Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://workupload.c...

windows10-2004-x64

10

Resubmissions

17/04/2026, 13:03

260417-qaj3gsex3n4

03/04/2023, 12:05

230403-n9fs1aee5910

Sharing

Copy URL Twitter E-mail

General

  • Target
    https://workupload.com/start/GcSmwNUSGRw
  • Sample230403-n9fs1aee59
Score
10/10
ransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5AN3FZ97\translations[2].js

Ransom Note
  • var translations = {"maintenance text":"Maintenance work! <br \/> We will be right back!","file not found":"File not found","archive not found":"Archive not found","download limit exceeded":"Download limit exceeded","access denied":"Access denied","no files uploaded":"No files uploaded","activation link expired":"Activation link expired","password link expired":"Password link expired","404 text":"This file does not exist or has been deleted by the owner prematurely.","error message":"Error message","403 text":"This file is not publicly accessible.","your user account is still not valid":"You have not verified your email address.","500 text":"An error has occurred. We will fix this as soon as possible. We ask for your patience.","oops, an error occurred":"Oops, an error occurred","unable to get sync server":"Unable to get any sync server","invalid file":"Invalid file","unable to move sync file":"Unable to move sync file","captcha is invalid":"Invalid validation","captcha is invalid text":"The captcha input was incorrect. Please try again.","monthly rate limited":"You have already uploaded too many files this month. Further uploads are currently not possible for you.","workupload pro":"workupload pro","plan_pro":"workupload pro","plan_proplus":"workupload pro+","plan_1":"workupload pro","plan_2":"workupload pro+","activate your workupload pro account":"Aktivate your workupload pro account","update your workupload pro account":"Update payment informations","tls secure text":"Your data will be transferred securely using TLS encryption.","unsupported address":"We do not support this address. Please make sure the entered address is spelled correctly.","buy":"Buy","product":"Product","country":"Country","name":"Name","street address":"Street address","city":"City","zip postal code":"ZIP\/Postal Code","creditcard":"Creditcard (Credit Card Number, expiry date, CVV\/CVC)","your subscription":"Your subscription","really cancel workupload pro?":"If you cancel your membership, you will not have access to the workupload premium features. Files beyond the free storage quota will be deleted.","cancel subscription":"Cancel subscription","cancel subscription text":"You can <a href=\"#\" id=\"cancelSubscription\">cancel<\/a> your workupload subscription at any time on a monthly basis. If you cancel, you can still access your workupload per feature for the current payment period.","workupload pro will expire":"workupload pro expires","your subscription will expire at":"Your subscription will end at %date%","update payment data":"Update payment data","payment plan pricing":"workupload %name% (%price% EUR per month)","your active produkt":"<b>%name%<\/b> is active","corrected address":"We have corrected the address. Please check the address for correctness.","invoices":"Invoices","your received invoices are listed here":"Your received invoices are listed here","premium active":"VIP status active","premium text":"<b>%storage%<\/b> exklusiv Storage <br \/> prioritized downloads <br \/> dedicated Support <br \/> and more ...","patreon_text":"Become a free <a href=\"%link_registration%\" target=\"_blank\">workupload member<\/a> and get additional features or get <a href=\"%link_patreon%\" target=\"_blank\">workupload Pro<\/a> for even more features.","uploaded":"uploaded","back":"back","save":"Save","cancel":"Cancel","sign up":"Sign up","file":"Datei","server":"Server","text":"Text","archive":"Archive","ready":"Ready","close":"Close","password":"Password","repeat password":"Repeat password","confirm":"Confirm","notice":"Notice","error":"Error","default dialog confirm":"Ok","comment":"Comment","unlimited":"Unlimited","upload":"Upload","contact":"Contact","message":"Message","send":"Send","megabyte":"Megabyte","optional":"optional","reason":"Reason","from":"From","send request":"Send request","private message":"Private message","social network":"Social Network","support request":"Support request","online since":"online since 2011","max.":"max.","learn more":"Learn more","file informations":"File information","archive informations":"Archive information","note tos and privacy":"Please note our <a href=\"%privacy%\" target=\"_blank\">data protection regulations<\/a> and our <a href=\"%tos%\" target=\"_blank\">terms of use<\/a>.","date":"Date","day":"Day","days":"Days","hours":"Houres","minutes":"Minutes","seconds":"Seconds","home":"Home","my files":"My files","members area":"Members area","logged in as":"Logged in as","logout":"Logout","choose language":"Choose Language","german":"German","english":"English","help":"Help","about workupload":"About workupload","workupload at facebook":"Workupload at Facebook","give us feedback":"Give us feedback","terms of service":"General Terms and Conditions","imprint":"Imprint","dashboard":"Dashboard","files":"Files","archives":"Archives","settings":"Settings","faq":"FAQ","login":"Login","signup":"Sign Up","archivename":"Archive name","archivesize":"Archive size","edit archive":"Edit Archive","create archive title":"Create a new archive","archive password":"Archive password","share archive":"Share archive","archive is public":"Archive is public","download archive":"Download archive","this archive is protected with a password":"This archive is protected with a password.","archive email sent":"Your files have been successfully sent via email.","filename":"Filename","filesize":"Filesize","filehash":"Checksum","qrurl":"QR-URL","downloads":"Downloads","download":"Download","preview":"Preview","download file now":"Download the file %filename% now.","malware found":"Attention! File contains maybe malware!","no malware":"We have checked this file and could not detect any malware.","delete in":"Delete in","it is a user file":"This file was uploaded by a user.","contacting server":"contacting server","download started":"Download started","passwordprotection":"Password protected","password prompt text":"This file is password protected. Please enter the correct password to download the file.","report file":"Report file","delete file":"Delete file","x hours valid":"%hours% hours valid.","share file":"Share file","uploaded a wrong file?":"Uploaded a wrong file?","recommendation":"Recommendation","share workupload links and earn money":"share workupload links and earn money.","do you really want to delete this file?":"Do you really want to delete this file?","coupon":"Coupon","redeem a coupon":"Redeem a coupon","coupon code":"Coupon code","invalid coupon":"Invalid coupon","the entered coupon is invalid":"The entered coupon is invalid!","valid coupon":"Valid coupon","the coupon is valid and has been activated":"The coupon is valid and has been activated.","your download has started":"Your download has started","x is downloaded":"%filename% is downloaded.","your download will start automatically":"Your download will start automatically!<br \/> If the download does not start, <a href=\"\" id=\"directDownload\" target=\"_blank\">please click here.<\/a>\n","we have scanned for maleware":"We have checked this file and could not detect any malware.","upload own files":"Upload own files","passwordprotected":"Password protected","this file is protected with a password":"This file is protected with a password.","file email sent":"Your file has been successfully sent via email.","download now at workupload":"Download %filename% (%filesize%) now. Fast and easy at workupload.com","ad notice":"Advertisement","low speed notice":"Tip: Do you want to download this file 5 times faster, for free? Add workupload as an exception in your AdBlocker.","search":"Search","filter":"Filter","delete":"Delete","move":"Move","edit":"Edit","edit file":"Edit file","options":"Options","file permissions":"File permissions","public":"public","private":"private","new folder title":"Create a new folder","new folder":"New folder","create archive":"Create archive","add to archive":"Add to archive","rename":"Rename","homefolder":"Homefolder","create archive text":"Create an archive out of the selected files","create folder":"Create folder","create folder text":"Create a new folder","foldername":"Foldername","edit folder":"Edit folder","rename archive":"Rename archive","rename archive text":"Set a new name for the selected archive","permissions":"Permissions","archive name":"Archivename","archive files":"Archive files","select files":"Select files","or drag and drop files in this window":"or drag and drop files in this window","max. downloads":"Max. downloads","file password":"File password","email receivers":"Email Receivers","storagetime (days)":"Storagetime (days)","expiration date":"Expiration date","download limit":"Download Limit","file has expiration date":"File has an expiration date","file has download limit":"File has a download limit.","share now!":"Share now!","file search":"File search","files in your account":"Files in your account","folders in your account":"Folders in your account","archives in your account":"Archives in your account","file storage used":"File storage used","upload a file":"Upload a file","create a folder":"Create a folder","create an archive":"Create an archive","file downloads":"File downloads","email text":"Email text","file comment":"Description","comment text":"Add a public description to the file.","invalid receiver":"Invalid receiver","set a file password to protect":"Enter a file password to prevent public access.","password protected area":"Protected access (password saved)","your email":"Your email","no files found":"No files found.","delete account":"Delete account","delete account text":"If you delete your account, all your files, folders and archives will be deleted immediately. Your account will completely removed from our system. Your uploaded files can not be downloaded anymore. <p>If you have activated workupload pro, it will stop prematurely.<\/p> <br \/> <p>Do you really want to leave us?<\/p> <p>If you have any <a href=\"%contact%\">problems or questions<\/a> just contact us.<\/p>\n","yes delete my account now":"Yes, delete my account now!","account deleted":"Account deleted","account deleted text":"Your account has been successfully deleted. We hope that you will also use workupload.com without account. <br \/><br \/> Best wishes <br \/> Your workupload.com team\n","the following email addresses are invalid please correct them":"The following email addresses are invalid. Please correct them","please confirm":"Please confirm","really delete this file\/folder?":"Do you really want to delete the selected files\/folders?","really delete this archive?":"Do you really want to delete the selected archive? The files in this archive will not deleted.","accept tos":"<a href=\"%link%\" target=\"_blank\">Terms of Use<\/a> are read and accepted","accept privacy":"<a href=\"%link%\" target=\"_blank\">Privacy Policy<\/a> read and accepted","click x to copy the file direct link":"Click on %icon% to copy the direct download link.","support us on patreon":"Support workupload now on Patreon and get exclusive features!","join workupload patreon":"Join workupload as a Patreon","patreon link":"Link your Patreon Account","patreon successfully linked":"Patreon Account successfully linked","patreon please wait":"Note: It can take up to 5 minutes for your Patreon membership to be processed. If you have any problems, please contact us: [email protected] ","workupload pro is active":"<b>Your workupload Pro status is active!<\/b> <br \/> You can see the current range of functions at <a href=\"https:\/\/patreon.com\/workupload\" target=\"_blank\">https:\/\/patreon.com\/workupload<\/a>. <br \/> You have questions or need help? Contact us: [email protected]","email signature":"<br \/><br \/>Yours sincerely <br \/>Your workupload-Team","email upload subject":"[workupload.com] File provided","email upload text":"Hi %email%,<br \/><br \/>a file was uploaded for you at workupload.com. You can download the file at the following link:<br \/><br \/><a href=\"%link%\">%link%<\/a>","email upload title":"File provided","email footer text":"This information is intended only for the recipient and may be confidential. If you have received this email in error, please contact us. Do not forward this message to other people, and delete the email and any possibly existing copies and attachments.","email reset password text":"Hi %email%, <br \/><br \/> Did you forgot your workupload.com password? To chose a new password, please click the following link: <br \/><br \/> <a href=\"%link%\">%link%<\/a> <br \/><br \/> Once you have clicked the link you can set a new password for your account. After setting a new password you can login with your new password and your email address.","email signup title":"Your registration","email sign up text":"Hi %email%, <br \/><br \/> to complete your registration at workupload.com, please click on the following link: <br \/><br \/><a href=\"%link%\">%link%<\/a><br \/><br \/> Once you have clicked the link you can login with your chosen password and your email address.","reset password email header":"[workupload.com] Change your password","signup email header":"[workupload.com] Your registration","description":"Upload documents, images and files for free - without registration.","keywords":"image upload, file upload, free file upload, free file upload without registration, filesharing","default title":"workupload - Share and send large files.","upload title":"Share and send large files!","upload text":"Up to 2 GB files | without registration | all filetypes | secure and fast","upload title picture":"Share and send pictures without limits!","select pictures":"Select pictures","facebook":"Facebook","share on facebook":"Share at Facebook","share on twitter":"Share on Twitter","share on google":"Share on Google","send to email":"Send the file to an email address. Up to %max% email addresses can be separated by a comma.","email additional text":"Add a private message to the email.","protect with a password":"Protect the file with a password. The file can be downloaded only by entering the correct password.","choose storagetime":"Choose a storagetime. Leave this field blank is not storagetime limit should be present.","delete after x downloads":"Enter the number of downloads after the file should be deleted. Leave this field blank if no download limit should be present.","primefile fullspeed text":"Premium File: <br \/> Ultra fast Download!","coupon text":"Publicly visible text for premium download. Example: Premium Download by John Doe","do not use adblocker title":"Please, don't use an adBlocker on our site.","do not use adblocker text":"Our platform can only exist by showing ads. Please help us to provide an awesome filesharing platform by <b>whitelisting our site in your adBlocker<\/b>. <br \/>We're showing only small Ads. In addition, we do not use Pop-Ups. All our Ads are tested by Google. <br \/><br \/>Thank you very much. <br \/><br \/> <span id=\"ads-do-not-care\">I don't care about workupload, just show me the file.<\/span>","file storage is almost full":"Your file storage is almost full.","file storage is full":"Your file storage is full! This file will not assigned to your account.","your ip":"Your IP","this file has been banned":"This file has been banned","this file has been banned longtext":"We have banned this file as it violates our Terms of Use. You can find our General Terms and Conditions <a href=\"%link%\">here <\/a>.","write us":"Write us","contact form text":"You have questions? Want to give us feedback or do you need help? Write to us!","thanks for your request":"Thanks for your request","we will process your request":"We will process your request as quickly as possible.","forgotten your password?":"Did you forget your password?","reset password":"Reset Password","request new password":"Request new password","request new password text":"To set a new password, please enter your email address in the field below.","password requested":"New password was requested","password requested text":"Please check your e-mail inbox. You will receive a confirmation email. Click the link in there to reset your password.","change password":"Change password","change password text":"To set a new password, please enter your new password in the fields below.","password changed":"Password changed","you have successfully changed your password":"You have successfully chang
Emails
URLs

  • http:\/\/ec.europa.eu\/consumers\/odr\/

  • https:\/\/securepubads.g.doubleclick.net\/tag\/js\/gpt.js';\n

  • https:\/\/get.adobe.com\/reader\/

Targets

MITRE ATT&CK Enterprise v6

Tasks