# E02. Clipboard-lure deobfuscation analysis

## Material and method

The July analysis examined recovered, minified recruitment-page JavaScript with readable strings. The method was static inspection of event handlers, command construction and endpoint references. The sample used in the later companion scanner check is identified below; that scanner check is distinct from the original deobfuscation. [S1, S2]

## Clipboard substitution

The recorded copy handler calls `preventDefault()` and writes a generated value through `clipboardData.setData('text/plain', ...)`. In the identified sample the command builder receives a nonce and an operating-system selector; in the `d2saitrade[.]ink` bundle it also receives the phrase, which does not reach the command text. The visible verification instruction therefore differs from the value placed on the clipboard. The handler also records a `cmdline_copied` event. These observations describe browser-side logic, not a captured user session. [S1]

The Unix-like branch constructs a background download-and-execution sequence followed by verification output. The Windows branch prepends hidden installation logic to an interactive access-key prompt. The command still produces a `VERIFY-` result, allowing the visible verification step to accompany the installation attempt. No executable command template is reproduced in this report.

## Retrieval and telemetry

The builder derives its download origin from `window.location.origin`. Recorded dropper names include `verify_m` and `verify_w`; the challenge-specific `check_bot` and `check_3d` variants come from other bundles in the lure fleet. Endpoint references across the fleet include device checks, verification, completion and activity tracking; the device-check route appears in the heavier bundles, not in the identified sample. A nonce or phrase returned to the site may support a verification workflow; frontend code alone does not establish how the server validates it or whether payload installation succeeded. [S1]

## Interpretation

Clipboard-write calls are useful triage locations, but their presence alone does not prove deception. Here the conclusion depends on comparing the displayed instruction with the generated clipboard value. A later parse-only scanner reported two clipboard-write sites in the held lure sample; it does not independently prove that divergence. Terminal behavior, user execution and backend responses were not reproduced for this report. [S2]

## Artifact identity

Lure JavaScript: 73,545 bytes; SHA-256 `5ee915bb8d0363bd92176cc595d7425fd7e7830508d8824d90b5285a3d2b11bd`. [S2]