Benign Download

%D0%91%D0%B0%D0%B9%D0%B5%D1%80

Contains a hardcoded insecure HTTP URLURL targets .php with query

SHA-256347097fbc4e4e30b6761427b9641aeb8fb8f023d8f6416c7d9f9ff7c38569c91

URLhttps://bg.wikipedia.org/wiki/%D0%91%D0%B0%D0%B9%D0%B5%D1%80

Evidence

Contains a Cyrillic script sequence lines 2–6

2:615… dard" lang="bg" dir="ltr">
3<head>
4<meta charset="UTF-8">
5<title>Байер – Уикипедия</title>
6<script>(function(){var className="client-js vector-feature-language-in-header-enabled vector-fe …

Regex scans cookies via document.cookie.match line 6

6:588… or-toc-available skin-thumbsize-clientpref-standard";var cookie=document.cookie.match(/(?:^|; )bgwikimwclientpreferences=([^;]+)/);if(cookie){cookie[1].split('%2C').forEach(function(pref){className=className.replace(new RegExp('(^| )'+pref.replace(/-clientpref-\w+$|[^\w-]+/g,'')+'-clientpref-\\w+( |$)'),'$1'+pr …

Contains a hardcoded remote HTTP(S) URL lines 19–24

19:26… ion" content="telephone=no">
20<meta property="og:image" content="https://upload.wikimedia.org/wikipedia/commons/thumb/f/f7/Logo_Bayer.svg/1280px-Logo_Bayer.svg.png">
21<meta property="og:image:width" content="1200">
22<meta property="og:image:height" content="1200">
23<meta name="viewport" content="width=1120">
24<m …

Contains Arabic or Urdu script line 441

441:394… "https://ar.wikipedia.org/wiki/%D8%A8%D8%A7%D9%8A%D8%B1" title="باير – арабски" lang="ar" hreflang="ar" data-title="باير" data-language-autonym="العربية" data-language-local-na …

Contains Devanagari script line 441

441:7543… wikipedia.org/wiki/%E0%A4%AC%E0%A4%BE%E0%A4%AF%E0%A4%B0" title="बायर – хинди" lang="hi" hreflang="hi" data-title="बायर" data-language-autonym="हिन्दी" data-language-loca …