Benign Download

virussign.com_04d39fc796416388a6107a2e157f2c00.vir

Browser download names archiveCloudflare Turnstile challenge API script URL

SHA-256facde14cb9bd7d1df2f311b7f85d006fd765044dc7c06d219cf67aa32988c35b

URLhttp://samples.virussign.com/samples/virussign.com_20261003_LimitedFree.zip

Evidence

Public cloud provider name (Cloudflare) lines 1–5

1﻿<!DOCTYPE html><html class="no-js" lang="en-US"><!--<![endif]--><head>
2  <title>Suspected Phishing | Cloudflare</title>
3  <meta charset="UTF-8">
4<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
5<meta http-equiv="X-UA-Com …

Reads browser cookieEnabled flag lines 10–21

10:30… 0}</style>
11
12
13<!--[if gte IE 10]><!-->
14<script>
15  if (!navigator.cookieEnabled) {
16    window.addEventListener('DOMContentLoaded', function () {
17      var cookieEl = document.getElementById('cookie-alert');
⋯4 lines

Contains a hardcoded remote HTTP(S) URL lines 52–62

52[id^="ad_slider"],
53[id^="section-ad-banner"],
54a-ad,
55a[onclick^="window.location.replace('https://random-affiliate.atimaze.com/"],
56a[style="width:100%;height:100%;z-index:10000000000000000;position:absolute;top:0;left:0;"],
57ad-shield-ads,
58ad-slot,
⋯4 lines

Assigns external URL to non-location href lines 119–127

119:10… stom,
120amp-connatix-player,
121amp-fx-flying-carpet,
122a[data-oburl^="https://paid.outbrain.com/network/redir?"],
123a[data-redirect^="https://paid.outbrain.com/network/redir?"],
124a[onmousedown^="this.href='https://paid.outbrain.com/network/redir?"] + .ob_source,
125[data-taboola-options],
126[data-testid="commercial-label-taboola"],
127[data-testid^ …

Browser code names payment-card data fields lines 140–144

140:21… t([style]) > div.captchaBody,
141html[lang] > body#body > * > div.cv-xwrapper > div.cvc > div.cv-inner,
142html[lang] > body#body > * > div.cvh.BlockClicksActivityBusy,
143html#html[sti][vic][lang] > body#allbody,
144html > b …