Benign Download

JScript

Contains a hardcoded insecure HTTP URLHTTP URL ending in executable extension
SHA-25672996e382f39a67b2e764d79831f3627ba81139019b8e2f37e17d64386d7314b
URLhttps://az.wikipedia.org/wiki/JScript
MaleculeH(Cm₃)Md

Evidence

Regex scans cookies via document.cookie.match lines 1–18
1<!DOCTYPE html>
2<html class="client-nojs vector-feature-language-in-header-enabled vector-feature-language-in-main-menu-disabled vector-feature-language-in-main-page-header-disabled vector-feature-page-tools-pinned-disabled vector-feature-toc-pinned-clientpref-1 vector-feature-main-menu-pinned-disabled vector-feature-limited-width-clientpref-1 vector-feature-limited-width-content-enabled vector-feature-custom-font-size-clientpref-1 vector-feature-appearance-pinned-clientpref-1 skin-theme-clientpref-day vector-feature-navigation-update-disabled vector-sticky-header-enabled vector-toc-available skin-thumbsize-clientpref-standard" lang="az" dir="ltr">
3<head>
4<meta charset="UTF-8">
5<title>JScript — Vikipediya</title>
6<script>(function(){var className="client-js vector-feature-language-in-header-enabled vector-feature-language-in-main-menu-disabled vector-feature-language-in-main-page-header-disabled vector-feature-page-tools-pinned-disabled vector-feature-toc-pinned-clientpref-1 vector-feature-main-menu-pinned-disabled vector-feature-limited-width-clientpref-1 vector-feature-limited-width-content-enabled vector-feature-custom-font-size-clientpref-1 vector-feature-appearance-pinned-clientpref-1 skin-theme-clientpref-day vector-feature-navigation-update-disabled vector-sticky-header-enabled vector-toc-available skin-thumbsize-clientpref-standard";var cookie=document.cookie.match(/(?:^|; )azwikimwclientpreferences=([^;]+)/);if(cookie){cookie[1].split('%2C').forEach(function(pref){className=className.replace(new RegExp('(^| )'+pref.replace(/-clientpref-\w+$|[^\w-]+/g,'')+'-clientpref-\\w+( |$)'),'$1'+pref+'$2');});}document.documentElement.className=className;}());RLCONF={"wgBreakFrames":false,"wgSeparatorTransformTable":[",\
7RLSTATE={"ext.gadget.Codex":"ready","ext.gadget.common-site":"ready","ext.gadget.darkModeFixes":"ready","ext.gadget.logo":"ready","ext.globalCssJs.user.styles":"ready","site.styles":"ready","user.styles":"ready","ext.globalCssJs.user":"ready","user":"ready","user.options":"loading","ext.pygments":"ready","ext.cite.parsoid.styles":"ready","ext.cite.styles":"ready","mediawiki.skinning.content.parsoid":"ready","ext.wikimediamessages.styles":"ready","skins.vector.search.codex.styles":"ready","skins.vector.styles":"ready","skins.vector.icons":"ready","ext.visualEditor.desktopArticleTarget.noscript":"ready","ext.uls.interlanguage":"ready","wikibase.client.init":"ready"};RLPAGEMODULES=["ext.pygments.view","ext.cite.ux-enhancements","ext.scribunto.logs","site","mediawiki.page.ready","skins.vector.js","ext.centralNotice.geoIP","ext.centralNotice.startUp","ext.gadget.directLinkToCommons","ext.gadget.referenceTooltips","ext.gadget.sidebarRelated","ext.gadget.metaBox","ext.gadget.adminsStats","ext.gadget.markadmins","ext
8<script>(RLQ=window.RLQ||[]).push(function(){mw.loader.impl(function(){return["user.options@12s5i",function($,jQuery,require,module){mw.user.tokens.set({"patrolToken":"+\\","watchToken":"+\\","csrfToken":"+\\"});
9}];});});</script>
10<link rel="stylesheet" href="/w/load.php?lang=az&amp;modules=ext.cite.parsoid.styles%7Cext.cite.styles%7Cext.pygments%7Cext.uls.interlanguage%7Cext.visualEditor.desktopArticleTarget.noscript%7Cext.wikimediamessages.styles%7Cmediawiki.skinning.content.parsoid%7Cskins.vector.icons%2Cstyles%7Cskins.vector.search.codex.styles%7Cwikibase.client.init&amp;only=styles&amp;skin=vector-2022">
11<script async="" src="/w/load.php?lang=az&amp;modules=startup&amp;only=scripts&amp;raw=1&amp;skin=vector-2022"></script>
12<meta name="ResourceLoaderDynamicStyles" content="">
13<link rel="stylesheet" href="/w/load.php?lang=az&amp;modules=ext.gadget.Codex%2Ccommon-site%2CdarkModeFixes%2Clogo&amp;only=styles&amp;skin=vector-2022">
⋯5 lines
Contains a hardcoded remote HTTP(S) URL lines 27–35
27<link rel="search" type="application/opensearchdescription+xml" href="/w/rest.php/v1/search" title="Vikipediya (az)">
28<link rel="EditURI" type="application/rsd+xml" href="//az.wikipedia.org/w/api.php?action=rsd">
29<link rel="canonical" href="https://az.wikipedia.org/wiki/JScript">
30<link rel="license" href="https://creativecommons.org/licenses/by-sa/4.0/deed.az">
31<link rel="alternate" type="application/atom+xml" title="Vikipediya — Atom-lent" href="/w/index.php?title=X%C3%BCsusi:SonD%C9%99yi%C5%9Fiklikl%C9%99r&amp;feed=atom">
32<link rel="dns-prefetch" href="//meta.wikimedia.org" />
33<link rel="dns-prefetch" href="auth.wikimedia.org">
34</head>
35<body class="skin--responsive skin-vector skin-vector-search-vue mediawiki ltr sitedir-ltr mw-hide-empty-elt ns-0 ns-subject mw-editable page-JScript rootpage-JScript skin-vector-2022 action-view">
Contains Arabic or Urdu script lines 388–393
388 <ul class="vector-menu-content-list">
389
390 <li class="interlanguage-link interwiki-ar mw-list-item"><a href="https://ar.wikipedia.org/wiki/%D8%AC%D9%8A%D9%87_%D8%B3%D9%83%D8%B1%D9%8A%D8%A8%D8%AA" title="جيه سكريبت – ərəb" lang="ar" hreflang="ar" data-title="جيه سكريبت" data-language-autonym="العربية" data-language-local-name="ərəb" class="interlanguage-link-target"><span>العربية</span></a></li><li class="interlanguage-link interwiki-ca mw-list-item"><a href="https://ca.wikipedia.org/wiki/JScript" title="JScript – katalan" lang="ca" hreflang="ca" data-title="JScript" data-language-autonym="Català" data-language-local-name="katalan" class="interlanguage-link-target"><span>Català</span></a></li><li class="interlanguage-link interwiki-ckb mw-list-item"><a href="https://ckb.wikipedia.org/wiki/%D8%AC%DB%95%DB%8C%D8%B3%DA%A9%D8%B1%DB%8C%D9%BE%D8%AA" title="جەیسکریپت – Mərkəzi kürdcə" lang="ckb" hreflang="ckb" data-title="جەیسکریپت" data-language-autonym="کوردی" data-language-local-nam
391 </ul>
392 <div class="after-portlet after-portlet-lang"><span class="wb-langlinks-edit wb-langlinks-link"><a href="https://www.wikidata.org/wiki/Special:EntityPage/Q553514#sitelinks-wikipedia" title="Dillərarası keçidləri redaktə et" class="wbc-editpage">Keçidləri redaktə et</a></span></div>
393 </div>
HTTP URL ending in executable extension lines 844–848
844</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1px">İdarəetmə<br/>alətləri</th><td class="navbox-list navbox-odd" style="text-align:left;border-left-width:2px;border-left-style:solid;width:100%;padding:0px"><div style="padding:0em 0.25em">
845<ul><li><a rel="mw:WikiLink" href="https://az.wikipedia.org/wiki/App_Installer?action=edit&amp;redlink=1" title="App Installer (səhifə mövcud deyil)" class="new" typeof="mw:LocalizedAttrs" data-mw-i18n='{"title":{"lang":"x-page","key":"red-link-title","params":["App Installer"]}}'>App Installer</a></li>
846<li><a rel="mw:WikiLink" href="https://az.wikipedia.org/wiki/Cmd.exe" title="Cmd.exe">Command Prompt</a></li>
847<li><a rel="mw:WikiLink" href="https://az.wikipedia.org/wiki/İdarəetmə_paneli_(Windows)" title="İdarəetmə paneli (Windows)">Control Panel</a></li>
848<li><a rel="mw:WikiLink" href="https://az.wikipedia.org/wiki/Cihaz_meneceri?action=edit&amp;redlink=1" title="Cihaz meneceri (səhifə mövcud deyil)" class="new" typeof="mw:LocalizedAttrs" data-mw-i18n='{"title":{"lang":"x-page","key":"red-link-title","params":["Cihaz meneceri"]}}'>Cihaz meneceri</a></li>
Office/Productivity application names lines 899–903
899<li><a rel="mw:WikiLink" href="https://az.wikipedia.org/wiki/Windows_Notepad" title="Windows Notepad">Notepad</a></li>
900<li><a rel="mw:WikiLink" href="https://az.wikipedia.org/wiki/OneDrive" title="OneDrive">OneDrive</a></li>
901<li><a rel="mw:WikiLink" href="https://az.wikipedia.org/wiki/Microsoft_OneNote?action=edit&amp;redlink=1" title="Microsoft OneNote (səhifə mövcud deyil)" class="new" typeof="mw:LocalizedAttrs" data-mw-i18n='{"title":{"lang":"x-page","key":"red-link-title","params":["Microsoft OneNote"]}}'>OneNote</a></li>
902<li><a rel="mw:WikiLink" href="https://az.wikipedia.org/wiki/Microsoft_Paint" title="Microsoft Paint">Paint</a></li>
903<li><a rel="mw:WikiLink" href="https://az.wikipedia.org/wiki/Paint_3D?action=edit&amp;redlink=1" title="Paint 3D (səhifə mövcud deyil)" class="new" typeof="mw:LocalizedAttrs" data-mw-i18n='{"title":{"lang":"x-page","key":"red-link-title","params":["Paint 3D"]}}'>Paint 3D</a></li>

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.