33:"SampleDetailWrapper" 34:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$33"] 38:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 35:T69e,Pattern match: "https://adsdk.microsoft.com/ast/ast.js;function", Pattern match: "http://localhost:8080/,innerheight:768,devicepixelratio:1,canusecssgrid:!1,requestid:0,cookie:,useragent:,referer:,oneserviceheaders:,vpcetotoken", Pattern match: "https://assets.msn.com/config/v1/"", Pattern match: "http://x,void", Pattern match: "https://assets.msn.com"", Pattern match: "https://+b+/onecollector/1.0+", Pattern match: "https://ent-api.msn.com/"", Pattern match: "http://a#", Heuristic match: ",n){var r=n(82012);t.exports=function(t){if(!r(t))throw typeerror(string(t)+ is not an object);return t}},21314:function(t){t.exports=u>typeof arraybuffer&&u>typeof dataview},52570:function(t,e,n){var r,o=n(21314),i=n(80594),a=n(61905),c=n(82012),u=n", Pattern match: "http://a/c%20d?a=1&c=3!==t.href||3!==e.get(c)||a=1!==string", Pattern match: "https://.concat(t).concat(j)", Pattern match: "https://{hostname}/{localecode}/video},{id:weather,localizationkey:weathertext,href:https://{hostname}/{localecode}/weather},{id:money,localizationkey:moneytext,href:https://{hostname}/{localecode}/money},{id:games,localizationkey:gamestext", Heuristic match: "tion(t,e,n){var r=n(91496),o=n(24893),i=n(50260),a=math.abs,c=math.exp,u=math.e;r({target:math,stat:!0,forced:o(function(){return -2e-17!=math.sinh(-2e-17)})},{sinh:function(t){return 1>a(t*=1)?(i(t)-i(-t))/2:(c(t-1)-c(-t-1))*(u/2)}})},95140:function(t,e", Heuristic match: "(var n in e)object.prototype.hasownproperty.call(e,n)&&(t[n]=e[n])})(t,e)},z=function(){return(z=object.assign||function(t){for(var e,n=1,r=arguments.length;nn;)e.push(arguments[n++]);return b[++w]=function(){("function"==typeof t?t:Function(t)).apply(void 0,e)},r(w),w},v=function(t){delete b[t]},h?r=function(t){g.nextTick(E(t))}:m&&m.now?r=function(t){m.now(E(" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "t))}:y&&!l?(i=(o=new y).port2,o.port1.onmessage=A,r=u(i.postMessage,i,1)):a.addEventListener&&"function"==typeof postMessage&&!a.importScripts&&p&&"file:"!==p.protocol&&!c(O)?(r=O,a.addEventListener("message",A,!1)):r=x in f("script")?function(t){s.appendChild(f("script"))[x]=function(){s.removeChild(this),S(t)}}:function(t){setTimeout(E(t),0)}),t.exports={set:d,clear:v}},64234:function(t,e,n){var r=n(35562);t.exports=function(t){if("number"!=typeof t&&"Number"!=r(t))throw TypeError("Incorrect invocation");return+t}},7556:function(t,e,n){var r=n(91720),o=Math.max,i=Math.min;t.exports=function(t,e){var n=r(t);return n<0?o(n+e,0):i(n,e)}},14146:function(t,e,n){var r=n(91720),o=n(8040);t.exports=function(t){if(void 0===t)return 0;var e=r(t),n=o(e);if(e!==n)throw RangeError("Wrong length or index");return n}},62355:function(t,e,n){var r=n(55485),o=n(18236);t.exports=function(t){return r(o(t))}},91720:function(t){var e=Math.ceil,n=Math.floor;t.exports=function(t){return isNaN(t*=1)?0:(t>0?n:e)(t)}},8040:function(t" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "rg-rp2-tmpl,1s-qsmask,prg-1sw-mvspstripe2,prg-1sw-mvspstripe,prg-1sw-tbrguard1,prg-1sw-uupt,prg-1sw-spwpouup,prg-linf-t-pid,ads-xdr-w-ovr-early,prg-watch-ovr-early,prg-1sw-orlt,1s-wpo-csatr,msph-exportpar,prg-1sw-spltheaderc,msph-pcmurlbt,prg-pr2-cfast-t1,prg-1scf-cmt,ads-confiant-bl-h-c,hdr-pr2-prebun,ads-srctid-c,prg-1sw-mguupv,prg-cg-cardmetrics,msph-brandstmt,prg-pr2-load-spin,prg-pr2-skelrm,msph-pcmcpmr,prismsd-off-t,1s-prism-rev,1s-prismsd-off,prg-fin-worthinessv2,1s-tp-all,1s-ts-lockscreen,1s-ts-p2segment,1s-ts-rubyp2segment,1s-wpo-pcimp-sc,ads-sdk-bidder-postmessage-enforcement-t,1s-ruby-ruru-nofeed;" data-canvas-info="f:prg-al-notice" data-ads-numberline="f:5ui9=ads-anjson-migt,63hy=ads-nooutbrain,649x=ads-prcrid-bi,6965=ads-bcn-cndomain,anaheimmuidads5=ads-idpass-t,anaheimmuidadsupv2=btie-msan-wfv3-aml-c,7khg=ads-3pctve-filter,xandrmsntied2=xads-titanv1-cbmm-it-r75-v2,rubyconsumption17=ads-xdr-w-ovr-early,f7d67825-d515-b58d-b810-e7aa1ea8057b=ads-confiant-bl-h-c,22edb23f-a971-dc01-994c-84d1d4b2375e=a" (Indicator: "postmessage"; Source: "sample.bin")37:T426,Found string - ).length>3})}},13661:function(t,e,n){var r=n(91720),o=n(18236),i=function(t){return function(e,n){var i,a,c=String(o(e)),u=r(n),s=c.length;return u<0||u>=s?t?"":void 0:(i=c.charCodeAt(u))<55296||i>56319||u+1===s||(a=c.charCodeAt(u+1))<56320||a>57343?t?c.charAt(u):i:t?c.slice(u,u+2):(i-55296<<10)+(a-56320)+65536}};t.exports={codeAt:i(!1),charAt:i(!0)}},26329:function(t,e,n){var r=n(97546);t.exports=/Version\/10(?:\.\d+){1,2}(?: [\w./]+)?(?: Mobile\/\w+)? Safari\//.test(r)},85407:function(t,e,n){var r=n(8040),o=n(15119),i=n(18236),a=Math.ceil,c=function(t){return function(e,n,c){var u,s,f=String(i(e)),l=f.length,h=void 0===c?" ":String(c),p=r(n);return p<=l||""==h?f:(u=p-l,(s=o.call(h,a(u/h.length))).length>u&&(s=s.slice(0,u)),t?f+s:s+f)}};t.exports={start:c(!1),end:c(!0)}},82287:function(t){var e=/[^\0-\u007E]/,n=/[.\u3002\uFF0E\uFF61]/g,r="Overflow: input needs wider integers to process",o=Math.floor,i=String.fromCharCode,a=function(t){for(var e=[],n=0,r=t.length;n=55296&&o<=; Source: "sample.bin")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 52d41dd02d9f… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 52d41dd02d9f…. Threat score 0/100. 0/26 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/52d41dd02d9feb973e4d204d55acf81547cd233cb9eacc5cccff55ffbcf25bbc\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"52d41dd02d9feb973e4d204d55acf81547cd233cb9eacc5cccff55ffbcf25bbc\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"TDL2565I.htm\",\"applicationCategory\":[\"html\"],\"identifier\":\"52d41dd02d9feb973e4d204d55acf81547cd233cb9eacc5cccff55ffbcf25bbc\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":26},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":0},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L34",null,{"initialData":{"schema_version":"1.0.17","sha256":"52d41dd02d9feb973e4d204d55acf81547cd233cb9eacc5cccff55ffbcf25bbc","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1794372505961,"unified_at":"2026-11-11T04:48:25.961Z","metadata":{"hashes":{"sha256":"52d41dd02d9feb973e4d204d55acf81547cd233cb9eacc5cccff55ffbcf25bbc","sha1":"9cba1d44712050ed54bac6d2b6db08674215f9f3","md5":"c4187e166bb4287990d19d07b6665857"},"file_info":{"file_name":"TDL2565I.htm","file_type":["html"],"file_type_id":"html","file_size":145296,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794372499000,"last_seen":1794372499000,"last_multi_scan":1794372499000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":8},"sandbox_signatures":{"informative_count":8,"suspicious_count":0,"malicious_count":0,"total":8},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Able to access browser directory location"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to access file/directory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$35","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://adsdk.microsoft.com\", Found HTTPS url \"https://assets.msn.com\", Found HTTPS url \"https://ent\", Found HTTPS url \"https://a\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$36","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access file/directory","description":"file/memory contains long string with (Indicator: \".delete(\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-779","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"file/memory contains long string with (Indicator: \"text/javascript\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.007","id":"string-626","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"fromcharcode\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-356","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$37","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access browser directory location","description":"file/memory contains long string with (Indicator: \"chromium/\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-10089","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Sample 52d41dd02d9f… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 52d41dd02d9f…. Threat score 0/100. 0/26 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/52d41dd02d9feb973e4d204d55acf81547cd233cb9eacc5cccff55ffbcf25bbc"}],["$","meta","4",{"property":"og:title","content":"Sample 52d41dd02d9f… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 52d41dd02d9f…. Threat score 0/100. 0/26 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/52d41dd02d9feb973e4d204d55acf81547cd233cb9eacc5cccff55ffbcf25bbc"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 52d41dd02d9f… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 52d41dd02d9f…. Threat score 0/100. 0/26 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L38","11",{}]] 32:null