26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T43e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 1bc77b013c83… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1bc77b013c83…. Threat score 100/100. 9/24 AV engines flagged this file. 2 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f"],"about":{"@type":"SoftwareApplication","name":"what_is_an_open_book_agreement 67938.js","applicationCategory":["script","javascript"],"identifier":"1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":9,"total":24},"behavioralIndicators":{"malicious":2,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5336,"// Support: Firefox 64+, Edge 18+ // Some browsers don't support the "nonce" property on scripts. // On the other hand, just using `getAttribute` is not enough as // the `nonce` attribute is reset to an empty string whenever it // becomes browsing-context connected. // See https://github.com/whatwg/html/issues/2369 // See https://html.spec.whatwg.org/#nonce-attributes // The `node.getAttribute` check was added for the sake of // `jQuery.globalEval` so that it can fake a nonce-containing node // via an object. val = node[ i ] || node.getAttribute && node.getAttribute( i ); if ( val ) { script.setAttribute( i, val ); } } } doc.head.appendChild( script ).parentNode.removeChild( script ); } function toType( obj ) { if ( obj == null ) { return obj + ""; } // Support: Android <=2.3 only (functionish RegExp) return typeof obj === "object" || typeof obj === "function" ? class2type[ toString.call( obj ) ] || "object" : typeof obj; } /* global" (Indicator: "connect") in Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin "Symbol */ // Defining this global in .eslintrc.json would create a danger of using the global // unguarded in another place, it seems safer to define global only for this module var version = "3.6.0", // Define a local copy of jQuery jQuery = function( selector, context ) { // The jQuery object is actually just the init constructor 'enhanced' // Need init if jQuery is called (just allow error to be thrown if not included) return new jQuery.fn.init( selector, context ); }; jQuery.fn = jQuery.prototype = { // The current version of jQuery being used jquery: version, constructor: jQuery, // The default length of a jQuery object is 0 length: 0, toArray: function() { return slice.call( this ); }, // Get the Nth element in the matched element set OR // Get the whole matched element set as a clean array get: function( num ) { // Return all the elements in a clean array if ( num == null ) { return slice.call( this ); } // Return just the one element from the set return" (Indicator: "select") in Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin "{ // Support: real iOS 8.2 only (not reproducible in simulator) // `in` check used to prevent JIT error (gh-2145) // hasOwn isn't used here due to false negatives // regarding Nodelist length in IE var length = !!obj && "length" in obj && obj.length, type = toType( obj ); if ( isFunction( obj ) || isWindow( obj ) ) { return false; } return type === "array" || length === 0 || typeof length === "number" && length > 0 && ( length - 1 ) in obj; } var Sizzle = /*! * Sizzle CSS Selector Engine v2.3.6 * https://sizzlejs.com/ * * Copyright JS Foundation and other contributors * Released under the MIT license * https://js.foundation/ * * Date: 2021-02-16 */ ( function( window ) { var i, support, Expr, getText, isXML, tokenize, compile, select, outermostContext, sortInput, hasDuplicate, // Local document vars setDocument, document, docElem, documentIsHTML, rbuggyQSA, rbuggyMatches, matches, contains, // Instance-specific data expando = "sizzle" + 1 * new Date(), preferr" (Indicator: "select") in Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin "edDoc = window.document, dirruns = 0, done = 0, classCache = createCache(), tokenCache = createCache(), compilerCache = createCache(), nonnativeSelectorCache = createCache(), sortOrder = function( a, b ) { if ( a === b ) { hasDuplicate = true; } return 0; }, // Instance methods hasOwn = ( {} ).hasOwnProperty, arr = [], pop = arr.pop, pushNative = arr.push, push = arr.push, slice = arr.slice, // Use a stripped-down indexOf as it's faster than native // https://jsperf.com/thor-indexof-vs-for/5 indexOf = function( list, elem ) { var i = 0, len = list.length; for ( ; i < len; i++ ) { if ( list[ i ] === elem ) { return i; } } return -1; }, booleans = "checked|selected|async|autofocus|autoplay|controls|defer|disabled|hidden|" + "ismap|loop|multiple|open|readonly|required|scoped", // Regular expressions // http://www.w3.org/TR/css3-selectors/#whitespace whitespace = "[\\x20\\t\\r\\n\\f]", // https://www.w3.org/TR/css-syntax-3/#ident-token-diagram identif" (Indicator: "open") in Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin "ier = "(?:\\\\[\\da-fA-F]{1,6}" + whitespace + "?|\\\\[^\\r\\n\\f]|[\\w-]|[^\0-\\x7f])+", // Attribute selectors: http://www.w3.org/TR/selectors/#attribute-selectors attributes = "\\[" + whitespace + "*(" + identifier + ")(?:" + whitespace + // Operator (capture 2) "*([*^$|!~]?=)" + whitespace + // "Attribute values must be CSS identifiers [capture 5] // or strings [capture 3 or capture 4]" "*(?:'((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\"|(" + identifier + "))|)" + whitespace + "*\\]" pseudos = ":(" + identifier + ")(?:\$(" + // To reduce the number of selectors needing tokenize in the preFilter prefer arguments: // 1. quoted (capture 3; capture 4 or capture 5) "('((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\")|" + // 2. simple (capture 6) "((?:\\\\.|[^\\\\()[\\]]|" + attributes + ")*)|" + // 3. anything else (capture 2) ".*" + ")\$|)" // Leading and non-escaped trailing whitespace capturing some non-whitespace characters preceding the latter rwhitesp" (Indicator: "select") in Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin, "We use this for POS matching in `select` "needsContext": new RegExp( "^" + whitespace + "*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?:\$" + whitespace + "*((?:-\\d)?\\d*)" + whitespace + "*\$|)(?=[^-]|$)", "i" ) }, rhtml = /HTML$/i, rinputs = /^(?:input|select|textarea|button)$/i, rheader = /^h\d$/i, rnative = /^[^{]+\{\s*\[native \w/, // Easily-parseable/retrievable ID or TAG or CLASS selectors rquickExpr = /^(?:#([\w-]+)|(\w+)|\.([\w-]+))$/, rsibling = /[+~]/, // CSS escapes // http://www.w3.org/TR/CSS21/syndata.html#escaped-characters runescape = new RegExp( "\\\\[\\da-fA-F]{1 6}" + whitespace + "?|\\\\([^\\r\\n\\f])", "g" ), funescape = function( escape, nonHex ) { var high = "0x" + escape.slice( 1 ) - 0x10000; return nonHex ? // Strip the backslash prefix from a non-hex escape sequence nonHex : // Replace a hexadecimal escape sequence with the encoded Unicode code point // Support: IE <=11+ // For values outside the Basic Multilingual Plane (BMP), manuall" (Indicator: "select") in Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin "m ) { return elem.disabled === true && elem.nodeName.toLowerCase() === "fieldset"; }, { dir: "parentNode", next: "legend" } ); // Optimize for push.apply( _, NodeList ) try { push.apply( ( arr = slice.call( preferredDoc.childNodes ) ), preferredDoc.childNodes ); // Support: Android<4.0 // Detect silently failing push.apply // eslint-disable-next-line no-unused-expressions arr[ preferredDoc.childNodes.length ].nodeType; } catch ( e ) { push = { apply: arr.length ? // Leverage slice if possible function( target, els ) { pushNative.apply( target, slice.call( els ) ); } : // Support: IE<9 // Otherwise append directly function( target, els ) { var j = target.length, i = 0; // Can't trust NodeList.length while ( ( target[ j++ ] = els[ i++ ] ) ) {} target.length = j - 1; } }; } function Sizzle( selector, context, results, seed ) { var m, i, elem, nid, match, groups, newSelector, newContext = context && context.ownerDocument, // nodeType defaults to 9," (Indicator: "select") in Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin "since context defaults to document nodeType = context ? context.nodeType : 9; results = results || []; // Return early from calls with invalid selector or context if ( typeof selector !== "string" || !selector || nodeType !== 1 && nodeType !== 9 && nodeType !== 11 ) { return results; } // Try to shortcut find operations (as opposed to filters) in HTML documents if ( !seed ) { setDocument( context ); context = context || document; if ( documentIsHTML ) { // If the selector is sufficiently simple, try using a "get*By*" DOM method // (excepting DocumentFragment context, where the methods don't exist) if ( nodeType !== 11 && ( match = rquickExpr.exec( selector ) ) ) { // ID selector if ( ( m = match[ 1 ] ) ) { // Document context if ( nodeType === 9 ) { if ( ( elem = context.getElementById( m ) ) ) { // Support: IE, Opera, Webkit // TODO: identify versions // getElementById can match elements by name instead of ID if ( elem.id" (Indicator: "select") in Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin "=== m ) { results.push( elem ); return results; } } else { return results; } // Element context } else { // Support: IE, Opera, Webkit // TODO: identify versions // getElementById can match elements by name instead of ID if ( newContext && ( elem = newContext.getElementById( m ) ) && contains( context, elem ) && elem.id === m ) { results.push( elem ); return results; } } // Type selector } else if ( match[ 2 ] ) { push.apply( results, context.getElementsByTagName( selector ) ); return results; // Class selector } else if ( ( m = match[ 3 ] ) && support.getElementsByClassName && context.getElementsByClassName ) { push.apply( results, context.getElementsByClassName( m ) ); return results; } } // Take advantage of querySelectorAll if ( support.qsa && !nonnativeSelectorCache[ selector + " " ] && ( !rbuggyQSA || !rbuggyQSA.test( sel" (Indicator: "select") in Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin "ector ) ) && // Support: IE 8 only // Exclude object elements ( nodeType !== 1 || context.nodeName.toLowerCase() !== "object" ) ) { newSelector = selector; newContext = context; // qSA considers elements outside a scoping root when evaluating child or // descendant combinators, which is not what we want. // In such cases, we work around the behavior by prefixing every selector in the // list with an ID selector referencing the scope context. // The technique has to be used as well when a leading combinator is used // as such selectors are not recognized by querySelectorAll. // Thanks to Andrew Dupont for this technique. if ( nodeType === 1 && ( rdescend.test( selector ) || rcombinators.test( selector ) ) ) { // Expand context for sibling selectors newContext = rsibling.test( selector ) && testContext( context.parentNode ) || context; // We can use :scope instead of the ID hack if the browser // supports it & if we're not c" (Indicator: "select") in Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin "hanging the context. if ( newContext !== context || !support.scope ) { // Capture the context ID, setting it first if necessary if ( ( nid = context.getAttribute( "id" ) ) ) { nid = nid.replace( rcssescape, fcssescape ); } else { context.setAttribute( "id", ( nid = expando ) ); } } // Prefix every selector in the list groups = tokenize( selector ); i = groups.length; while ( i-- ) { groups[ i ] = ( nid ? "#" + nid : ":scope" ) + " " + toSelector( groups[ i ] ); } newSelector = groups.join( " " ); } try { push.apply( results, newContext.querySelectorAll( newSelector ) ); return results; } catch ( qsaError ) { nonnativeSelectorCache( selector, true ); } finally { if ( nid === expando ) { context.removeAttribute( "id" ); } } } } } // All others return select( selector.replace( rtrim, "$1" ), context, results, seed ); } /** * Create key-value caches" (Indicator: "select") in Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin "} } } return a ? 1 : -1; } /** * Returns a function to use in pseudos for input types * @param {String} type */ function createInputPseudo( type ) { return function( elem ) { var name = elem.nodeName.toLowerCase(); return name === "input" && elem.type === type; }; } /** * Returns a function to use in pseudos for buttons * @param {String} type */ function createButtonPseudo( type ) { return function( elem ) { var name = elem.nodeName.toLowerCase(); return ( name === "input" || name === "button" ) && elem.type === type; }; } /** * Returns a function to use in pseudos for :enabled/:disabled * @param {Boolean} disabled true for :disabled; false for :enabled */ function createDisabledPseudo( disabled ) { // Known :disabled false positives: fieldset[disabled] > legend:nth-of-type(n+2) :can-disable return function( elem ) { // Only certain elements can match :enabled or :disabled // https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled // https://html.spec.wh" (Indicator: "select") in Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin "atwg.org/multipage/scripting.html#selector-disabled if ( "form" in elem ) { // Check for inherited disabledness on relevant non-disabled elements: // * listed form-associated elements in a disabled fieldset // https://html.spec.whatwg.org/multipage/forms.html#category-listed // https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled // * option elements in a disabled optgroup // https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled // All such elements have a "form" property. if ( elem.parentNode && elem.disabled === false ) { // Option elements defer to a parent optgroup if present if ( "label" in elem ) { if ( "label" in elem.parentNode ) { return elem.parentNode.disabled === disabled; } else { return elem.disabled === disabled; } } // Support: IE 6 - 11 // Use the isDisabled shortcut property to check for disabled fieldset ancestors return elem.isDisabled === disabled || // Where th" (Indicator: "select") in Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin "ed variables once based on the current document * @param {Element|Object} [doc] An element or document object to use to set the document * @returns {Object} Returns the current document */ setDocument = Sizzle.setDocument = function( node ) { var hasCompare, subWindow, doc = node ? node.ownerDocument || node : preferredDoc; // Return early if doc is invalid or already selected // Support: IE 11+, Edge 17 - 18+ // IE/Edge sometimes throw a "Permission denied" error when strict-comparing // two documents; shallow comparisons work. // eslint-disable-next-line eqeqeq if ( doc == document || doc.nodeType !== 9 || !doc.documentElement ) { return document; } // Update global variables document = doc; docElem = document.documentElement; documentIsHTML = !isXML( document ); // Support: IE 9 - 11+, Edge 12 - 18+ // Accessing iframe documents after unload throws "permission denied" errors (jQuery #13936) // Support: IE 11+, Edge 17 - 18+ // IE/Edge sometimes throw a "Permission denied" error wh" (Indicator: "select") in Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin ".jquery.com/ticket/13378 rbuggyQSA = []; if ( ( support.qsa = rnative.test( document.querySelectorAll ) ) ) { // Build QSA regex // Regex strategy adopted from Diego Perini assert( function( el ) { var input; // Select is set to empty string on purpose // This is to test IE's treatment of not explicitly // setting a boolean content attribute, // since its presence should be enough // https://bugs.jquery.com/ticket/12359 docElem.appendChild( el ).innerHTML = "" + ""; // Support: IE8, Opera 11-12.16 // Nothing should be selected when empty strings follow ^= or $= or *= // The test attribute must be unknown in Opera but "safe" for WinRT // https://msdn.microsoft.com/en-us/library/ie/hh465388.aspx#attribute_section if ( el.querySelectorAll( "[msallowcapture^='']" ).length ) { rbuggyQSA.push( "[*^$]=" + whitespace + "*(?:''|\"\")" );" (Indicator: "select") in Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin "} // Support: IE8 // Boolean attributes and "value" are not treated correctly if ( !el.querySelectorAll( "[selected]" ).length ) { rbuggyQSA.push( "\\[" + whitespace + "*(?:value|" + booleans + ")" ); } // Support: Chrome<29, Android<4.4, Safari<7.0+, iOS<7.0+, PhantomJS<1.9.8+ if ( !el.querySelectorAll( "[id~=" + expando + "-]" ).length ) { rbuggyQSA.push( "~=" ); } // Support: IE 11+, Edge 15 - 18+ // IE 11/Edge don't find elements on a `[name='']` query in some cases. // Adding a temporary attribute to the document before the selection works // around the issue. // Interestingly, IE 10 & older don't seem to have the issue. input = document.createElement( "input" ); input.setAttribute( "name", "" ); el.appendChild( input ); if ( !el.querySelectorAll( "[name='']" ).length ) { rbuggyQSA.push( "\\[" + whitespace + "*name" + whitespace + "*=" + whitespace + "*(?:''|\"\")" ); } // Webkit/Opera - :checked should return selected option" (Indicator: "select") in Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin "elements // http://www.w3.org/TR/2011/REC-css3-selectors-20110929/#checked // IE8 throws error here and will not see later tests if ( !el.querySelectorAll( ":checked" ).length ) { rbuggyQSA.push( ":checked" ); } // Support: Safari 8+, iOS 8+ // https://bugs.webkit.org/show_bug.cgi?id=136851 // In-page `selector#id sibling-combinator selector` fails if ( !el.querySelectorAll( "a#" + expando + "+*" ).length ) { rbuggyQSA.push( ".#.+[+~]" ); } // Support: Firefox <=3.6 - 5 only // Old Firefox doesn't throw on a badly-escaped identifier. el.querySelectorAll( "\\\f" ); rbuggyQSA.push( "[\\r\\n\\f]" ); } ); assert( function( el ) { el.innerHTML = "" + ""; // Support: Windows 8 Native Apps // The type and name attributes are restricted during .innerHTML assignment var input = document.createElement( "input" ); input.setAttribute( "type", "hidden" ); el.appendCh" (Indicator: "select") in Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin "ild( input ).setAttribute( "name", "D" ); // Support: IE8 // Enforce case-sensitivity of name attribute if ( el.querySelectorAll( "[name=d]" ).length ) { rbuggyQSA.push( "name" + whitespace + "*[*^$|!~]?=" ); } // FF 3.5 - :enabled/:disabled and hidden elements (hidden elements are still enabled) // IE8 throws error here and will not see later tests if ( el.querySelectorAll( ":enabled" ).length !== 2 ) { rbuggyQSA.push( ":enabled", ":disabled" ); } // Support: IE9-11+ // IE's :disabled selector does not pick up the children of disabled fieldsets docElem.appendChild( el ).disabled = true; if ( el.querySelectorAll( ":disabled" ).length !== 2 ) { rbuggyQSA.push( ":enabled", ":disabled" ); } // Support: Opera 10 - 11 only // Opera 10-11 does not throw on post-comma invalid pseudos el.querySelectorAll( "* :x" ); rbuggyQSA.push( " .*:" ); } ); } if ( ( support.matchesSelector = rnative.test( ( matches = docElem.matches || docElem.webkitMatche" (Indicator: "select") in Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin "sSelector || docElem.mozMatchesSelector || docElem.oMatchesSelector || docElem.msMatchesSelector ) ) ) ) { assert( function( el ) { // Check to see if it's possible to do matchesSelector // on a disconnected node (IE 9) support.disconnectedMatch = matches.call( el, "*" ); // This should fail with an exception // Gecko does not error, returns false instead matches.call( el, "[s!='']:x" ); rbuggyMatches.push( "!=", pseudos ); } ); } rbuggyQSA = rbuggyQSA.length && new RegExp( rbuggyQSA.join( "|" ) ); rbuggyMatches = rbuggyMatches.length && new RegExp( rbuggyMatches.join( "|" ) ); /* Contains ---------------------------------------------------------------------- */ hasCompare = rnative.test( docElem.compareDocumentPosition ); // Element contains another // Purposefully self-exclusive // As in, an element does not contain itself contains = hasCompare || rnative.test( docElem.contains ) ? function( a, b ) { var adown = a.nodeType === 9 ? a.documentElement : a," (Indicator: "connect") in Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin "shallow comparisons work. // eslint-disable-next-line eqeqeq compare = ( a.ownerDocument || a ) == ( b.ownerDocument || b ) ? a.compareDocumentPosition( b ) : // Otherwise we know they are disconnected 1; // Disconnected nodes if ( compare & 1 || ( !support.sortDetached && b.compareDocumentPosition( a ) === compare ) ) { // Choose the first element that is related to our preferred document // Support: IE 11+, Edge 17 - 18+ // IE/Edge sometimes throw a "Permission denied" error when strict-comparing // two documents; shallow comparisons work. // eslint-disable-next-line eqeqeq if ( a == document || a.ownerDocument == preferredDoc && contains( preferredDoc, a ) ) { return -1; } // Support: IE 11+, Edge 17 - 18+ // IE/Edge sometimes throw a "Permission denied" error when strict-comparing // two documents; shallow comparisons work. // eslint-disable-next-line eqeqeq if ( b == document || b.ownerDocument == preferredDoc && contains( preferredD" (Indicator: "connect") in Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin28:T100e,Output: "/*! * jQuery JavaScript Library v3.6.0 * https://jquery.com/ * * Includes Sizzle.js * https://sizzlejs.com/ * * Copyright OpenJS Foundation and other contributors * Released under the MIT license * https://jquery.org/license * * Date: 2021-03-02T17:08Z */ (function(global, factory) { "use strict"; if (typeof module === "object" && typeof module.exports === "object") { // For CommonJS and CommonJS-like environments where a proper `window` // is present, execute the factory and get jQuery. // For environments that do not have a `window` with a `document` // (such as Node.js), expose a factory as module.exports. // This accentuates the need for the creation of a real `window`. // e.g. var jQuery = require("jquery")(window); // See ticket #14549 for more info. module.exports = global.document ? factory(global, true) : function(w) { if (!w.document) { throw new Error("jQuery requires a window with a document"); } return factory(w); }; } else { factory(global); } // Pass this if window is not defined yet })(typeof window !== "undefined" ? window : this, function(window, noGlobal) { // Edge <= 12 - 13+, Firefox <=18 - 45+, IE 10 - 11, Safari 5.1 - 9+, iOS 6 - 9.1 // throw exceptions when non-strict code (e.g., ASP.NET 4.5) accesses strict mode // arguments.callee.caller (trac-13335). But as of jQuery 3.0 (2016), strict mode should be common // enough that all such attempts are guarded in a try block. "use strict"; var arr = []; var getProto = Object.getPrototypeOf; var slice = arr.slice; var flat = arr.flat ? function(array) { return arr.flat.call(array); } : function(array) { return arr.concat.apply([], array); }; var push = arr.push; var indexOf = arr.indexOf; var class2type = {}; var toString = class2type.toString; var hasOwn = class2type.hasOwnProperty; var fnToString = hasOwn.toString; var ObjectFunctionString = fnToString.call(Object); var support = {}; var isFunction = function isFunction(obj) { // Support: Chrome <=57, Firefox <=52 // In some browsers, typeof returns "function" for HTML <object> elements // (i.e., `typeof document.createElement( "object" ) === "function"`). // We don't want to classify *any* DOM node as a function. // Support: QtWeb <=3.8.5, WebKit <=534.34, wkhtmltopdf tool <=0.12.5 // Plus for old WebKit, typeof returns "function" for HTML collections // (e.g., `typeof document.getElementsByTagName("div") === "function"`). (gh-4756) return typeof obj === "function" && typeof obj.nodeType !== "number" && typeof obj.item !== "function"; }; var isWindow = function isWindow(obj) { return obj != null && obj === obj.window; }; var document = window.document; var preservedScriptAttributes = { type: true, src: true, nonce: true, noModule: true }; function DOMEval(code, node, doc) { doc = doc || document; var i, val, script = doc.createElement("script"); script.text = code; if (node) { for (i in preservedScriptAttributes) { // Support: Firefox 64+, Edge 18+ // Some browsers don't support the "nonce" property on scripts. // On the other hand, just using `getAttribute` is not enough as // the `nonce` attribute is reset to an empty string whenever it // becomes browsing-context connected. // See https://github.com/whatwg/html/issues/2369 // See https://html.spec.whatwg.org/#nonce-attributes // The `node.getAttribute` check was added for the sake of // `jQuery.globalEval` so that it can fak ..."29:T25ba,Pattern match: "https://jquery.com/"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://github.com/whatwg/html/issues/2369"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://sizzlejs.com/"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://jsperf.com/thor-indexof-vs-for/5"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "http://www.w3.org/TR/selectors/#attribute-selectors"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "http://www.w3.org/TR/CSS21/syndata.html#escaped-characters"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://drafts.csswg.org/cssom/#common-serializing-idioms"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Heuristic match: "since context defaults to document nodeType = context ? context.nodeType : 9; results = results || []; // Return early from calls with invalid selector or context if ( typeof selector !== string || !selector || nodeType !== 1 && nodeType !== 9 &"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "atwg.org/multipage/scripting.html#selector-disabled"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://bugs.jquery.com/ticket/4833"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://bugs"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "jquery.com/ticket/13378"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "http://www.w3.org/TR/2011/REC-css3-selectors-20110929/#checked"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://github.com/jquery/sizzle/pull/225"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "http://www.w3.org/TR/selectors/#pseudo-classes"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "http://www.w3.org/TR/selectors/#lang-pseudo"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "http://www.w3.org/TR/selectors/#empty-pseudo"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://msdn.microsoft.com/en-us/library/ms536429%28VS.85%29.aspx"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://promisesaplus.com/#point-59"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://promisesaplus.com/#point-64"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://promisesaplus.com/#point-61"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://promisesaplus.com/#point-57"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://bugs.chromium.org/p/chromium/issues/detail?id=378607"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://bugs.jquery.com/ticket/13393"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://www.w3.org/TR/DOM-Level-3-Events/#event-type-click"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://www.w3.org/TR/2003/WD-DOM-Level-3-Events-20030331/ecma-script-binding.html"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://bugs.chromium.org/p/chromium/issues/detail?id=470258"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://connect.microsoft.com/IE/feedback/details/1736512/"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://jsperf.com/getall-vs-sizzle/2"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://drafts.csswg.org/cssom/#resolved-values"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://developer.mozilla.org/en-US/docs/CSS/display"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://html.spec.whatwg.org/multipage/syntax.html#attributes-2"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript/"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://html.spec.whatwg.org/#strip-and-collapse-whitespace"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://bugzilla.mozilla.org/show_bug.cgi?id=687787"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "http://example.com:80x/"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://bugs.webkit.org/show_bug.cgi?id=137337"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://bugs.webkit.org/show_bug.cgi?id=29084"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://jquery.org/license"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://html.spec.whatwg.org/#nonce-attributes"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://js.foundation/"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "http://www.w3.org/TR/css3-selectors/#whitespace"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://www.w3.org/TR/css-syntax-3/#ident-token-diagram"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://html.spec.whatwg.org/multipage/forms.html#category-listed"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://bugs.jquery.com/ticket/13378"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://bugs.jquery.com/ticket/12359"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://msdn.microsoft.com/en-us/library/ie/hh465388.aspx#attribute_section"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://bugs.webkit.org/show_bug.cgi?id=136851"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://promisesaplus.com/#point-48"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://promisesaplus.com/#point-54"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://promisesaplus.com/#point-75"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "http://www.w3.org/TR/DOM-Level-3-Events/#events-focusevent-event-order"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://bugs.chromium.org/p/chromium/issues/detail?id=449857"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://bugs.chromium.org/p/chromium/issues/detail?id=589347"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin] Pattern match: "https://github.com/jquery/jquery/pull/557"- [Source: 1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f.js.bin]1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791791408071,"unified_at":"2026-10-12T07:50:08.071Z","metadata":{"hashes":{"sha256":"1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f","sha1":"ba567300a0d29024be5e9915b70e51314a402da1","md5":"2797db18134b41a0ad99af69caff1869","sha512":"244ecefd3845f4700d80de21aff6bb28c5fea4a5f4e4baccb0049ffd498039351eaeb3a3796515ce50ef80e5ff632151964f98cb7d577bc2e132fe90f5bd9178","ssdeep":"6144:rJshiVlV+TCtlmhToeKpL9YmD2kK8o1JEjPx+WK+978FyWc8L/dCneeNzIPfTv04:7lL9YmDF00Px+WK+978FyQsR+PfwA+up","ssdeep_chunks":["6144:rJshiVl","6144:JshiVlV","6144:shiVlV+","6144:hiVlV+T","6144:iVlV+TC","6144:VlV+TCt","6144:lV+TCtl","6144:V+TCtlm","6144:+TCtlmh","6144:TCtlmhT","6144:CtlmhTo","6144:tlmhToe","6144:lmhToeK","6144:mhToeKp","6144:hToeKpL","6144:ToeKpL9","6144:oeKpL9Y","6144:eKpL9Ym","6144:KpL9YmD","6144:pL9YmD2","6144:L9YmD2k","6144:9YmD2kK","6144:YmD2kK8","6144:mD2kK8o","6144:D2kK8o1","6144:2kK8o1J","6144:kK8o1JE","6144:K8o1JEj","6144:8o1JEjP","6144:o1JEjPx","6144:1JEjPx+","6144:JEjPx+W","6144:EjPx+WK","6144:jPx+WK+","6144:Px+WK+9","6144:x+WK+97","6144:+WK+978","6144:WK+978F","6144:K+978Fy","6144:+978FyW","6144:978FyWc","6144:78FyWc8","6144:8FyWc8L","6144:FyWc8L/","6144:yWc8L/d","6144:Wc8L/dC","6144:c8L/dCn","6144:8L/dCne","6144:L/dCnee","6144:/dCneeN","6144:dCneeNz","6144:CneeNzI","6144:neeNzIP","6144:eeNzIPf","6144:eNzIPfT","6144:NzIPfTv","6144:zIPfTv0","6144:IPfTv04","12288:rJshiVl","12288:JshiVlV","12288:shiVlV+","12288:hiVlV+T","12288:iVlV+TC","12288:VlV+TCt","12288:lV+TCtl","12288:V+TCtlm","12288:+TCtlmh","12288:TCtlmhT","12288:CtlmhTo","12288:tlmhToe","12288:lmhToeK","12288:mhToeKp","12288:hToeKpL","12288:ToeKpL9","12288:oeKpL9Y","12288:eKpL9Ym","12288:KpL9YmD","12288:pL9YmD2","12288:L9YmD2k","12288:9YmD2kK","12288:YmD2kK8","12288:mD2kK8o","12288:D2kK8o1","12288:2kK8o1J","12288:kK8o1JE","12288:K8o1JEj","12288:8o1JEjP","12288:o1JEjPx","12288:1JEjPx+","12288:JEjPx+W","12288:EjPx+WK","12288:jPx+WK+","12288:Px+WK+9","12288:x+WK+97","12288:+WK+978","12288:WK+978F","12288:K+978Fy","12288:+978FyW","12288:978FyWc","12288:78FyWc8","12288:8FyWc8L","12288:FyWc8L/","12288:yWc8L/d","12288:Wc8L/dC","12288:c8L/dCn","12288:8L/dCne","12288:L/dCnee","12288:/dCneeN","12288:dCneeNz","12288:CneeNzI","12288:neeNzIP","12288:eeNzIPf","12288:eNzIPfT","12288:NzIPfTv","12288:zIPfTv0","12288:IPfTv04","6144:7lL9YmD","6144:lL9YmDF","6144:L9YmDF0","6144:9YmDF00","6144:YmDF00P","6144:mDF00Px","6144:DF00Px+","6144:F00Px+W","6144:00Px+WK","6144:0Px+WK+","6144:+978FyQ","6144:978FyQs","6144:78FyQsR","6144:8FyQsR+","6144:FyQsR+P","6144:yQsR+Pf","6144:QsR+Pfw","6144:sR+PfwA","6144:R+PfwA+","6144:+PfwA+u","6144:PfwA+up"],"imphash":"Unknown"},"file_info":{"file_name":"what_is_an_open_book_agreement 67938.js","file_type":["script","javascript"],"file_type_id":"js","file_size":293164,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1652443054000,"last_seen":1703573404000,"last_multi_scan":1703573404000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["criminal","halfandhalfdownloader","banker","gootkit","infostealer"]},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":4},"sandbox_signatures":{"informative_count":10,"suspicious_count":4,"malicious_count":2,"total":16},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/JS.Tnega","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HTML/ExpKit.Gen2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.49011136","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.49011136 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"JS/TrojanDownloader.Agent.XYD trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!2CAAEF22AFC6C6C7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Script.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"JS/Gootkit-AR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"ABRisk.CJXR-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"suspicious","value":"Executes a java script"}],"sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$27","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"WScript.exe\" touched \"JScript Language\" (Path: \"HKCU\\CLSID\\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\")\n \"WScript.exe\" touched \"Constructor that allows hosts better control creating scriptlets\" (Path: \"HKCU\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]},{"level":"informative","category":"General","name":"Parsed Javascript","description":"$28","origin":"Static Parser","relevance":5,"id":"static-25","sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$29","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"25/59 Antivirus vendors marked sample as malicious (42% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]},{"level":"suspicious","category":"General","name":"Executes a java script","description":"Process \"WScript.exe\" with commandline \"\"C:\\what_is_an_open_book_agreement67938.js\"\" (UID: 00000000-00002868)","origin":"Monitored Target","mitre_attack_id":"T1059.007","relevance":10,"id":"target-167","sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"2.3.3.1\" found in string \"// Support: Promises/A+ sections 2.3.3.1, 3.5\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found decoded Javascript strings","description":"\"radio\"","origin":"File/Memory","relevance":10,"id":"string-33","sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"25/59 Antivirus vendors marked sample as malicious (42% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":41,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["criminal","halfandhalfdownloader","banker","gootkit","infostealer"],"sample_flags":["Sample not shared"],"sandbox_reports":[{"id":"62d6a26972150c48417ea407","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"what_is_an_open_book_agreement 67938.js","analysis_start_time":"2022-07-19T12:24:11+00:00","indicators_count":{"informative":10,"suspicious":4,"malicious":2},"tags":["Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}],"processes":[{"pid":2868,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\what_is_an_open_book_agreement67938.js\"","sha256":"9c8a1b52a638ca87a5e7e60e635a3cbf89b04f5888995f55e2ad3d94ab009b97","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00002868","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAA6ElEQVR42s2WgQrFIAhF/fQ+rT/biIfQelo3u0KCjMVW55paIp2VUh62y461H5h2BcAWRAZArRWHyABoBkNkAcAQM4CdzKcn4W9chtH/96ZS5/KE9N9AADpWipg+Lt5n/jGArfxxlWvWq1sQAYC5em9xDyIEEFFPBUAjYM1J2QJL+RgBtDcEq0CgKCQCfFVbTxRiGwDLBRwiBMCMRBiAFYkjAEYkSAAShjjKAeQCuuoRR1XgNaSxG1IjsDoR+8WRLklvRF+AhBxAks6CoFaBd9T2rvs/u4wcVYFsWkonZNj9AKu9ZrjcZC9vbgLxkdYVYgAAAABJRU5ErkJggg=="}],"all_imported_dlls":["wintrust.dll","msasn1.dll","RpcRtRemote.dll","msvcrt.dll","lpk.dll","shlwapi.dll","ntdll.dll","advapi32.dll","rpcss.dll","VxSSL64.dll","ws2_32.dll","kernel32.dll","KernelBase.dll","version.dll","cryptbase.dll","dwmapi.dll","scrobj.dll","uxtheme.dll","cryptsp.dll","msisip.dll","usp10.dll","msctf.dll","imm32.dll","wshext.dll","sechost.dll","rpcrt4.dll","api-ms-win-core-synch-l1-2-0.dll","rsaenh.dll","user32.dll","clbcatq.dll","nsi.dll","sxs.dll","crypt32.dll","comdlg32.dll","gdi32.dll","oleaut32.dll","fltLib.dll","ole32.dll","jscript.dll","comctl32.dll","shell32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"62d6a26972150c48417ea407"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["62d6a26972150c48417ea407"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample 1bc77b013c83… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 1bc77b013c83…. Threat score 100/100. 9/24 AV engines flagged this file. 2 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 1bc77b013c83… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 1bc77b013c83…. Threat score 100/100. 9/24 AV engines flagged this file. 2 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1bc77b013c83b5b075c3d3c403da330178477843fc2d8326d90e495a61fbb01f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 1bc77b013c83… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 1bc77b013c83…. Threat score 100/100. 9/24 AV engines flagged this file. 2 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]