26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T40e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Sample cdf13645672e… — Score 0/100 — Hybrid Analysis","description":"Threat analysis for sample cdf13645672e…. Threat score 0/100. 0/23 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cdf13645672ec231af3ec9f46368c048223fb51e518b288acfa5a3f82db73d24","keywords":["malware analysis","sandbox report","threat intelligence","cdf13645672ec231af3ec9f46368c048223fb51e518b288acfa5a3f82db73d24"],"about":{"@type":"SoftwareApplication","name":"clientlib-base.min.37b3218af1a584e5fea8e57f6aa1ab3a_1_.js","applicationCategory":["script","javascript"],"identifier":"cdf13645672ec231af3ec9f46368c048223fb51e518b288acfa5a3f82db73d24"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":23},"behavioralIndicators":{"malicious":0,"suspicious":1},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T194b,Pattern match: "http://code.google.com/p/chromium/issues/detail?id=91158", Heuristic match: "unction (e) { if (e.keycode == 9) { $('.fxg-download-accordion_body-dropdown ul', $root).removeclass('display-dropdown-webtolead'); $(this).parent('ul').siblings().find('span.fxg-download-drop_body__carot-icon').removeclas", Pattern match: "https://github.com/w3c/intersectionobserver/pull/205", Pattern match: "www.fedex", Pattern match: "tdn.r42tag.com/lib", Pattern match: "https://.concat(host).concat", Pattern match: "https://fedex.tt.omtrdc.net/rest/v1/mbox/'+sessionid+'?client=fedex", Heuristic match: "n indicatorcheck() { var _fdx$breakpoints; if (fdx.components.footer.socialsize < fdx.components.footer.wrappersize) { $('.' + fdx.components.footer.rightindicatorclass).hide(); hiderightindicator(); } else if ($", Heuristic match: "(!fdx) { var fdx = {}; } fdx.navbar = { componentclass: .fxg-navbar__main, activedropdown: fxg-navbar__menu__item--is-active, parentclass: .fxg-navbar__menu__item--has-submenu, kebabmenu: .fxg-kebab__menu, activekebabmenu: ", Heuristic match: " }, 200); } }); } } } // add hero active cube class fdx.cube.activecube = ($(elem).index() + 1); var cubeclass = 'fxg-hero--cube-' +", Heuristic match: "end an event for login var tmpdate = new date() const eventdata = { eventdata: edata, eventaction: header login, type: authentication, effect: change authenticated state to logged in, ", Pattern match: "http://www.apache.org/licenses/license-2.0", Pattern match: "http://www.w3.org/2000/svg", Pattern match: "https://www.fedex.com?key1=value1&key2=value2", Pattern match: "https://gdl-master.devapp.paas.fedex.com/testbed.form.html", Pattern match: "https://github.com/babel/babel/blob/main/packages/babel-helpers/license", Pattern match: "https://www.fedex.com/fedextrack/?trknbr=", Pattern match: "https://github.com/w3c/intersectionobserver/issues/324", Pattern match: "https://gdl-master.devapp.paas.fedex.com/testbed.error.html", Pattern match: "https://gdl-master.devapp.paas.fedex.com/testbed.generic-interaction.html", Pattern match: "https://developer.salesforce.com/docs/service/messaging-web/guide/introduction.html", Pattern match: "http://www.w3.org/1999/xhtml", Pattern match: "https://twitter.com/intent/tweet?&text=.concat", Pattern match: "https://developer.mozilla.org/en-us/docs/web/api/customevent/customevent", Pattern match: "http://bit.ly/1kzffri", Pattern match: "www.dailymotion.com/embed/video/$1", Heuristic match: "; inputval = []; inputtimestamp.push(e.timestamp); inputval.push(e.key); $(this).find('li').each(function () { var countryname = $(this).text().match(/[a-za-z0-9]/g).join(''); if (", Pattern match: "www.youtube.com/embed/$4", Pattern match: "https://www.fedex.com/fedextrack/wtrk/track", Heuristic match: "= _objectspread(_objectspread({}, defaultconfig), _config); }; /** * to close current notification banner * * @private */ var closenotification = function closenotification() { if (notificationsselecto", Pattern match: "https://bugs.webkit.org/show_bug.cgi?id=65440", Pattern match: "https://api.emea.fedex.com/aemform/v1/mcte/", Pattern match: "https://twitter.com/intent/tweet?url={{url}}&text={{descr", Pattern match: "https://eo92vlhk714c2hm.m.pipedream.net", Pattern match: "https://developer.salesforce.com/docs/atlas.en-us.live_agent_dev.meta/live_agent_dev/live_agent_deployment_api_code_sample.htm", Heuristic match: "uthenticated: function(authenticated) { fdx.session.userauthenticated = authenticated; }, settargetredirectauth: function(authenticated) { fdx.session.targetredirectauth = authenticated; }, setuserrewards: function() { var rewards = fdx.session.", Pattern match: "https://w3c.github.io/intersectionobserver/#calculate-intersection-rect-algo", Pattern match: "https://developer.salesforce.com/docs/service/messaging-web/guide/launch-chat.html", Heuristic match: "$(this).parents('.toggle-view').siblings('.tab-content').find('#\\'+$(this).siblings('.active').attr('id')+'').removeclass('active'); }) } }) } } }, scrolltocontent: function(elem){ var", Pattern match: "https://www.google.com/maps/search/empire+state+building/", Pattern match: "https://github.com/w3c/intersectionobserver", Pattern match: "https://w3c.github.io/intersectionobserver/#intersection-observer-entry", Pattern match: "https://maps.googleapis.com/maps/api/geocode/json?key=", Pattern match: "https://+fdx.appbase.domainname+fdx.appbase.extapphtml", Pattern match: "https://www.facebook.com/sharer/sharer.php?u={{url", Heuristic match: "{ return button.addeventlistener('click', function () { return handlebuttonclick(button); }); }); } /** * handle keys * handling the navigation with buttons * ", Pattern match: "https://cdnapisec.kaltura.com/p/", Heuristic match: "ger script that potentially causes error // akamai script already gets injected in parent page $afdom.find('script[src*=akam]').remove(); // fix following ootb issues: // - it overwrites the dropdown dom, ", Pattern match: "https://gdl-master.devapp.paas.fedex.com/testbed.accordion.html", Pattern match: "https://+host+/etc/services/getalerts.+brand+.+regionparam+.+countryparam+.+localeparam+.+trimpath+.jsonp", Pattern match: "https://developer.salesforce.com/docs/service/messaging-web/guide/event-listeners.html", Pattern match: "http://www.fedex.com/locate/?locale='+locale+'&appid=wcon&originlatitude='+lat+'&originlongitude='+lng+'&originstreetlines='+", Pattern match: "https://gdl-master.devapp.paas.fedex.com/testbed.link.html", Pattern match: "http://stackoverflow.com/a/9039885/177710", Heuristic match: " elem.getattribute(href); var target = elem.getattribute(target); var issecure = elem.classlist.contains(fdx.components.button.secureadvlinkclass); if (issecure) { fdx.components.button.checksecurelink(elem); } else { "28:T2e45,"ment.getElementById('fxg-search-url')) === null || _document$getElementB3 === void 0 ? void 0 : _document$getElementB3.value) || ''; if (!trackNumInput) return; var dtTrackNum = trackNumInput.replace(/\s/g, ''); var isNumeric = FDX.services.utils.isNumeric; var isDtTrackNum = dtTrackNum.slice(0, 2).toLowerCase() === 'dt' && isNumeric(dtTrackNum.slice(2)) && dtTrackNum.slice(2).length === 12; var host = typeof FDX_HOSTNAME !== 'undefined' && FDX_HOSTNAME ? FDX_HOSTNAME : window.location.host; var countryCode = ((_FDX$DATALAYER = FDX.DATALAYER) === null || _FDX$DATALAYER === void 0 || (_FDX$DATALAYER = _FDX$DATALAYER.page) === null || _FDX$DATALAYER === void 0 ? void 0 : _FDX$DATALAYER.country) || 'us'; var isStandardTracking = isNumeric(trackNumInput) && trackNumInput.length > 5 && trackNumInput.length < 30; var baseTrackUrl = "https://".concat(host).concat(trackUrl || '/apps/fedextrack/'); var trackQueryParams = "?action=track&tracknumber" (Indicator: "countrycode") in Source: sample.bin, "ockUserModel: { "successful": true, "userProfile": { "profileLocked": false, "loginInformation": { "userId": "wportesting1", "secretQuestion": { "code": "SP2Q1", "text": "What is your mother\u0027s first name? " } }, "userProfileAddress": { "contact": { "personName": { "firstName": "Jayas", "middleName": "(*\u0026amp;#$(*\u0026amp;@#$", "lastName": "Tolleson" }, "companyName": "RAYMOND HO \u0026 CO", "phoneNumber": "6472638310", "faxNumber": "", "emailAddress": "a_jeyamala@hotmail.com" }, "contactAncillaryDetail": { "phoneNumberDetails": [{ "type": "HOME", "number": { "countryCode": "1", "localNumber": "6472638310" }, "permissions": {} }, { "type": "MOBILE", "number": { "countryCode": "", "localNumber": "" }, "permissions": {} }, { "type": "FAX", "number": { "countryCo" (Indicator: "countrycode") in Source: sample.bin, "ss.contact.personName.firstName + " " + FDX.SESSION.getUserModel().userProfileAddress.contact.personName.lastName); } }, getaFName: function() { return FDX.SESSION.getCookie(FDX.SESSION.COOKIENAMES.fName); }, getCountryCode: function() { return FDX.SESSION.getCookie(FDX.SESSION.COOKIENAMES.countryCode) != null ? FDX.SESSION.getCookie(FDX.SESSION.COOKIENAMES.countryCode) : "/us/"; }, getCountryPath: function() { return FDX.SESSION.getCookie(FDX.SESSION.COOKIENAMES.countryPath) != null ? FDX.SESSION.getCookie(FDX.SESSION.COOKIENAMES.countryPath) : "us"; }, getUUID: function() { return FDX.SESSION.getCookie(FDX.SESSION.COOKIENAMES.uuid); }, getSessionID: function() { return FDX.SESSION.getCookie(FDX.SESSION.COOKIENAMES.sessionId); }, getCBID: function() { return FDX.SESSION.getCookie(FDX.SESSION.COOKIENAMES.cbid); }, getLocale: function() { return FDX.SESSION.getCookie(FDX.SESSION.COOKIENAMES.locale) != null ? FDX.SESSION.getCookie(FDX.SESSION.COOKIENAMES.locale) : "en_" (Indicator: "countrycode") in Source: sample.bin, "=\"<%= language.url %>\" data-analytics=\"link|<%= language.analyticsText %>\" onclick=\"FDX.DTM.pushLinkInfo(this)\" data-country-code=\"<%= locale.countryCode %>\" aria-label=\"<%= language.ariaLabel %>\">\n \"><%= language.text %>\n \n \n <% }); %>\n \n \n <% }); %>\n \n

\n <% // The link to the overview of countries %>\n \" data-analytics=\"link|<%= globalAnalyticsText %>\" onclick=\"FDX.DTM.pushLinkInfo(this); FDX.SESSION.removeRedirectCookie();\" aria-label=\"<%= globalLocationAriaLabel %>\"><%= globalLocation %>\n

\n \n"; ;// ./src/components/geolocator/geolocator.js /** * Hello World * * This component is created for demonstration purpose */ (function ($, _, $fetch, $session) { window.FDX.components" (Indicator: "countrycode") in Source: sample.bin, "SSION.COOKIENAMES.countryCode, "/us/", expiry); FDX.SESSION.setCookie(FDX.SESSION.COOKIENAMES.countryPath, "us", expiry); FDX.SESSION.setCookie(FDX.SESSION.COOKIENAMES.uuid, "1234567890", expiry); FDX.SESSION.setCookie(FDX.SESSION.COOKIENAMES.sessionId, "1234567890", expiry); FDX.SESSION.setCookie(FDX.SESSION.COOKIENAMES.cbid, "1234567890", expiry); FDX.SESSION.setCookie(FDX.SESSION.COOKIENAMES.locale, "en_US", expiry); FDX.SESSION.setCookie(FDX.SESSION.COOKIENAMES.login, "1234567890", expiry); FDX.SESSION.setCookie(FDX.SESSION.COOKIENAMES.jSessionId, "1234567890", expiry); FDX.SESSION.setCookie(FDX.SESSION.COOKIENAMES.rewards, "987654", expiry); } }, setMockUserModel: function() { if (FDX.CORE.runMode == "debug") { FDX.SESSION.userModel = FDX.SESSION.mockUserModel; } }, setUserModel: function(model) { FDX.SESSION.userModel = model; }, getUserModel: function() { return FDX.SESSION.userModel; }, destroyUserModel: function() { FDX.SESSION.userModel = null; }, m" (Indicator: "countrycode") in Source: sample.bin, " var accessToken = accessToken; var tierInfo = resp.JsonExternalData.memberType; $.ajax({ type: "POST", url: "https://" + FDX.SESSION.apiURL + "/rewards/v1/profiles/memberinfo", contentType: "application/json", dataType: "json", beforeSend: function (xhr) { xhr.setRequestHeader ("Authorization", "Bearer "+FDX.MFXR_APIG.accessToken); }, headers: { "x-clientid": accessToken}, data: JSON.stringify({ "ProfileId" : profileID, "ActivityType": "GETMEMBERINFO", "JsonExternalData": { "memberType" :tierInfo, "apiSource" : "Mobile|AEM", "locale" : "en_us", "LangCode": "en", "CountryCode": "US" } }), error: function(xhr) { console.log("API request failed from Epsilon"); console.log("status is "+ xhr.status+", status text is "+ xhr.statusText); }, succes" (Indicator: "countrycode") in Source: sample.bin, "de": "", "localNumber": "" }, "permissions": {} } ] }, "address": { "streetLines": ["30 fedex pkwy", ""], "city": "COLLIERVILLE", "stateOrProvinceCode": "TN", "postalCode": "38017", "countryCode": "US", "residential": false } } } }, validateTimeStamp: function() { var userLoggedInDetails = sessionStorage.getItem("userLoggedIn"); if (userLoggedInDetails != null && JSON.parse(userLoggedInDetails).output.userLoggedIn == true) { var timestampVal = JSON.parse(sessionStorage.getItem("userLoggedIn")).timestamp; if ((new Date().getTime() >= new Date(timestampVal).getTime())) { sessionStorage.removeItem("userLoggedIn"); } } } }; $(document).ready(function() { // Set authenticated state on page load if (window.location.href.indexOf(FDX.SESSION.globalHomePage) != 0) { FDX.SESSION.getLogin(); } // If authenticated then set Rewards if (FDX.SESSION.userAuthenticated) { // set reward points value FDX.SESSION.set" (Indicator: "countrycode") in Source: sample.bin, "s=".concat(encodeURIComponent(trackNumInput), "&cntry_code=").concat(countryCode, "&wsch=true"); var fullTrackUrl = "".concat(baseTrackUrl).concat(trackQueryParams); if (isDtTrackNum || isStandardTracking) { window.location.href = fullTrackUrl; return; } FDX.DTM.updateSearchTerm(); var locale = (_FDX$DATALAYER2 = FDX.DATALAYER) === null || _FDX$DATALAYER2 === void 0 || (_FDX$DATALAYER2 = _FDX$DATALAYER2.page.pageInfo) === null || _FDX$DATALAYER2 === void 0 ? void 0 : _FDX$DATALAYER2.locale; var lang = (_FDX$DATALAYER3 = FDX.DATALAYER) === null || _FDX$DATALAYER3 === void 0 || (_FDX$DATALAYER3 = _FDX$DATALAYER3.page.pageInfo) === null || _FDX$DATALAYER3 === void 0 ? void 0 : _FDX$DATALAYER3.language; var region = (_FDX$DATALAYER4 = FDX.DATALAYER) === null || _FDX$DATALAYER4 === void 0 || (_FDX$DATALAYER4 = _FDX$DATALAYER4.page.pageInfo) === null || _FDX$DATALAYER4 === void 0 ? void 0 : _FDX$DATALAYER4.country; if (trackNumInput" (Indicator: "countrycode") in Source: sample.bin, "DX object must already be defined. This file contains methods to get and set cookies. Author: joey.dukeminier@vml.com Created: 2017-03-27 */ if (!FDX) { var FDX = {}; } FDX.SESSION = { userAuthenticated: false, userModel: null, userRewards: 0, userRewardsTier: "", defaultRewardsTier: "VALUED REWARDS MEMBER", apiURL: "", clientID: "", clientSecret: "", grantType: "", sessionTimeout: "", apiConfigURL: "/etc/services/getapigconfigs", rewardsUATHost: "fedexapiuat.epsilon.com", rewardsKey: "", rewardsHost: "fedexapi.epsilon.com", targetRedirectAuth: false, cubeShippipng: false, globalHomePage: window.location.origin + "/global/choose-location.html", COOKIENAMES: { contactName: "fcl_contactname", fName: "fcl_fname", lName: "lastName", companyName: "companyName", countryCode: "cc", postalCode: "postalCode", countryPath: "countryPath", locale: "fdx_locale", login: "fdx_login", rewards: "fdx_rewardPoints", userRewardsTier: "fdx_memberType", uuid: "fcl_uuid", session" (Indicator: "countrycode") in Source: sample.bin, "ocessedLanguages.unshift(processedLanguage); } else { processedLanguages.push(processedLanguage); } }); // Set up data object to use in template var localeData = { countryCode: locale.countryCode, countryName: locale.countryName, defaultLanguage: defaultLanguage, languages: processedLanguages, type: type }; return localeData; } /** * Populate process language * * @param {object} languageData - unprocessed language data * @return {object} processed lanugage data object */ function processLanguage(languageData) { var language = languageData.language; var type = languageData.type; var processedLanguage = { ariaLabel: language.name, analyticsText: language.analyticsText, text: language.name, code: language.languageCode, linkType: 'link', // link by default " (Indicator: "countrycode") in Source: sample.bin, " administrative_area_level_1 : '', administrative_area_level_2 : '', locality : '', route:'' }; $.each(FDX.LOCATIONS.address, function(k,v1) {jQuery.each(v1.types, function(k2, v2){address_components[v2]=v1.short_name});}) console.log('address components ', address_components); var link = 'http://www.fedex.com/locate/?locale='+locale+'&appId=WCON&originLatitude='+lat+'&originLongitude='+lng+'&originStreetLines='+ address_components.route+'&originCity='+address_components.locality+'&originStateOrProvinceCode='+address_components.administrative_area_level_1 +'&originPostalCode='+address_components+ '&originCountryCode='+address_components.country+'&actionType=results'; var openInNewWindow=document.getElementById("openInNewWindowLoc").value; console.log("openInNewWindow" (Indicator: "countrycode") in Source: sample.bin1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"cdf13645672ec231af3ec9f46368c048223fb51e518b288acfa5a3f82db73d24","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1793691996105,"unified_at":"2026-11-03T07:46:36.105Z","metadata":{"hashes":{"sha256":"cdf13645672ec231af3ec9f46368c048223fb51e518b288acfa5a3f82db73d24","sha1":"5c44aac54f8af341e4862cc2aee9532efdfd26c5","md5":"37b3218af1a584e5fea8e57f6aa1ab3a"},"file_info":{"file_name":"clientlib-base.min.37b3218af1a584e5fea8e57f6aa1ab3a_1_.js","file_type":["script","javascript"],"file_type_id":"js","file_size":1551782,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793691989000,"last_seen":1793691989000,"last_multi_scan":1793691989000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":23},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":17},"sandbox_signatures":{"informative_count":18,"suspicious_count":1,"malicious_count":0,"total":19},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"suspicious","value":"Able to retrieve browser cookies using SQL"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to set the value of an HTTP request header"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Cloud Services","attack_id":"T1021.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/007","identifiers":[{"type":"informative","value":"Able to connect to a cloud service"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Able to manipulate a file/directory time format"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found system command-related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to retrieve geographical location"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Security Account Manager","attack_id":"T1003.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/002","identifiers":[{"type":"informative","value":"Able to access system credential hash file"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \" bind \"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \" connect \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://code.google.com\", Found HTTPS url \"https://github.com\", Found HTTPS url \"https://fedex.tt.omtrdc.net\", Found HTTPS url \"https://www.fedex.com\", Found HTTPS url \"https://gdl\", Found HTTPS url \"https://w3c.github.io\", Found HTTPS url \"https://developer.salesforce.com\", Found HTTPS url \"https://twitter.com\", Found HTTPS url \"https://www.linkedin.com\", Found HTTPS url \"https://www.facebook.com\", Found HTTPS url \"https://developer.mozilla.org\", Found HTTPS url \"https://www.google.com\", Found HTTPS url \"https://bugs.webkit.org\", Found HTTPS url \"https://api.emea.fedex.com\", Found HTTPS url \"https://eo92vlhk714c2hm.m.pipedream.net\", Found HTTPS url \"https://pipedream.com\", Found HTTPS url \"https://www.w3.org\", Found HTTPS url \"https://maps.googleapis.com\", Found HTTPS url \"https://www.pinterest.com\", Found HTTPS url \"https://cdnapisec.kaltura.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"file/memory contains long string with (Indicator: \"@hotmail.\"; Source: \"sample.bin\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1585.002","id":"string-235","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"file/memory contains long string with (Indicator: \"ping \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-417","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to set the value of an HTTP request header","description":"file/memory contains long string with (Indicator: \".setRequestHeader\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-623","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \".googleapis.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1102","id":"string-186","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"base64\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"secret\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access system credential hash file","description":"file/memory contains long string with (Indicator: \"nthash\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1003.002","id":"string-867","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve browser cookies using SQL","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1539","id":"string-692","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"youtube.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve geographical location","description":"$28","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-575","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to manipulate a file/directory time format","description":"file/memory contains long string with (Indicator: \"timeformat(\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-778","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Remote Access Related","name":"Able to connect to a cloud service","description":"file/memory contains long string with (Indicator: \"gcloud\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1021.007","id":"string-767","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"file/memory contains long string with (Indicator: \"facebook.com\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"youtube\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"twitter\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-10","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"file/memory contains long string with (Indicator: \"text/javascript\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.007","id":"string-626","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"fromcharcode\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-356","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Sample cdf13645672e… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample cdf13645672e…. Threat score 0/100. 0/23 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/cdf13645672ec231af3ec9f46368c048223fb51e518b288acfa5a3f82db73d24"}],["$","meta","4",{"property":"og:title","content":"Sample cdf13645672e… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample cdf13645672e…. Threat score 0/100. 0/23 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/cdf13645672ec231af3ec9f46368c048223fb51e518b288acfa5a3f82db73d24"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample cdf13645672e… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample cdf13645672e…. Threat score 0/100. 0/23 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]