*
 * Closure-level globals
 */
    var _ = {},
        DEBUG = false,
        DEFAULT_CONFIG = {
            api_host: HTTP_PROTOCOL + "api.mixpanel.com",
            cross_subdomain_cookie: false,
            cookie_name: "",
            loaded: function() {},
            store_google: true,
            save_referrer: true,
            test: false,
            verbose: false,
            img: false,
            track_pageview: true,
            debug: false,
            track_links_timeout: 300,
            cookie_expiration: 365,
            upgrade: false,
            disable_cookie: false,
            secure_cookie: true,
            ip: true
        },
        DOM_LOADED = false;

    // UNDERSCORE
    // Embed part of the Underscore Library

    (function() {
        var nativeForEach = ArrayProto.forEach,
            nativeIndexOf = ArrayProto.indexOf,
            nativeIsArray = Array.isArray,
            breaker = {};

        /**
         * @param {*=} obj
         * @pa

{
  "contains_trigger_text": true,
  "trigger_text": "Please read the Electronic Record and Signature Disclosure",
  "prominent_button_name": "CONTINUE",
  "text_input_field_labels": [
    "Organization Name",
    "Additional Name",
    "TWC Tax Account Number",
    "Service Representative Company Name",
    "Mailing Address",
    "City",
    "State",
    "Zip Code",
    "Telephone Number",
    "Fax Number",
    "Contact Person",
    "Telephone Number"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Paychex, Inc.",
    "Rowmark LLC"
  ]
}

```json{  "legit_domain": "docusign.com",  "classification": "wellknown",  "reasons": [    "The URL 'na2.docusign.net' is a subdomain of 'docusign.net', which is associated with DocuSign, a well-known brand.",    "The brand 'Paychex, Inc.' is not directly associated with the domain 'docusign.net'.",    "DocuSign is a well-known electronic signature service provider, and the URL structure suggests it is a legitimate subdomain.",    "The presence of input fields related to tax and organization information could be legitimate if the service is being used for document signing by Paychex, but it is unusual for DocuSign to host such specific brand-related forms without clear branding.",    "There is no direct match between the brand 'Paychex, Inc.' and the domain 'docusign.net', which raises suspicion."  ],  "riskscore": 6}

URL: na2.docusign.net
			Brands: Paychex, Inc.
			Input Fields: Organization Name, Additional Name, TWC Tax Account Number, Service Representative Company Name, Mailing Address, City, State, Zip Code, Telephone Number, Fax Number, Contact Person, Telephone Number

{
  "contains_trigger_text": true,
  "trigger_text": "Please read the Electronic Record and Signature Disclosure",
  "prominent_button_name": "CONTINUE",
  "text_input_field_labels": [
    "Organization Name",
    "Additional Name",
    "TWC Tax Account Number",
    "Service Representative Company Name",
    "Mailing Address",
    "City",
    "State",
    "Zip Code",
    "Telephone Number",
    "Fax Number",
    "Contact Person",
    "Telephone Number"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Paychex, Inc.",
    "Rowmark LLC"
  ]
}

```json{  "legit_domain": "docusign.com",  "classification": "wellknown",  "reasons": [    "The URL 'na2.docusign.net' is a subdomain of 'docusign.com', which is a well-known and legitimate domain associated with DocuSign.",    "The brand 'Paychex, Inc.' is not directly associated with the domain 'docusign.net'.",    "DocuSign is a well-known brand, and the domain matches the legitimate domain for DocuSign services.",    "The presence of Paychex-related input fields on a DocuSign subdomain could indicate a legitimate use case where Paychex is using DocuSign services for document signing.",    "No suspicious elements such as misspellings or unusual domain extensions are present in the URL."  ],  "riskscore": 3}

URL: na2.docusign.net
			Brands: Paychex, Inc.
			Input Fields: Organization Name, Additional Name, TWC Tax Account Number, Service Representative Company Name, Mailing Address, City, State, Zip Code, Telephone Number, Fax Number, Contact Person, Telephone Number