33:"SampleDetailWrapper" 34:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$33"] 38:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 35:T5dc,Pattern match: "https://assets.msn.com"", Pattern match: "http://x,void", Heuristic match: ".length;oa(t*=1)?(i(t)-i(-t))/2:(c(t-1)-c(-t-1))*(u/2)}})},95140:function(t,e", Pattern match: "https://adsdk.microsoft.com/ast/ast.js;function", Pattern match: "http://localhost:8080/,innerheight:768,devicepixelratio:1,canusecssgrid:!1,requestid:0,cookie:,useragent:,referer:,oneserviceheaders:,vpcetotoken"36:T112e,Found reference to API "t(tc)},tl=function(){if(!tt.get(tu)){var t=ts();tt.set(tu,t.toLowerCase().split("-")[1])}return tt.get(tu)};function th(){if(!te()||tg())return!1;var t=window.sapphireWebViewBridge,e=window.webkit,n=t&&t.send,r=e&&e.messageHandlers&&e.messageHandlers.send&&e.messageHandlers.send.postMessage;return!!(n||r)}function tp(){return!(!te()||tg())&&(th()||"onostartapp"===ti()||tr.includes(ti()))}function td(){var t=tm("edge");return("emmx"===tf()||"1"===t)&&tp()||"mmx"===ti()}function tv(){return["launcherntp","launcherinterests"].includes(ti())&&tp()}function tg(){return"swiftkey"===ti().toLowerCase()||"swiftkey"==tf().toLowerCase()}var ty=tn(function(){var t,e;return th()||(t=ts()&&"outlook"===tf()&&["ios","android","ipados"].includes(tl()),e="onooutlookmobile"===ti(),t||e)||tp()||"weather-app-win"===ti()||"finance-app-win"===ti()||td()||"3rdp"===tf()||ti().startsWith("xmweather-")||tg()||tv()||tg()||-1!==window.location.href.indexOf("metaos=true")||window&&!!window._isCopilotBridge||"copilot"===tm("MBApp")||!!te()" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "",localizationKey:"moneyText",href:"https://{hostName}/{localeCode}/money"},{id:"games",localizationKey:"gamesText",href:"https://{hostName}/{localeCode}/play"}]);var eg=function(){function t(){this.childCookieName="child",this.command="command",this.domInfo=document.head.dataset.info,this.canvasInfo=document.head.dataset.canvasInfo||""}return t.prototype.init=function(t,e){this.clientSettings=t||tN(),this.authCookieName=U||window._authCookieName||"",this.bundle=window._webWorkerBundle||"",e=e||{};var n=this.buildWebWorkerUrl(this.clientSettings,e),r=window.webWorker=this.createWebWorkerInstance(n);r?this.initCore(r):console.warn("Error while initializing the web worker.")},t.prototype.initCore=function(t){var e=this,n=window.webWorkerMessages=[];t.onmessage=function(t){n.push(t.data)};var r=window.webWorkerErrors=[];t.onerror=function(t){r.push(t)},ec()&&tt.get(ed).promise.then(function(n){return t.postMessage({id:"AuthHeaders",type:e.command,payload:n||{}})})},t.prototype.createWebWorkerInstance=function(t)" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "";t.exports=function(t){return r(function(){return!!o[t]()||i[t]()!=i||o[t].name!==t})}},23028:function(t,e,n){var r=n(18236),o="["+n(78418)+"]",i=RegExp("^"+o+o+"*"),a=RegExp(o+o+"*$"),c=function(t){return function(e){var n=String(r(e));return 1&t&&(n=n.replace(i,"")),2&t&&(n=n.replace(a,"")),n}};t.exports={start:c(1),end:c(2),trim:c(3)}},65699:function(t,e,n){var r,o,i,a=n(61905),c=n(24893),u=n(9118),s=n(93423),f=n(56309),l=n(70021),h=n(77810),p=a.location,d=a.setImmediate,v=a.clearImmediate,g=a.process,y=a.MessageChannel,m=a.Dispatch,w=0,b={},x="onreadystatechange",S=function(t){if(b.hasOwnProperty(t)){var e=b[t];delete b[t],e()}},E=function(t){return function(){S(t)}},A=function(t){S(t.data)},O=function(t){a.postMessage(t+"",p.protocol+"//"+p.host)};d&&v||(d=function(t){for(var e=[],n=1;arguments.length>n;)e.push(arguments[n++]);return b[++w]=function(){("function"==typeof t?t:Function(t)).apply(void 0,e)},r(w),w},v=function(t){delete b[t]},h?r=function(t){g.nextTick(E(t))}:m&&m.now?r=function(t){m.now(E(" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "t))}:y&&!l?(i=(o=new y).port2,o.port1.onmessage=A,r=u(i.postMessage,i,1)):a.addEventListener&&"function"==typeof postMessage&&!a.importScripts&&p&&"file:"!==p.protocol&&!c(O)?(r=O,a.addEventListener("message",A,!1)):r=x in f("script")?function(t){s.appendChild(f("script"))[x]=function(){s.removeChild(this),S(t)}}:function(t){setTimeout(E(t),0)}),t.exports={set:d,clear:v}},64234:function(t,e,n){var r=n(35562);t.exports=function(t){if("number"!=typeof t&&"Number"!=r(t))throw TypeError("Incorrect invocation");return+t}},7556:function(t,e,n){var r=n(91720),o=Math.max,i=Math.min;t.exports=function(t,e){var n=r(t);return n<0?o(n+e,0):i(n,e)}},14146:function(t,e,n){var r=n(91720),o=n(8040);t.exports=function(t){if(void 0===t)return 0;var e=r(t),n=o(e);if(e!==n)throw RangeError("Wrong length or index");return n}},62355:function(t,e,n){var r=n(55485),o=n(18236);t.exports=function(t){return r(o(t))}},91720:function(t){var e=Math.ceil,n=Math.floor;t.exports=function(t){return isNaN(t*=1)?0:(t>0?n:e)(t)}},8040:function(t" (Indicator: "postmessage"; Source: "sample.bin")37:T426,Found string - ).length>3})}},13661:function(t,e,n){var r=n(91720),o=n(18236),i=function(t){return function(e,n){var i,a,c=String(o(e)),u=r(n),s=c.length;return u<0||u>=s?t?"":void 0:(i=c.charCodeAt(u))<55296||i>56319||u+1===s||(a=c.charCodeAt(u+1))<56320||a>57343?t?c.charAt(u):i:t?c.slice(u,u+2):(i-55296<<10)+(a-56320)+65536}};t.exports={codeAt:i(!1),charAt:i(!0)}},26329:function(t,e,n){var r=n(97546);t.exports=/Version\/10(?:\.\d+){1,2}(?: [\w./]+)?(?: Mobile\/\w+)? Safari\//.test(r)},85407:function(t,e,n){var r=n(8040),o=n(15119),i=n(18236),a=Math.ceil,c=function(t){return function(e,n,c){var u,s,f=String(i(e)),l=f.length,h=void 0===c?" ":String(c),p=r(n);return p<=l||""==h?f:(u=p-l,(s=o.call(h,a(u/h.length))).length>u&&(s=s.slice(0,u)),t?f+s:s+f)}};t.exports={start:c(!1),end:c(!0)}},82287:function(t){var e=/[^\0-\u007E]/,n=/[.\u3002\uFF0E\uFF61]/g,r="Overflow: input needs wider integers to process",o=Math.floor,i=String.fromCharCode,a=function(t){for(var e=[],n=0,r=t.length;n=55296&&o<=; Source: "sample.bin")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 63fe10557dec… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 63fe10557dec…. Threat score 0/100. 0/23 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/63fe10557dec6db6e6bfe384d4e5809418d0b3e6a2245abb405f993a5f76571b\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"63fe10557dec6db6e6bfe384d4e5809418d0b3e6a2245abb405f993a5f76571b\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"4CDYVF53.htm\",\"applicationCategory\":[\"html\"],\"identifier\":\"63fe10557dec6db6e6bfe384d4e5809418d0b3e6a2245abb405f993a5f76571b\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":23},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":0},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L34",null,{"initialData":{"schema_version":"1.0.17","sha256":"63fe10557dec6db6e6bfe384d4e5809418d0b3e6a2245abb405f993a5f76571b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1794496846192,"unified_at":"2026-11-12T15:20:46.192Z","metadata":{"hashes":{"sha256":"63fe10557dec6db6e6bfe384d4e5809418d0b3e6a2245abb405f993a5f76571b","sha1":"114e458e2c8a48977ecc7c0ecdb55024ce833361","md5":"a2713291c237ad474da938c667d79af0"},"file_info":{"file_name":"4CDYVF53.htm","file_type":["html"],"file_type_id":"html","file_size":144717,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794496839000,"last_seen":1794496839000,"last_multi_scan":1794496839000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":23},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":9},"sandbox_signatures":{"informative_count":9,"suspicious_count":0,"malicious_count":0,"total":9},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Able to access browser directory location"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to access file/directory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Able to download payload"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$35","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://assets.msn.com\", Found HTTPS url \"https://ent\", Found HTTPS url \"https://a\", Found HTTPS url \"https://assets.msn.cn\", Found HTTPS url \"https://adsdk.microsoft.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to download payload","description":"file/memory contains long string with (Indicator: \"curl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-10039","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access browser directory location","description":"file/memory contains long string with (Indicator: \"chromium/\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-10089","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$36","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access file/directory","description":"file/memory contains long string with (Indicator: \".delete(\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-779","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"file/memory contains long string with (Indicator: \"text/javascript\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.007","id":"string-626","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"fromcharcode\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-356","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$37","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Sample 63fe10557dec… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 63fe10557dec…. Threat score 0/100. 0/23 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/63fe10557dec6db6e6bfe384d4e5809418d0b3e6a2245abb405f993a5f76571b"}],["$","meta","4",{"property":"og:title","content":"Sample 63fe10557dec… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 63fe10557dec…. Threat score 0/100. 0/23 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/63fe10557dec6db6e6bfe384d4e5809418d0b3e6a2245abb405f993a5f76571b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 63fe10557dec… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 63fe10557dec…. Threat score 0/100. 0/23 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L38","11",{}]] 32:null