Edit tour

Windows Analysis Report
http://888.mixly.us.kg/

Overview

General Information

Sample URL:	http://888.mixly.us.kg/
Analysis ID:	1608870
Infos:

Detection

Score:	52
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

HTML page contains obfuscated javascript

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1416 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6404 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2236,i,5013916874469833490,17558059062716982547,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1092 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4416 --field-trial-handle=2236,i,5013916874469833490,17558059062716982547,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6620 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://888.mixly.us.kg/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://888.mixly.us.kg/

Avira URL Cloud: detection malicious, Label: phishing

Phishing

HTML page contains obfuscated javascript

Source: https://js.player.cntv.cn/creator/vodplayer.js

HTTP Parser: var a0_0x51f3=['7G179E7AA7A17G179P7A9','ui_webFullScreen','iPhone','zIndex','hasBarrage','barrageApp

Source: https://888.mixly.us.kg/	HTTP Parser: No favicon
Source: https://888.mixly.us.kg/	HTTP Parser: No favicon
Source: https://888.mixly.us.kg/	HTTP Parser: No favicon
Source: https://global.cctv.com/2025/02/04/VIDEybiYWadtnrWnvvCyjGsI250204.shtml	HTTP Parser: No favicon
Source: https://global.cctv.com/2025/02/04/VIDEybiYWadtnrWnvvCyjGsI250204.shtml	HTTP Parser: No favicon
Source: https://global.cctv.com/2025/02/04/VIDEybiYWadtnrWnvvCyjGsI250204.shtml	HTTP Parser: No favicon
Source: https://global.cctv.com/2025/02/04/VIDEybiYWadtnrWnvvCyjGsI250204.shtml	HTTP Parser: No favicon
Source: https://global.cctv.com/2025/02/06/VIDE4NnTbvNJwk77JqSWZTlH250206.shtml	HTTP Parser: No favicon
Source: https://global.cctv.com/2025/02/06/VIDE4NnTbvNJwk77JqSWZTlH250206.shtml	HTTP Parser: No favicon
Source: https://global.cctv.com/2025/02/06/VIDE4NnTbvNJwk77JqSWZTlH250206.shtml	HTTP Parser: No favicon
Source: https://global.cctv.com/2025/02/06/VIDE4NnTbvNJwk77JqSWZTlH250206.shtml	HTTP Parser: No favicon

Source: chromecache_479.3.dr, chromecache_354.3.dr	String found in binary or memory: http://jsfiddle.net/NDYV8/16/
Source: chromecache_479.3.dr, chromecache_354.3.dr	String found in binary or memory: http://jsfiddle.net/NDYV8/19/
Source: chromecache_413.3.dr, chromecache_358.3.dr	String found in binary or memory: http://ns.attribution.com/ads/1.0/
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: http://p2.img.cctvpic.com/fmspic/2015/04/21/3c54a67ca29244bf940716d57d3b4cd3-1321.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: http://p2.img.cctvpic.com/fmspic/2015/04/21/3c54a67ca29244bf940716d57d3b4cd3-2714.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: http://p3.img.cctvpic.com/fmspic/2015/04/21/3c54a67ca29244bf940716d57d3b4cd3-10.jpg
Source: chromecache_258.3.dr, chromecache_527.3.dr	String found in binary or memory: http://videojs.com/
Source: chromecache_479.3.dr, chromecache_354.3.dr	String found in binary or memory: http://www.lalit.org/lab/javascript-css-font-detect/
Source: chromecache_479.3.dr, chromecache_354.3.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_479.3.dr, chromecache_354.3.dr	String found in binary or memory: http://www.stucox.com/blog/you-cant-detect-a-touchscreen/
Source: chromecache_479.3.dr, chromecache_354.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=781447
Source: chromecache_578.3.dr, chromecache_551.3.dr	String found in binary or memory: https://dh5.cntv.cdn20.com/asp/h5e/hls/main/0303000a/3/default/5d60cdb5cdcd40af8c46095a5ffcac29/main
Source: chromecache_578.3.dr, chromecache_551.3.dr	String found in binary or memory: https://dhls.cntv.cdn20.com/asp/audio/5/d/6/0/5d60cdb5cdcd40af8c46095a5ffcac29/mp3/main.m3u8
Source: chromecache_578.3.dr, chromecache_551.3.dr	String found in binary or memory: https://dhls.cntv.cdn20.com/asp/enc/hls/main/0303000a/3/default/5d60cdb5cdcd40af8c46095a5ffcac29/mai
Source: chromecache_578.3.dr, chromecache_551.3.dr	String found in binary or memory: https://dhls.cntv.cdn20.com/asp/hlsaudio/hls/main/0303000a/3/default/5d60cdb5cdcd40af8c46095a5ffcac2
Source: chromecache_578.3.dr, chromecache_551.3.dr	String found in binary or memory: https://dhls2.cntv.cdn20.com/asp/enc2/hls/main/0303000a/3/default/5d60cdb5cdcd40af8c46095a5ffcac29/m
Source: chromecache_391.3.dr	String found in binary or memory: https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=9
Source: chromecache_479.3.dr, chromecache_354.3.dr	String found in binary or memory: https://github.com/Modernizr/Modernizr/blob/master/feature-detects/canvas/winding.js
Source: chromecache_479.3.dr, chromecache_354.3.dr	String found in binary or memory: https://github.com/Modernizr/Modernizr/issues/548
Source: chromecache_479.3.dr, chromecache_354.3.dr	String found in binary or memory: https://github.com/Valve/fingerprintjs2
Source: chromecache_479.3.dr, chromecache_354.3.dr	String found in binary or memory: https://github.com/Valve/fingerprintjs2/issues/66
Source: chromecache_258.3.dr, chromecache_527.3.dr	String found in binary or memory: https://github.com/kesla/parse-headers/
Source: chromecache_258.3.dr, chromecache_527.3.dr	String found in binary or memory: https://github.com/kesla/parse-headers/blob/master/LICENCE
Source: chromecache_258.3.dr, chromecache_527.3.dr	String found in binary or memory: https://github.com/mozilla/vtt.js
Source: chromecache_258.3.dr, chromecache_527.3.dr	String found in binary or memory: https://github.com/mozilla/vtt.js/blob/main/LICENSE
Source: chromecache_258.3.dr, chromecache_527.3.dr	String found in binary or memory: https://github.com/videojs/video.js/blob/main/LICENSE
Source: chromecache_474.3.dr	String found in binary or memory: https://global.cctv.com/2024/11/03/VIDE00WMMkTMawWEVvRjeFZU241103.shtml
Source: chromecache_474.3.dr	String found in binary or memory: https://global.cctv.com/2024/11/03/VIDE57d1ZMADGjMY4qWDGIyO241103.shtml
Source: chromecache_474.3.dr	String found in binary or memory: https://global.cctv.com/2024/11/03/VIDE7cTPs5HjXhNm6gsZC2uP241103.shtml
Source: chromecache_474.3.dr	String found in binary or memory: https://global.cctv.com/2024/11/03/VIDEP2AJP05wlu9b7g0OukSg241103.shtml
Source: chromecache_474.3.dr	String found in binary or memory: https://global.cctv.com/2024/11/03/VIDEWKeerOcVwNSv1EbdTjfo241103.shtml
Source: chromecache_474.3.dr	String found in binary or memory: https://global.cctv.com/2024/11/07/VIDE69ABse1ynS8TqypFrVJ4241107.shtml
Source: chromecache_474.3.dr	String found in binary or memory: https://global.cctv.com/2024/11/12/VIDEX2hrwzAbfCEBmt41fZCP241112.shtml
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://global.cctv.com/2024/11/14/VIDERKeZQdhygtIyHX3PY8bt241114.shtml
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://global.cctv.com/2024/11/14/VIDEYEC3jiFYBBYGSeCvyCsz241114.shtml
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://global.cctv.com/2024/11/14/VIDElfQQtIgzzzwOpHw29yh5241114.shtml
Source: chromecache_474.3.dr	String found in binary or memory: https://global.cctv.com/2024/11/22/VIDEWSB4KwKIPeminssHFtKB241122.shtml
Source: chromecache_474.3.dr	String found in binary or memory: https://global.cctv.com/2024/11/27/VIDE6R8sdOnaoJD4liCwbbAV241127.shtml
Source: chromecache_474.3.dr	String found in binary or memory: https://global.cctv.com/2024/12/03/VIDE3VlPHb0GJ5BFmH6B8wid241203.shtml
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://global.cctv.com/2024/12/04/VIDE3SuMJLq97GA7XRe3ztIl241204.shtml
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://global.cctv.com/2024/12/06/VIDE43PMmdH3ky44ODjXy0k5241206.shtml
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://global.cctv.com/2024/12/06/VIDEQL44pOaZa5DwRnaWJZWK241206.shtml
Source: chromecache_474.3.dr	String found in binary or memory: https://global.cctv.com/2024/12/10/VIDEnlrIFgWWq1iIcIafDYTj241210.shtml
Source: chromecache_474.3.dr	String found in binary or memory: https://global.cctv.com/2024/12/17/VIDEipwD6cDS7BKqqfLsDlLi241217.shtml
Source: chromecache_474.3.dr	String found in binary or memory: https://global.cctv.com/2024/12/27/VIDEY2rRHuTmjW2AbJdqXaXa241227.shtml
Source: chromecache_474.3.dr	String found in binary or memory: https://global.cctv.com/2024/12/31/VIDESd7oTQcka90G4VTWZgsB241231.shtml
Source: chromecache_474.3.dr	String found in binary or memory: https://global.cctv.com/2025/01/07/VIDEkEw5xA8clKYmw6eON0OG250107.shtml
Source: chromecache_474.3.dr	String found in binary or memory: https://global.cctv.com/2025/01/14/VIDEQHPeuQn9iGmZk4ZLpfch250114.shtml
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://global.cctv.com/2025/01/17/VIDE2ZAnd1zluFZdshrPRUU6250117.shtml
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://global.cctv.com/2025/01/17/VIDE6KRxOqFYk1XvD6xgMA4D250117.shtml
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://global.cctv.com/2025/01/17/VIDETJQ1QB1byOLu0uUHgckf250117.shtml
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://global.cctv.com/2025/01/17/VIDEZuR08BtkT2E1FiAYrl00250117.shtml
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://global.cctv.com/2025/01/21/VIDEYsMj0ldiQrXFAaKvoWCU250121.shtml
Source: chromecache_474.3.dr	String found in binary or memory: https://global.cctv.com/2025/01/22/VIDE44vchVcs64COSXEqPRjJ250122.shtml
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://global.cctv.com/2025/01/27/VIDETaz8pHjMo4ElMiRLIpBW250127.shtml
Source: chromecache_474.3.dr, chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://global.cctv.com/2025/01/27/VIDEY6pbLQGPgjOK6F0I3bdb250127.shtml
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://global.cctv.com/2025/01/27/VIDEhzTVgmmoo3xnpeosudRs250127.shtml
Source: chromecache_474.3.dr, chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://global.cctv.com/2025/02/04/VIDEybiYWadtnrWnvvCyjGsI250204.shtml
Source: chromecache_474.3.dr, chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://global.cctv.com/2025/02/06/VIDE4NnTbvNJwk77JqSWZTlH250206.shtml
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://global.cctv.com/2025/02/06/VIDEMUqmqt1U3q19yeOMQpXp250206.shtml
Source: chromecache_578.3.dr, chromecache_551.3.dr	String found in binary or memory: https://hls.cntv.cdn20.com/asp/hls/main/0303000a/3/default/5d60cdb5cdcd40af8c46095a5ffcac29/main.m3u
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p1.img.cctvpic.com/fmspic/2023/01/17/2a6d1ccc3852408392ff08706460e48e-41287973-2.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p1.img.cctvpic.com/fmspic/2024/11/03/76b7a926be8147cb8ca6022366979a18-300.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p1.img.cctvpic.com/fmspic/2024/11/12/35bf524c7a0c4a5dbae59fbe22f3653c-1.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p1.img.cctvpic.com/fmspic/2024/11/27/5543c06b05bb4596b9bb8f411aeaa82f-1.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p1.img.cctvpic.com/fmspic/2024/12/04/3974a1337c0844e9b691520072659264-300.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p1.img.cctvpic.com/fmspic/2025/01/07/f4d4981c63ad47ad9b0b436df933de91-300.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p1.img.cctvpic.com/fmspic/2025/01/14/1bba66b961e246d3b9baeaf3a166164f-1.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p1.img.cctvpic.com/fmspic/2025/01/27/203ce7c7867d4ac1814bbec34e92d849-300.jpg
Source: chromecache_392.3.dr	String found in binary or memory: https://p1.img.cctvpic.com/fmspic/2025/02/04/f39f74da3ba14825b75a6431b3c79bc4-1.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p1.img.cctvpic.com/photoworkspace/2024/11/22/2024112210150936333.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p1.img.cctvpic.com/photoworkspace/2025/01/27/2025012717220529870.png
Source: chromecache_474.3.dr	String found in binary or memory: https://p2.img.cctvpic.com/fmspic/2024/11/03/571357eb4be947d4ab13181cb7d7558e-300.jpg
Source: chromecache_392.3.dr	String found in binary or memory: https://p2.img.cctvpic.com/fmspic/2024/12/06/a70f6aa0f7ff44f996febb1b4a7bd85f-1.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p2.img.cctvpic.com/fmspic/2024/12/17/2cafba71f31a4a30b209d04472fc4b4f-300.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p2.img.cctvpic.com/fmspic/2025/01/22/be19a3ef37a04c8d86b2b4a3c1273578-1.jpg
Source: chromecache_392.3.dr	String found in binary or memory: https://p2.img.cctvpic.com/fmspic/2025/02/06/54e50efbfd3941c997327042b2a326c0-1.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p2.img.cctvpic.com/photoworkspace/2024/12/03/2024120314061337900.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p2.img.cctvpic.com/photoworkspace/2024/12/27/2024122714504016973.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p2.img.cctvpic.com/photoworkspace/2025/01/17/2025011716100791275.png
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/fmspic/2023/11/13/830615d74a2147e6a8a093ea74568003-1.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/fmspic/2023/11/13/830615d74a2147e6a8a093ea74568003-46506577-0.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/fmspic/2023/11/13/830615d74a2147e6a8a093ea74568003-46506577-2.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/11/03/1cb1af9252224be98bd243af4592d594-1.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/11/03/1cb1af9252224be98bd243af4592d594-300.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/11/03/22f4a69a46e840fc812ac3cc98871ca4-1.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/11/07/6c7c887889ce4740bfed02a125f9d37d-300.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/11/12/35bf524c7a0c4a5dbae59fbe22f3653c-300.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/12/03/9aa26225e7f746ecb26783a5535f4d4f-1.jpg
Source: chromecache_392.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/12/04/3974a1337c0844e9b691520072659264-1.jpg
Source: chromecache_392.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/12/06/a5bf28aeeacb4a03840f7ec928314db2-1.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/12/17/2cafba71f31a4a30b209d04472fc4b4f-1.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/12/27/4d7c20ef7ed7402087b9dc56fcb5d59e-1.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/12/27/4d7c20ef7ed7402087b9dc56fcb5d59e-300.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/fmspic/2024/12/31/66b031436eb54a248a76dd64408cc6ea-300.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/fmspic/2025/01/17/98eec5744f634da69d19b50596a79b1a-300.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/fmspic/2025/01/22/be19a3ef37a04c8d86b2b4a3c1273578-300.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/fmspic/2025/01/27/203ce7c7867d4ac1814bbec34e92d849-1.jpg
Source: chromecache_474.3.dr, chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/fmspic/2025/01/27/81b6d8a1bcb544b7a503630e8acebf42-1.jpg
Source: chromecache_474.3.dr, chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/fmspic/2025/01/27/81b6d8a1bcb544b7a503630e8acebf42-300.jpg
Source: chromecache_474.3.dr, chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/fmspic/2025/02/04/f39f74da3ba14825b75a6431b3c79bc4-300.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/photoworkspace/2025/01/21/2025012117463081616.png
Source: chromecache_474.3.dr, chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/photoworkspace/2025/01/27/2025012714583875799.jpg
Source: chromecache_474.3.dr, chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p3.img.cctvpic.com/photoworkspace/2025/02/06/2025020613581254371.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p4.img.cctvpic.com/fmspic/2022/02/01/188b2481e7ff471aa7bf75c81bf218da-1.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p4.img.cctvpic.com/fmspic/2022/02/01/188b2481e7ff471aa7bf75c81bf218da-36082649-2.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p4.img.cctvpic.com/fmspic/2023/01/17/2a6d1ccc3852408392ff08706460e48e-41287973-0.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p4.img.cctvpic.com/fmspic/2024/11/03/22f4a69a46e840fc812ac3cc98871ca4-300.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p4.img.cctvpic.com/fmspic/2024/11/03/76b7a926be8147cb8ca6022366979a18-1.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p4.img.cctvpic.com/fmspic/2024/11/27/5543c06b05bb4596b9bb8f411aeaa82f-300.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p4.img.cctvpic.com/fmspic/2024/12/06/a70f6aa0f7ff44f996febb1b4a7bd85f-300.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p4.img.cctvpic.com/fmspic/2024/12/10/b96e596d1a46421585833f943386f1b4-1.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p4.img.cctvpic.com/fmspic/2024/12/10/b96e596d1a46421585833f943386f1b4-300.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p4.img.cctvpic.com/fmspic/2025/01/14/1bba66b961e246d3b9baeaf3a166164f-300.jpg
Source: chromecache_392.3.dr	String found in binary or memory: https://p4.img.cctvpic.com/fmspic/2025/01/17/5b745e2639fb452da06d91712d7207a1-1.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p4.img.cctvpic.com/fmspic/2025/01/17/5b745e2639fb452da06d91712d7207a1-300.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p4.img.cctvpic.com/fmspic/2025/01/17/82edbd2f9ee048f2b4e3e582302c630c-300.jpg
Source: chromecache_392.3.dr	String found in binary or memory: https://p4.img.cctvpic.com/fmspic/2025/01/17/98eec5744f634da69d19b50596a79b1a-1.jpg
Source: chromecache_392.3.dr	String found in binary or memory: https://p4.img.cctvpic.com/fmspic/2025/01/27/44d682753d8c41e8b92be983afc03d53-1.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p4.img.cctvpic.com/fmspic/2025/01/27/44d682753d8c41e8b92be983afc03d53-300.jpg
Source: chromecache_474.3.dr, chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p4.img.cctvpic.com/fmspic/2025/02/06/5d60cdb5cdcd40af8c46095a5ffcac29-1.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p4.img.cctvpic.com/photoworkspace/2025/01/22/2025012211055516232.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p4.img.cctvpic.com/photoworkspace/2025/02/06/2025020617085244836.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p5.img.cctvpic.com/fmspic/2022/02/01/188b2481e7ff471aa7bf75c81bf218da-36082649-0.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p5.img.cctvpic.com/fmspic/2024/11/03/0324a65ff83e470ab93d76c97b1b6108-1.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p5.img.cctvpic.com/fmspic/2024/11/03/0324a65ff83e470ab93d76c97b1b6108-300.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p5.img.cctvpic.com/fmspic/2024/11/03/571357eb4be947d4ab13181cb7d7558e-1.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p5.img.cctvpic.com/fmspic/2024/11/07/6c7c887889ce4740bfed02a125f9d37d-1.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p5.img.cctvpic.com/fmspic/2024/12/03/9aa26225e7f746ecb26783a5535f4d4f-300.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p5.img.cctvpic.com/fmspic/2024/12/06/a5bf28aeeacb4a03840f7ec928314db2-300.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p5.img.cctvpic.com/fmspic/2024/12/31/66b031436eb54a248a76dd64408cc6ea-1.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p5.img.cctvpic.com/fmspic/2025/01/07/f4d4981c63ad47ad9b0b436df933de91-1.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p5.img.cctvpic.com/fmspic/2025/01/17/0692dae40c5240cdb45cab03a78bb4b5-1.jpg
Source: chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p5.img.cctvpic.com/fmspic/2025/01/17/0692dae40c5240cdb45cab03a78bb4b5-300.jpg
Source: chromecache_392.3.dr	String found in binary or memory: https://p5.img.cctvpic.com/fmspic/2025/01/17/82edbd2f9ee048f2b4e3e582302c630c-1.jpg
Source: chromecache_551.3.dr	String found in binary or memory: https://p5.img.cctvpic.com/fmspic/2025/02/06/5d60cdb5cdcd40af8c46095a5ffcac29-180.jpg
Source: chromecache_474.3.dr, chromecache_388.3.dr, chromecache_392.3.dr	String found in binary or memory: https://p5.img.cctvpic.com/fmspic/2025/02/06/5d60cdb5cdcd40af8c46095a5ffcac29-300.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p5.img.cctvpic.com/photoworkspace/2024/11/07/2024110711142612707.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p5.img.cctvpic.com/photoworkspace/2024/11/13/2024111311252714720.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p5.img.cctvpic.com/photoworkspace/2024/11/27/2024112715090749784.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p5.img.cctvpic.com/photoworkspace/2025/01/03/2025010316300876860.jpg
Source: chromecache_474.3.dr	String found in binary or memory: https://p5.img.cctvpic.com/photoworkspace/2025/01/14/2025011415411893350.jpg
Source: chromecache_464.3.dr	String found in binary or memory: https://tv.cctv.com/cctv4asia/
Source: chromecache_258.3.dr, chromecache_527.3.dr	String found in binary or memory: https://www.brightcove.com/
Source: chromecache_479.3.dr, chromecache_354.3.dr	String found in binary or memory: https://www.browserleaks.com/canvas#how-does-it-work

Source: classification engine

Classification label: mal52.phis.win@20/546@0/30

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2236,i,5013916874469833490,17558059062716982547,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://888.mixly.us.kg/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4416 --field-trial-handle=2236,i,5013916874469833490,17558059062716982547,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2236,i,5013916874469833490,17558059062716982547,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4416 --field-trial-handle=2236,i,5013916874469833490,17558059062716982547,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://888.mixly.us.kg/	100%	Avira URL Cloud	phishing

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://global.cctv.com/2024/12/17/VIDEipwD6cDS7BKqqfLsDlLi241217.shtml	0%	Avira URL Cloud	safe
https://global.cctv.com/2024/12/06/VIDEQL44pOaZa5DwRnaWJZWK241206.shtml	0%	Avira URL Cloud	safe
https://dhls.cntv.cdn20.com/asp/hlsaudio/hls/main/0303000a/3/default/5d60cdb5cdcd40af8c46095a5ffcac2	0%	Avira URL Cloud	safe
https://global.cctv.com/2024/11/14/VIDElfQQtIgzzzwOpHw29yh5241114.shtml	0%	Avira URL Cloud	safe
https://global.cctv.com/2025/01/17/VIDEZuR08BtkT2E1FiAYrl00250117.shtml	0%	Avira URL Cloud	safe
https://global.cctv.com/2024/11/03/VIDEP2AJP05wlu9b7g0OukSg241103.shtml	0%	Avira URL Cloud	safe
https://dhls2.cntv.cdn20.com/asp/enc2/hls/main/0303000a/3/default/5d60cdb5cdcd40af8c46095a5ffcac29/m	0%	Avira URL Cloud	safe
https://global.cctv.com/2024/11/14/VIDEYEC3jiFYBBYGSeCvyCsz241114.shtml	0%	Avira URL Cloud	safe
https://global.cctv.com/2025/01/17/VIDE2ZAnd1zluFZdshrPRUU6250117.shtml	0%	Avira URL Cloud	safe
https://global.cctv.com/2024/11/12/VIDEX2hrwzAbfCEBmt41fZCP241112.shtml	0%	Avira URL Cloud	safe
https://global.cctv.com/2025/01/27/VIDETaz8pHjMo4ElMiRLIpBW250127.shtml	0%	Avira URL Cloud	safe
https://global.cctv.com/2024/12/04/VIDE3SuMJLq97GA7XRe3ztIl241204.shtml	0%	Avira URL Cloud	safe
https://global.cctv.com/2024/12/06/VIDE43PMmdH3ky44ODjXy0k5241206.shtml	0%	Avira URL Cloud	safe
https://global.cctv.com/2024/11/03/VIDE7cTPs5HjXhNm6gsZC2uP241103.shtml	0%	Avira URL Cloud	safe
https://global.cctv.com/2025/01/17/VIDE6KRxOqFYk1XvD6xgMA4D250117.shtml	0%	Avira URL Cloud	safe
https://global.cctv.com/2024/11/03/VIDEWKeerOcVwNSv1EbdTjfo241103.shtml	0%	Avira URL Cloud	safe
https://global.cctv.com/2024/12/03/VIDE3VlPHb0GJ5BFmH6B8wid241203.shtml	0%	Avira URL Cloud	safe
https://global.cctv.com/2024/12/10/VIDEnlrIFgWWq1iIcIafDYTj241210.shtml	0%	Avira URL Cloud	safe
https://global.cctv.com/2024/11/03/VIDE57d1ZMADGjMY4qWDGIyO241103.shtml	0%	Avira URL Cloud	safe
https://global.cctv.com/2025/01/27/VIDEY6pbLQGPgjOK6F0I3bdb250127.shtml	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Reputation
https://global.cctv.com/2025/02/04/VIDEybiYWadtnrWnvvCyjGsI250204.shtml	false	unknown
https://888.mixly.us.kg/	false	unknown
https://global.cctv.com/2025/02/06/VIDE4NnTbvNJwk77JqSWZTlH250206.shtml	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://p5.img.cctvpic.com/fmspic/2024/12/31/66b031436eb54a248a76dd64408cc6ea-1.jpg	chromecache_474.3.dr	false		high
https://dhls.cntv.cdn20.com/asp/hlsaudio/hls/main/0303000a/3/default/5d60cdb5cdcd40af8c46095a5ffcac2	chromecache_578.3.dr, chromecache_551.3.dr	false	Avira URL Cloud: safe	unknown
https://p4.img.cctvpic.com/fmspic/2024/11/27/5543c06b05bb4596b9bb8f411aeaa82f-300.jpg	chromecache_474.3.dr	false		high
http://p3.img.cctvpic.com/fmspic/2015/04/21/3c54a67ca29244bf940716d57d3b4cd3-10.jpg	chromecache_388.3.dr, chromecache_392.3.dr	false		high
https://p1.img.cctvpic.com/fmspic/2024/11/03/76b7a926be8147cb8ca6022366979a18-300.jpg	chromecache_474.3.dr	false		high
https://p1.img.cctvpic.com/fmspic/2025/01/27/203ce7c7867d4ac1814bbec34e92d849-300.jpg	chromecache_388.3.dr, chromecache_392.3.dr	false		high
https://p3.img.cctvpic.com/fmspic/2024/12/27/4d7c20ef7ed7402087b9dc56fcb5d59e-1.jpg	chromecache_474.3.dr	false		high
https://p2.img.cctvpic.com/fmspic/2024/12/17/2cafba71f31a4a30b209d04472fc4b4f-300.jpg	chromecache_474.3.dr	false		high
http://p2.img.cctvpic.com/fmspic/2015/04/21/3c54a67ca29244bf940716d57d3b4cd3-1321.jpg	chromecache_388.3.dr, chromecache_392.3.dr	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=781447	chromecache_479.3.dr, chromecache_354.3.dr	false		high
https://p3.img.cctvpic.com/fmspic/2025/01/22/be19a3ef37a04c8d86b2b4a3c1273578-300.jpg	chromecache_474.3.dr	false		high
https://p3.img.cctvpic.com/fmspic/2024/12/06/a5bf28aeeacb4a03840f7ec928314db2-1.jpg	chromecache_392.3.dr	false		high
http://jsfiddle.net/NDYV8/16/	chromecache_479.3.dr, chromecache_354.3.dr	false		high
https://p3.img.cctvpic.com/fmspic/2024/11/12/35bf524c7a0c4a5dbae59fbe22f3653c-300.jpg	chromecache_474.3.dr	false		high
https://p2.img.cctvpic.com/fmspic/2024/12/06/a70f6aa0f7ff44f996febb1b4a7bd85f-1.jpg	chromecache_392.3.dr	false		high
https://dhls2.cntv.cdn20.com/asp/enc2/hls/main/0303000a/3/default/5d60cdb5cdcd40af8c46095a5ffcac29/m	chromecache_578.3.dr, chromecache_551.3.dr	false	Avira URL Cloud: safe	unknown
https://p3.img.cctvpic.com/fmspic/2025/01/27/81b6d8a1bcb544b7a503630e8acebf42-1.jpg	chromecache_474.3.dr, chromecache_388.3.dr, chromecache_392.3.dr	false		high
https://p2.img.cctvpic.com/fmspic/2025/02/06/54e50efbfd3941c997327042b2a326c0-1.jpg	chromecache_392.3.dr	false		high
http://p2.img.cctvpic.com/fmspic/2015/04/21/3c54a67ca29244bf940716d57d3b4cd3-2714.jpg	chromecache_388.3.dr, chromecache_392.3.dr	false		high
http://ns.attribution.com/ads/1.0/	chromecache_413.3.dr, chromecache_358.3.dr	false		high
https://p5.img.cctvpic.com/fmspic/2024/11/03/571357eb4be947d4ab13181cb7d7558e-1.jpg	chromecache_474.3.dr	false		high
https://p4.img.cctvpic.com/fmspic/2024/12/06/a70f6aa0f7ff44f996febb1b4a7bd85f-300.jpg	chromecache_388.3.dr, chromecache_392.3.dr	false		high
https://global.cctv.com/2024/12/17/VIDEipwD6cDS7BKqqfLsDlLi241217.shtml	chromecache_474.3.dr	false	Avira URL Cloud: safe	unknown
https://p2.img.cctvpic.com/photoworkspace/2025/01/17/2025011716100791275.png	chromecache_388.3.dr, chromecache_392.3.dr	false		high
https://p5.img.cctvpic.com/fmspic/2025/01/17/82edbd2f9ee048f2b4e3e582302c630c-1.jpg	chromecache_392.3.dr	false		high
http://www.stucox.com/blog/you-cant-detect-a-touchscreen/	chromecache_479.3.dr, chromecache_354.3.dr	false		high
https://p5.img.cctvpic.com/fmspic/2025/02/06/5d60cdb5cdcd40af8c46095a5ffcac29-180.jpg	chromecache_551.3.dr	false		high
http://jsfiddle.net/NDYV8/19/	chromecache_479.3.dr, chromecache_354.3.dr	false		high
https://p5.img.cctvpic.com/fmspic/2022/02/01/188b2481e7ff471aa7bf75c81bf218da-36082649-0.jpg	chromecache_388.3.dr, chromecache_392.3.dr	false		high
https://p4.img.cctvpic.com/fmspic/2025/01/17/82edbd2f9ee048f2b4e3e582302c630c-300.jpg	chromecache_388.3.dr, chromecache_392.3.dr	false		high
https://github.com/kesla/parse-headers/	chromecache_258.3.dr, chromecache_527.3.dr	false		high
https://tv.cctv.com/cctv4asia/	chromecache_464.3.dr	false		high
https://p5.img.cctvpic.com/fmspic/2025/01/17/0692dae40c5240cdb45cab03a78bb4b5-300.jpg	chromecache_388.3.dr, chromecache_392.3.dr	false		high
https://p5.img.cctvpic.com/fmspic/2025/01/07/f4d4981c63ad47ad9b0b436df933de91-1.jpg	chromecache_474.3.dr	false		high
https://global.cctv.com/2025/01/17/VIDEZuR08BtkT2E1FiAYrl00250117.shtml	chromecache_388.3.dr, chromecache_392.3.dr	false	Avira URL Cloud: safe	unknown
https://global.cctv.com/2024/11/14/VIDElfQQtIgzzzwOpHw29yh5241114.shtml	chromecache_388.3.dr, chromecache_392.3.dr	false	Avira URL Cloud: safe	unknown
https://global.cctv.com/2024/12/06/VIDEQL44pOaZa5DwRnaWJZWK241206.shtml	chromecache_388.3.dr, chromecache_392.3.dr	false	Avira URL Cloud: safe	unknown
https://p5.img.cctvpic.com/fmspic/2024/11/03/0324a65ff83e470ab93d76c97b1b6108-300.jpg	chromecache_474.3.dr	false		high
https://p4.img.cctvpic.com/fmspic/2025/01/17/5b745e2639fb452da06d91712d7207a1-1.jpg	chromecache_392.3.dr	false		high
https://p4.img.cctvpic.com/photoworkspace/2025/01/22/2025012211055516232.jpg	chromecache_474.3.dr	false		high
https://global.cctv.com/2024/11/14/VIDEYEC3jiFYBBYGSeCvyCsz241114.shtml	chromecache_388.3.dr, chromecache_392.3.dr	false	Avira URL Cloud: safe	unknown
https://global.cctv.com/2024/11/03/VIDEP2AJP05wlu9b7g0OukSg241103.shtml	chromecache_474.3.dr	false	Avira URL Cloud: safe	unknown
https://p3.img.cctvpic.com/fmspic/2024/11/07/6c7c887889ce4740bfed02a125f9d37d-300.jpg	chromecache_474.3.dr	false		high
https://global.cctv.com/2024/11/12/VIDEX2hrwzAbfCEBmt41fZCP241112.shtml	chromecache_474.3.dr	false	Avira URL Cloud: safe	unknown
https://p3.img.cctvpic.com/fmspic/2023/11/13/830615d74a2147e6a8a093ea74568003-46506577-0.jpg	chromecache_388.3.dr, chromecache_392.3.dr	false		high
https://p5.img.cctvpic.com/fmspic/2025/02/06/5d60cdb5cdcd40af8c46095a5ffcac29-300.jpg	chromecache_474.3.dr, chromecache_388.3.dr, chromecache_392.3.dr	false		high
http://www.opensource.org/licenses/mit-license.php)	chromecache_479.3.dr, chromecache_354.3.dr	false		high
http://videojs.com/	chromecache_258.3.dr, chromecache_527.3.dr	false		high
https://github.com/videojs/video.js/blob/main/LICENSE	chromecache_258.3.dr, chromecache_527.3.dr	false		high
https://p3.img.cctvpic.com/fmspic/2024/11/03/22f4a69a46e840fc812ac3cc98871ca4-1.jpg	chromecache_474.3.dr	false		high
https://p3.img.cctvpic.com/fmspic/2024/12/27/4d7c20ef7ed7402087b9dc56fcb5d59e-300.jpg	chromecache_474.3.dr	false		high
https://p3.img.cctvpic.com/photoworkspace/2025/01/21/2025012117463081616.png	chromecache_388.3.dr, chromecache_392.3.dr	false		high
https://global.cctv.com/2025/01/17/VIDE2ZAnd1zluFZdshrPRUU6250117.shtml	chromecache_388.3.dr, chromecache_392.3.dr	false	Avira URL Cloud: safe	unknown
https://p4.img.cctvpic.com/fmspic/2024/11/03/22f4a69a46e840fc812ac3cc98871ca4-300.jpg	chromecache_474.3.dr	false		high
https://github.com/mozilla/vtt.js	chromecache_258.3.dr, chromecache_527.3.dr	false		high
https://global.cctv.com/2024/11/03/VIDE7cTPs5HjXhNm6gsZC2uP241103.shtml	chromecache_474.3.dr	false	Avira URL Cloud: safe	unknown
https://global.cctv.com/2025/01/17/VIDE6KRxOqFYk1XvD6xgMA4D250117.shtml	chromecache_388.3.dr, chromecache_392.3.dr	false	Avira URL Cloud: safe	unknown
https://p3.img.cctvpic.com/fmspic/2025/01/27/81b6d8a1bcb544b7a503630e8acebf42-300.jpg	chromecache_474.3.dr, chromecache_388.3.dr, chromecache_392.3.dr	false		high
https://p4.img.cctvpic.com/fmspic/2025/01/17/98eec5744f634da69d19b50596a79b1a-1.jpg	chromecache_392.3.dr	false		high
https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=9	chromecache_391.3.dr	false		high
https://github.com/Modernizr/Modernizr/blob/master/feature-detects/canvas/winding.js	chromecache_479.3.dr, chromecache_354.3.dr	false		high
https://global.cctv.com/2024/12/06/VIDE43PMmdH3ky44ODjXy0k5241206.shtml	chromecache_388.3.dr, chromecache_392.3.dr	false	Avira URL Cloud: safe	unknown
https://p5.img.cctvpic.com/fmspic/2024/12/03/9aa26225e7f746ecb26783a5535f4d4f-300.jpg	chromecache_474.3.dr	false		high
https://p1.img.cctvpic.com/fmspic/2025/02/04/f39f74da3ba14825b75a6431b3c79bc4-1.jpg	chromecache_392.3.dr	false		high
https://p5.img.cctvpic.com/photoworkspace/2024/11/27/2024112715090749784.jpg	chromecache_474.3.dr	false		high
https://www.brightcove.com/	chromecache_258.3.dr, chromecache_527.3.dr	false		high
https://global.cctv.com/2025/01/14/VIDEQHPeuQn9iGmZk4ZLpfch250114.shtml	chromecache_474.3.dr	false		high
https://p4.img.cctvpic.com/fmspic/2024/12/10/b96e596d1a46421585833f943386f1b4-1.jpg	chromecache_474.3.dr	false		high
https://p5.img.cctvpic.com/photoworkspace/2025/01/14/2025011415411893350.jpg	chromecache_474.3.dr	false		high
https://p1.img.cctvpic.com/photoworkspace/2025/01/27/2025012717220529870.png	chromecache_388.3.dr, chromecache_392.3.dr	false		high
https://global.cctv.com/2024/11/03/VIDEWKeerOcVwNSv1EbdTjfo241103.shtml	chromecache_474.3.dr	false	Avira URL Cloud: safe	unknown
https://p3.img.cctvpic.com/fmspic/2023/11/13/830615d74a2147e6a8a093ea74568003-46506577-2.jpg	chromecache_388.3.dr, chromecache_392.3.dr	false		high
https://global.cctv.com/2025/01/27/VIDETaz8pHjMo4ElMiRLIpBW250127.shtml	chromecache_388.3.dr, chromecache_392.3.dr	false	Avira URL Cloud: safe	unknown
https://global.cctv.com/2024/12/04/VIDE3SuMJLq97GA7XRe3ztIl241204.shtml	chromecache_388.3.dr, chromecache_392.3.dr	false	Avira URL Cloud: safe	unknown
https://p1.img.cctvpic.com/fmspic/2023/01/17/2a6d1ccc3852408392ff08706460e48e-41287973-2.jpg	chromecache_388.3.dr, chromecache_392.3.dr	false		high
https://p1.img.cctvpic.com/fmspic/2024/11/27/5543c06b05bb4596b9bb8f411aeaa82f-1.jpg	chromecache_474.3.dr	false		high
https://p1.img.cctvpic.com/fmspic/2025/01/07/f4d4981c63ad47ad9b0b436df933de91-300.jpg	chromecache_474.3.dr	false		high
https://p3.img.cctvpic.com/fmspic/2024/12/04/3974a1337c0844e9b691520072659264-1.jpg	chromecache_392.3.dr	false		high
https://p4.img.cctvpic.com/photoworkspace/2025/02/06/2025020617085244836.jpg	chromecache_388.3.dr, chromecache_392.3.dr	false		high
https://p4.img.cctvpic.com/fmspic/2025/01/17/5b745e2639fb452da06d91712d7207a1-300.jpg	chromecache_388.3.dr, chromecache_392.3.dr	false		high
https://p3.img.cctvpic.com/fmspic/2025/01/27/203ce7c7867d4ac1814bbec34e92d849-1.jpg	chromecache_388.3.dr, chromecache_392.3.dr	false		high
https://p5.img.cctvpic.com/fmspic/2024/11/07/6c7c887889ce4740bfed02a125f9d37d-1.jpg	chromecache_474.3.dr	false		high
https://global.cctv.com/2024/11/03/VIDE57d1ZMADGjMY4qWDGIyO241103.shtml	chromecache_474.3.dr	false	Avira URL Cloud: safe	unknown
https://github.com/kesla/parse-headers/blob/master/LICENCE	chromecache_258.3.dr, chromecache_527.3.dr	false		high
https://p3.img.cctvpic.com/fmspic/2024/11/03/1cb1af9252224be98bd243af4592d594-300.jpg	chromecache_474.3.dr	false		high
https://p4.img.cctvpic.com/fmspic/2022/02/01/188b2481e7ff471aa7bf75c81bf218da-36082649-2.jpg	chromecache_388.3.dr, chromecache_392.3.dr	false		high
http://www.lalit.org/lab/javascript-css-font-detect/	chromecache_479.3.dr, chromecache_354.3.dr	false		high
https://p5.img.cctvpic.com/photoworkspace/2024/11/13/2024111311252714720.jpg	chromecache_474.3.dr	false		high
https://p3.img.cctvpic.com/fmspic/2025/01/17/98eec5744f634da69d19b50596a79b1a-300.jpg	chromecache_388.3.dr, chromecache_392.3.dr	false		high
https://p3.img.cctvpic.com/fmspic/2024/12/03/9aa26225e7f746ecb26783a5535f4d4f-1.jpg	chromecache_474.3.dr	false		high
https://github.com/Valve/fingerprintjs2/issues/66	chromecache_479.3.dr, chromecache_354.3.dr	false		high
https://global.cctv.com/2024/12/10/VIDEnlrIFgWWq1iIcIafDYTj241210.shtml	chromecache_474.3.dr	false	Avira URL Cloud: safe	unknown
https://global.cctv.com/2025/01/27/VIDEY6pbLQGPgjOK6F0I3bdb250127.shtml	chromecache_474.3.dr, chromecache_388.3.dr, chromecache_392.3.dr	false	Avira URL Cloud: safe	unknown
https://p3.img.cctvpic.com/photoworkspace/2025/01/27/2025012714583875799.jpg	chromecache_474.3.dr, chromecache_388.3.dr, chromecache_392.3.dr	false		high
https://p5.img.cctvpic.com/photoworkspace/2025/01/03/2025010316300876860.jpg	chromecache_474.3.dr	false		high
https://global.cctv.com/2024/12/03/VIDE3VlPHb0GJ5BFmH6B8wid241203.shtml	chromecache_474.3.dr	false	Avira URL Cloud: safe	unknown
https://p4.img.cctvpic.com/fmspic/2024/11/03/76b7a926be8147cb8ca6022366979a18-1.jpg	chromecache_474.3.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.48.1	unknown	United States	13335	CLOUDFLARENETUS	false
163.171.147.15	unknown	European Union	54994	QUANTILNETWORKSUS	false
163.171.132.119	unknown	European Union	54994	QUANTILNETWORKSUS	false
142.250.186.67	unknown	United States	15169	GOOGLEUS	false
138.113.27.66	unknown	United States	776	FR-INRIA-SOPHIAINRIASophia-AntipolisEU	false
163.171.132.42	unknown	European Union	54994	QUANTILNETWORKSUS	false
59.37.89.184	unknown	China	134764	CT-FOSHAN-IDCCHINANETGuangdongprovincenetworkCN	false
172.217.23.110	unknown	United States	15169	GOOGLEUS	false
163.181.92.250	unknown	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
39.107.0.195	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
104.115.82.10	unknown	United States	20940	AKAMAI-ASN1EU	false
104.115.82.16	unknown	United States	20940	AKAMAI-ASN1EU	false
163.181.131.243	unknown	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
163.181.131.244	unknown	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
138.113.147.185	unknown	United States	776	FR-INRIA-SOPHIAINRIASophia-AntipolisEU	false
115.182.216.38	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
2.21.65.137	unknown	European Union	20940	AKAMAI-ASN1EU	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
163.171.128.148	unknown	European Union	54994	QUANTILNETWORKSUS	false
108.177.15.84	unknown	United States	15169	GOOGLEUS	false
104.21.32.1	unknown	United States	13335	CLOUDFLARENETUS	false
163.171.130.92	unknown	European Union	54994	QUANTILNETWORKSUS	false
2.21.65.135	unknown	European Union	20940	AKAMAI-ASN1EU	false
59.110.133.46	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
142.250.181.227	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	unknown	United States	15169	GOOGLEUS	false
140.143.180.217	unknown	China	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false

Private

IP
192.168.2.6
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1608870
Start date and time:	2025-02-07 01:22:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://888.mixly.us.kg/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.phis.win@20/546@0/30
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, audiodg.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Not all processes where analyzed, report is missing behavior information
Skipping network analysis since amount of network traffic is too extensive
VT rate limit hit for: http://888.mixly.us.kg/

Simulations

Behavior and APIs

⊘No simulations

LLM Input / Output

Input	Output
URL: http://888.mixly.us.kg Model: Joe Sandbox AI	```json{ "brand": "unknown", "brand_classification": "unknown", "legit_url": "unknown", "similarity": 0, "spoofed": 0, "reasoning": "The URL 'http://888.mixly.us.kg' does not appear to be attempting to spoof any well-known brand. The domain 'mixly.us.kg' does not closely resemble any known brand or legitimate URL. The use of '888' as a subdomain does not suggest any specific brand association. The '.kg' country code top-level domain (ccTLD) is for Kyrgyzstan, which does not inherently suggest typosquatting. There are no visual character substitutions or structural changes that indicate an attempt to deceive users into thinking this is a different, legitimate site. The URL structure and domain do not imply any misleading intent or user confusion related to a known brand."}
URL: http://888.mixly.us.kg
URL: https://mixly.us.kg Model: Joe Sandbox AI	```json{ "brand": "unknown", "brand_classification": "unknown", "legit_url": "unknown", "similarity": 0, "spoofed": 0, "reasoning": "The URL 'https://mixly.us.kg' does not exhibit any clear signs of typosquatting. There are no obvious character substitutions or visual similarities to a well-known brand. The domain 'mixly.us.kg' does not closely resemble any globally recognized brand or legitimate URL. The use of the '.kg' country code top-level domain (ccTLD) suggests a possible connection to Kyrgyzstan, but without further context, it does not imply a deceptive intent. The subdomain 'us' could indicate a regional focus, but it is not misleading in this context. Overall, there is no evidence to suggest that this URL is attempting to spoof a known brand."}
URL: https://mixly.us.kg
URL: https://cctv.com Model: Joe Sandbox AI	```json{ "brand": "unknown", "brand_classification": "unknown", "legit_url": "unknown", "similarity": 0, "spoofed": 0, "reasoning": "The URL 'https://cctv.com' does not appear to be a typosquatting attempt. 'CCTV' is a generic term that stands for 'Closed-Circuit Television' and is not exclusively associated with a specific brand. The domain 'cctv.com' could be legitimately used by any entity related to surveillance systems or broadcasting. There are no visual character substitutions or structural changes that suggest an attempt to mimic a well-known brand. Additionally, the domain extension '.com' is standard and does not imply any deceptive intent. Without a specific brand association, the URL is unlikely to confuse users into thinking it is related to a particular brand."}
URL: https://cctv.com
URL: https://888.mixly.us.kg/... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script demonstrates moderate-risk behaviors, including external data transmission and the use of fallback domains. While the script's intent is not entirely clear, the conditional logic and potential for redirecting to different domains based on the user's location raise some concerns that require further investigation." }
window.addEventListener('load', function () { let scriptEl = document.createElement('script') let isCN = getArea() === 'CN'; let guowai = findGetParameter("guowai"); if (guowai === '1') { isCN = false } if ((isCN && "1" == "0") \|\| (!isCN && "1" == "0")) { document.getElementById("TPMTzo7laOcaXUpvBX67KgjG211216_container").style.display = "none"; }else{ scriptEl.src = isCN ? "" : "" document.body.appendChild(scriptEl) } })
URL: https://888.mixly.us.kg/... Model: Joe Sandbox AI	{ "risk_score": 5, "reasoning": "The script exhibits moderate-risk behaviors, including external data transmission and the use of fallback domains. However, the script's intent appears to be related to geolocation-based content delivery, which could be a legitimate use case. Further review may be necessary to determine the full context and potential risks." }
window.addEventListener('load', function () { let scriptEl = document.createElement('script') let isCN = getArea() === 'CN'; let guowai = findGetParameter("guowai"); if (guowai === '1') { isCN = false } if ((isCN && "1" == "1") \|\| (!isCN && "1" == "0")) { document.getElementById("TPMTGb0ECeaxfb2pTOI6i1qt211216_container").style.display = "none"; }else{ scriptEl.src = isCN ? "" : "" document.body.appendChild(scriptEl) } })
URL: https://888.mixly.us.kg/... Model: Joe Sandbox AI	{ "risk_score": 5, "reasoning": "The script exhibits moderate-risk behaviors, including external data transmission and the use of fallback domains. However, the intent appears to be related to geolocation-based content delivery, which is a common practice. Further review may be needed to determine if there are any suspicious or inconsistent behaviors." }
window.addEventListener('load', function () { let scriptEl = document.createElement('script') let isCN = getArea() === 'CN'; let guowai = findGetParameter("guowai"); if (guowai === '1') { isCN = false } if ((isCN && "1" == "0") \|\| (!isCN && "1" == "0")) { document.getElementById("TPMThn9QwS7fnC9io7f7M3Ml230804_container").style.display = "none"; }else{ scriptEl.src = isCN ? "" : "" document.body.appendChild(scriptEl) } })
URL: https://888.mixly.us.kg/... Model: Joe Sandbox AI	{ "risk_score": 5, "reasoning": "The script demonstrates some moderate-risk behaviors, such as dynamic script loading and potential data exfiltration, but the intent is not entirely clear. Further investigation is needed to determine the legitimacy of the script's purpose." }
window.addEventListener('load', function () { let scriptEl = document.createElement('script') let isCN = getArea() === 'CN'; let guowai = findGetParameter("guowai"); if (guowai === '1') { isCN = false } if ((isCN && "1" == "1") \|\| (!isCN && "1" == "0")) { document.getElementById("TPMTwof4bkYbF8Og0IQ0pDLA211216_container").style.display = "none"; }else{ scriptEl.src = isCN ? "" : "" document.body.appendChild(scriptEl) } })
URL: https://888.mixly.us.kg/... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script appears to be a legitimate content rendering function, but it exhibits some moderate-risk behaviors. It dynamically generates HTML content and modifies the DOM, which could be considered aggressive. Additionally, it uses fallback image URLs that are not directly provided in the data, which introduces some uncertainty. Overall, the script requires further review due to its complex behavior, but it does not demonstrate clear malicious intent." }
function PAGEnL0TSDsFQ26XkCx4G7Kl210126(res) { const datalist = res.data.list.slice(0, 8); var listEl = document.querySelector('#TPMTyC55g6ZBo3Whkz45Xo67211216_container').querySelector('.promptly-section-container-wrap'); var liList = ''; var back = 'PAGEnL0TSDsFQ26XkCx4G7Kl210126'; for(var i = 0 ; i < datalist.length ; i++){ var itemHtml = ''; let item_title = datalist[i].title; item_title = item_title.replace(/\#[^\s]\s/ig, ''); item_title = item_title.replace(/\#./i, ''); let item_subtitle = datalist[i].subtitle; item_subtitle = item_subtitle.replace(/\#[^\s]\s/ig, ''); item_subtitle = item_subtitle.replace(/\#./i, ''); itemHtml +='<dl class="promptly-section-container-dlWrap">' itemHtml +='<dt>' itemHtml +='<a href="' itemHtml += datalist[i].url itemHtml +='" target="_blank" >' itemHtml +='<img src="' //itemHtml +=datalist[i].image if(datalist[i].image == '' \|\| datalist[i].image == null \|\| datalist[i].image == undefined){ if(datalist[i].s_page_name == '' \|\| datalist[i].s_page_name == null \|\| datalist[i].s_page_name == undefined ){ if(back == 'PAGEnL0TSDsFQ26XkCx4G7Kl210126'){ itemHtml +='//p2.img.cctvpic.com/photoAlbum/templet/common/TPTERE93VfAfo34uSEe8veca211216/20220224_seat_jk.jpg' }else if(back == 'PAGEZ8HZ8JSmzO1F6GiAYTi9211130'){ itemHtml +='//p2.img.cctvpic.com/photoAlbum/templet/common/TPTERE93VfAfo34uSEe8veca211216/20220224_seat_hk.jpg' }else if(back == 'PAGEMURMOWpDxCfQkQPW3nKA210126'){ itemHtml +='//p2.img.cctvpic.com/photoAlbum/templet/common/TPTERE93VfAfo34uSEe8veca211216/20220224_seat_zgmk.jpg' } }else{ if(datalist[i].s_page_name == ''){ itemHtml +='//p2.img.cctvpic.com/photoAlbum/templet/common/TPTERE93VfAfo34uSEe8veca211216/20220224_seat_jrsla.jpg' }else if(datalist[i].s_page_name == ''){ itemHtml +='//p2.img.cctvpic.com/photoAlbum/templet/common/TPTERE93VfAfo34uSEe8veca211216/20220224_seat_gtbfb.jpg' }else if(datalist[i].s_page_name == ''){ itemHtml +='//p2.img.cctvpic.com/photoAlbum/templet/common/TPTERE93VfAfo34uSEe8veca211216/20220224_seat_jkla.jpg' }else if(datalist[i].s_page_name == ''){ itemHtml +='//p2.img.cctvpic.com/photoAlbum/templet/common/TPTERE93VfAfo34uSEe8veca211216/20220224_seat_wtng.jpg' }else if(datalist[i].s_page_name == ''){ itemHtml +='//p2.img.cctvpic.com/photoAlbum/templet/common/TPTERE93VfAfo34uSEe8veca211216/20220224_seat_jkdwq.jpg' } } }else{ itemHtml += datalist[i].image } itemHtml +='" >' if(datalist[i].duration){ itemHtml +='<span class="promptly-section-container-vidTime">' itemHtml +=datalist[i].duration itemHtml +='</span>' } itemHtml +='</a></dt>' itemHtml +='<dd><a href="' itemHtml +=datalist[i].url itemHtml +='" target="_blank" ><span>' if(datalist[i].subtitle == ''){ itemHtml +=item_title }else{ itemHtml +=item_subtitle } itemHtml +='</span></a>' itemHtml +='</dd>' itemHtml +='</dl>' liList +=itemHtml; } listEl.innerHTML = liList; }
URL: https://888.mixly.us.kg/... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The script appears to be primarily responsible for loading a video content from CCTV's global website based on the user's location (China or outside China). While it uses some dynamic behavior, such as creating a script element and appending it to the DOM, the overall intent seems to be legitimate content delivery. The script does not exhibit any high-risk indicators like data exfiltration or obfuscated code, and the use of the CCTV domain suggests a relatively trusted context. Therefore, the risk score is assessed as low." }
window.addEventListener('load', function () { let scriptEl = document.createElement('script') let isCN = getArea() === 'CN'; let guowai = findGetParameter("guowai"); if (guowai === '1') { isCN = false } if ((isCN && "1" == "0") \|\| (!isCN && "1" == "0")) { document.getElementById("TPMTyC55g6ZBo3Whkz45Xo67211216_container").style.display = "none"; }else{ let urlBeing = "https://global.cctv.com/cmsdatainterface/guonei/new/video/PAGEnL0TSDsFQ26XkCx4G7Kl210126_1.jsonp"?true:false; if(urlBeing){ scriptEl.src = isCN ? "https://global.cctv.com/cmsdatainterface/guonei/new/video/PAGEnL0TSDsFQ26XkCx4G7Kl210126_1.jsonp" : "https://global.cctv.com/cmsdatainterface/guowai/new/video/PAGEnL0TSDsFQ26XkCx4G7Kl210126_1.jsonp" document.body.appendChild(scriptEl) } } })
URL: https://888.mixly.us.kg/... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script appears to be a legitimate content rendering function, but it exhibits some moderate-risk behaviors that warrant further review. The script dynamically generates HTML elements and modifies the DOM, which could potentially be used for aggressive or malicious purposes. Additionally, it processes data from an external source, which could lead to potential data exfiltration if not properly sanitized. However, the script's purpose seems to be displaying a list of content items, which is a common and expected behavior. Overall, the script requires closer inspection to ensure there are no hidden or unintended behaviors." }
function PAGEMURMOWpDxCfQkQPW3nKA210126(res) { const datalist = res.data.list.slice(0, 7); var listEl = document.querySelector('#TPMTnR0hMwqDy6QtRYmjQJ0q211216_container').querySelector('.hot-section-list'); var liList = ''; for(var i = 0 ; i< datalist.length ; i++){ let item = ''; let item_title = datalist[i].title; item_title = item_title.replace(/\#[^\s]\s/ig, ''); item_title = item_title.replace(/\#./i, ''); let item_subtitle = datalist[i].subtitle; item_subtitle = item_subtitle.replace(/\#[^\s]\s/ig, ''); item_subtitle = item_subtitle.replace(/\#./i, ''); item +='<li class="hot-section-item">' item +='<a href="' item += datalist[i].url item +='" class="hot-section-item-box" target="_blank">' item +='<div class="hot-section-item-img" style="background-image: url(' item +=datalist[i].image item +=');"></div>' item +='<p class="hot-section-item-title">' if(datalist[i].subtitle !=''){ item +=item_subtitle }else{ item +=item_title } item +='</p>' item +='</a>' if(datalist[i].duration){ item +='<p class="hot-section-item-date">' item +=datalist[i].duration item +='</p>' } item +='</li>' liList += item } listEl.innerHTML = liList; }
URL: https://888.mixly.us.kg/... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The script appears to be primarily responsible for loading content from different URLs based on the user's location (China vs. outside of China). While it uses some dynamic behavior, such as creating a script element and appending it to the DOM, the overall intent seems to be legitimate content delivery rather than malicious activity. The script does not exhibit any high-risk indicators like dynamic code execution or data exfiltration, and the use of the `getArea()` and `findGetParameter()` functions is relatively benign. Therefore, the risk score is assessed as low, with a score of 3." }
window.addEventListener('load', function () { let scriptEl = document.createElement('script') let isCN = getArea() === 'CN'; let guowai = findGetParameter("guowai"); if (guowai === '1') { isCN = false } if ((isCN && "1" == "1") \|\| (!isCN && "1" == "0")) { document.getElementById("TPMTnR0hMwqDy6QtRYmjQJ0q211216_container").style.display = "none"; }else{ let urlBeing = "https://global.cctv.com/cmsdatainterface/guonei/new/page/PAGEMURMOWpDxCfQkQPW3nKA210126_1.jsonp"?true:false; if(urlBeing){ scriptEl.src = isCN ? "https://global.cctv.com/cmsdatainterface/guonei/new/page/PAGEMURMOWpDxCfQkQPW3nKA210126_1.jsonp" : "https://global.cctv.com/cmsdatainterface/guowai/new/page/PAGEMURMOWpDxCfQkQPW3nKA210126_1.jsonp" document.body.appendChild(scriptEl) } } })
URL: https://888.mixly.us.kg/... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a legitimate script for managing the active state of menu items based on the current URL path. It does not exhibit any high-risk behaviors, such as dynamic code execution, data exfiltration, or obfuscation. The script primarily focuses on manipulating the DOM to highlight the active menu item and updating the text content of sub-menu items based on the URL path. This behavior is consistent with typical navigation and UI functionality, and there are no clear indications of malicious intent." }
var pathName; if (window.location.pathname.indexOf("big5") != "-1") { pathName = window.location.pathname.replace("/gate/big5/", ""); pathName = pathName.split("/")[1]; } else { pathName = window.location.pathname.split("/")[1]; } var activeEl = document .querySelector(".header-container") .querySelector(".menu-list") .querySelectorAll(".menu-item"); activeEl.forEach((item) => { if (pathName != "" && pathName != "index.shtml") { if ( item.querySelector("a").getAttribute("href").indexOf(pathName) != -1 ) { item.querySelector("a").style.color = "#ff6c00"; } } }); if (window.location.pathname.indexOf("big5") != "-1") { $(".menu-item-10-sub1 a").html( '<span class="menu-item-sub-tips"></span></a>' ); $(".menu-item-10-sub2 a").html( '<span class="menu-item-sub-tips"></span></a>' ); } else { $(".menu-item-10-sub1 a").html( '<span class="menu-item-sub-tips"></span></a>' ); $(".menu-item-10-sub2 a").html( '<span class="menu-item-sub-tips"></span></a>' ); }
URL: https://global.cctv.com/cmsdatainterface/guowai/ne... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a legitimate news article content, with no indicators of malicious behavior. It contains typical news article elements like titles, subtitles, images, and video links. There are no signs of dynamic code execution, data exfiltration, or other high-risk behaviors. The script seems to be focused on displaying news content, which is a common and expected use case." }
PAGEnL0TSDsFQ26XkCx4G7Kl210126({"data":{"total":174,"pagenum":9,"list":[{"id":"VIDEMUqmqt1U3q19yeOMQpXp250206","title":"# ","subtitle":"# #","focus_date":"2025-02-06","url":"https://global.cctv.com/2025/02/06/VIDEMUqmqt1U3q19yeOMQpXp250206.shtml","image":"https://p2.img.cctvpic.com/fmspic/2025/02/06/54e50efbfd3941c997327042b2a326c0-1.jpg","image2":"https://p2.img.cctvpic.com/fmspic/2025/02/06/54e50efbfd3941c997327042b2a326c0-1.jpg","image3":"https://p4.img.cctvpic.com/photoworkspace/2025/02/06/2025020617085244836.jpg","brief":"# ","ext_field":"","keywords":"# ","type":"vide","old_id":"","s_page_id":"","s_page_name":"","duration":"00:21","ext":{"facebook":"1652617692341780"}},{"id":"VIDESocifs5BGaEld0Ns0T65250127","title":"# ","subtitle":"# ","focus_date":"2025-01-27","url":"https://global.cctv.com/2025/01/27/VIDESocifs5BGaEld0Ns0T65250127.shtml","image":"https://p2.img.cctvpic.com/fmspic/2025/01/27/f2e56408ec324fec8e760d5b4e86de32-1.jpg","image2":"https://p2.img.cctvpic.com/fmspic/2025/01/27/f2e56408ec324fec8e760d5b4e86de32-1.jpg","image3":"https://p4.img.cctvpic.com/fmspic/2025/01/27/f2e56408ec324fec8e760d5b4e86de32-300.jpg","brief":"# ","ext_field":"","keywords":"# ","type":"vide","old_id":"","s_page_id":"","s_page_name":"","duration":"00:37","ext":{"facebook":"3939716926348231"}},{"id":"VIDETaz8pHjMo4ElMiRLIpBW250127","title":"# 2025 127","subtitle":"# 2025 127","focus_date":"2025-01-27","url":"https://global.cctv.com/2025/01/27/VIDETaz8pHjMo4ElMiRLIpBW250127.shtml","image":"https://p4.img.cctvpic.com/fmspic/2025/01/27/44d682753d8c41e8b92be983afc03d53-1.jpg","image2":"https://p4.img.cctvpic.com/fmspic/2025/01/27/44d682753d8c41e8b92be983afc03d53-1.jpg","image3":"https://p4.img.cctvpic.com/fmspic/2025/01/27/44d682753d8c41e8b92be983afc03d53-300.jpg","brief":"# 2025 127","ext_field":"","keywords":"# 2025 127","type":"vide","old_id":"","s_page_id":"","s_page_name":"","duration":"01:42","ext":{"facebook":"984276773551412"}},{"id":"VIDEiZGO8GnR4wDbFPUGlN9F250127","title":"# ","subtitle":"# ","focus_date":"2025-01-27","url":"https://global.cctv.com/2025/01/27/VIDEiZGO8GnR4wDbFPUGlN9F250127.shtml","image":"https://p1.img.cctvpic.com/fmspic/2025/01/27/b9c4c8cfa4204c0f982d5501f539597b-1.jpg","image2":"https://p1.img.cctvpic.com/fmspic/2025/01/27/b9c4c8cfa4204c0f982d5501f539597b-1.jpg","image3":"https://p4.img.cctvpic.com/fmspic/2025/01/27/b9c4c8cfa4204c0f982d5501f539597b-300.jpg","brief":"# ","ext_field":"","keywords":"# ","type":"vide","old_id":"","s_page_id":"","s_page_name":"","duration":"01:09","ext":{"facebook":"1215300990309902"}},{"id":"VIDE8GvaLjGHWYbGuOib9sub250126","title":"# ","subtitle":"# ","focus_date":"2025-01-26","url":"https://global.cctv.com/2025/01/26/VIDE8GvaLjGHWYbGuOib9sub250126.shtml","image":"https://p5.img.cctvpic.com/fmspic/2025/01/26/dd09b5cec91244c7bfb607e026188eea-1.jpg","image2":"https://p5.img.cctvpic.com/fmspic/2025/01/26/dd09b5cec91244c7bfb607e026188eea-1.jpg","image3":"https://p3.img.cctvpic.com/fmspic/2025/01/26/dd09b5cec91244c7bfb607e026188eea-300.jpg","brief":"# ","ext_field":"","keywords":"# ","type":"vide","old_id":"","s_page_id":"","s_page_name":"","duration":"01:13","ext":{"facebook":"1321427672327356"}},{"id":"VIDEOoEDQU1FeUtg2fWxCRrR250126","title":"# ","subtitle":"# ","focus_date":"2025-01-26","url":"https://global.cctv.com/2025/01/26/VIDEOoEDQU1FeUtg2fWxCRrR250126.shtml","image":"https://p4.img.cctvpic.com/fmspic/2025/01/26/9917e7a134cf442cbc948f9448de0eeb-1.jpg","image2":"ht
URL: https://888.mixly.us.kg Model: Joe Sandbox AI	```json{ "brand": "unknown", "brand_classification": "unknown", "legit_url": "unknown", "similarity": 1, "spoofed": 1, "reasoning": "The URL 'https://888.mixly.us.kg' does not closely resemble any known brand or legitimate URL. The use of '888' and 'mixly' does not suggest a strong connection to a well-known brand. The domain extension '.us.kg' is unusual but does not inherently indicate typosquatting. There are no obvious character substitutions or structural changes that mimic a known brand. The URL could be related to a specific service or campaign unrelated to typosquatting."}
URL: https://888.mixly.us.kg
URL: https://global.cctv.com/2025/02/04/VIDEybiYWadtnrWnvvCyjGsI250204.shtml Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": true, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: https://888.mixly.us.kg/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "", "prominent_button_name": "", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": true, "contains_fake_security_alerts": false, "page_classification": "unknown" }

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://888.mixly.us.kg/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Malware Analysis System Evasion

Anti Debugging

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Windows Analysis Report
http://888.mixly.us.kg/