www.trendmicro.com Open in urlscan Pro
23.205.250.17  Public Scan

Form analysis
3 forms found in the DOM

<form class="main-menu-search" aria-label="Search Trend Micro">
  <div class="main-menu-search__field-wrapper" id="cludo-search-form">
    <table cellspacing="0" cellpadding="0" class="gsc-search-box" style="width:100%">
      <tbody>
        <tr>
          <td class="gsc-input">
            <input type="text" size="10" class="gsc-input" name="search" title="search" placeholder="Search Trend Micro" autocomplete="off">
          </td>
        </tr>
      </tbody>
    </table>
  </div>
</form>

<form class="main-menu-search" aria-label="Search Trend Micro">
  <div class="main-menu-search__field-wrapper" id="cludo-search-form-mobile">
    <table cellspacing="0" cellpadding="0" class="gsc-search-box" style="width:100%">
      <tbody>
        <tr>
          <td class="gsc-input">
            <input type="text" size="10" class="gsc-input" name="search" title="search" placeholder="Search Trend Micro" autocomplete="off">
          </td>
          <td class="gsc-search-close collapsed" style="width:1%;" data-target="#search-mobile-wrapper" data-toggle="collapse">
            <span class="icon-close"></span>
          </td>
        </tr>
      </tbody>
    </table>
  </div>
</form>

POST #

<form class="acsb-form" data-acsb-search="form" enctype="multipart/form-data" action="#" method="POST"> <input type="text" tabindex="0" name="acsb_search" autocomplete="off" placeholder="Unclear content? Search in dictionary..."
    aria-label="Unclear content? Search in dictionary..."> <i class="acsbi-search"></i> <i class="acsbi-chevron_down"></i> </form>

Text Content

Skip to Content
↵ENTER
Skip to Menu
↵ENTER
Skip to Footer
↵ENTER

Microsoft Exchange Server Security Alert: Attacks Employ Zero-Day
Vulnerabilities | How to stay protected >

dismiss
1 Alerts

 * Microsoft Exchange Server Security Alert: Attacks Employ Zero-Day
   Vulnerabilities
   
   dismiss
   How to stay protected

 * No new notifications at this time.

Download
 * Scan Engines
 * All Pattern Files
 * All Downloads
 * Subscribe to Download Center RSS

Buy
 * Find a Partner
 * Home Office Online Store
 * Renew Online
 * Free Tools
 * Contact Sales
 * Locations Worldwide
 * 1-888-762-8736 (M-F 8am - 5pm CST)
 * Small Business
 * Buy Online
 * Renew Online

Region
 * The Americas
 * United States
 * Brasil
 * Canada
 * México
 * Middle East & Africa
 * South Africa
 * Middle East and North Africa

 * Europe
 * België (Belgium)
 * Česká Republika
 * Danmark
 * Deutschland, Österreich Schweiz
 * España
 * France
 * Ireland
 * Italia
 * Nederland

 * Norge (Norway)
 * Polska (Poland)
 * Suomi (Finland)
 * Sverige (Sweden)
 * Türkiye (Turkey)
 * United Kingdom

 * Asia & Pacific
 * Australia
 * Центральная Азия (Central Asia)
 * Hong Kong (English)
 * 香港 (中文) (Hong Kong)
 * भारत गणराज्य (India)
 * Indonesia
 * 日本 (Japan)
 * 대한민국 (South Korea)
 * Malaysia
 * Монголия (Mongolia) and рузия (Georgia)
 * New Zealand

 * Philippines
 * Singapore
 * 台灣 (Taiwan)
 * ประเทศไทย (Thailand)
 * Việt Nam

Log In
 * My Support
 * Log In to Support
 * Partner Portal
 * Home Solutions
 * My Account
 * Lost Device Portal
 * Trend Micro Vault
 * Password Manager
 * Customer Licensing Portal
 * Online Case Tracking
 * Premium Support
 * Worry-Free Business Security Services
 * Remote Manager
 * Cloud One
 * Referral Affiliate
 * Referral Affiliate

Free trials
 * Cloud
 * Detection and Response
 * User Protection

Folio (0)
Contact Us
 * Contact Sales
 * Locations
 * Support
 * Find a Partner
 * Learn of upcoming events
 * Social Media Networks
 * Facebook
 * Twitter
 * Linkedin
 * Youtube
 * Instagram
 * 1-888-762-8736 (M-F 8-5 CST)


Business 
For Home 

Products Products
Trend Micro One - our unified cybersecurity platform >

Hybrid Cloud Security
Workload Security
Conformity
Container Security
File Storage Security
Application Security
Network Security
Open Source Security
Network Security
Intrusion Prevention
Advanced Threat Protection
Industrial Network Security
Mobile Network Security
Zero Trust Secure Access
User Protection
Endpoint Security
Email Security
Mobile Security
Web Security
Industrial Endpoint
Detection & Response
XDR
Attack Surface Risk Management
Powered by
AI/Machine Learning
Global Threat Intelligence
All Products & Trials

Our Unified Platform

Service Packages

Small & Midsize Business Security

Solutions Solutions
For Cloud
Cloud Migration
Cloud-Native App Development
Cloud Operational Excellence
Data Center Security
SaaS Applications
Internet of Things (IoT)
ICS / OT
Connected Car
5G Security for Enterprises
Risk Management
Ransomware
Cyber Insurance
End-of-Support Systems
Compliance
Detection and Response
Industries
Healthcare
Manufacturing
Oil & Gas
Electric Utility
Federal
Why Trend Micro Why Trend Micro
The Trend Micro Difference
Customer Successes
The Human Connection
Strategic Alliances

Industry Leadership
Research Research
Research
About Our Research
Research and Analysis
Research, News and Perspectives
Security Reports
Security News
Zero Day Initiative (ZDI)
Blog
Research by Topic
Vulnerabilities
Annual Predictions
The Deep Web
Internet of Things (IoT)
Resources
DevOps Resource Center
CISO Resource Center
What Is?
Threat Encyclopedia
Cloud Health Assessment
Cyber Risk Assessment
Enterprise Guides
Glossary of Terms

EXPLORE THE CYBER RISK INDEX (CRI)

Use the CRI to assess your organization’s preparedness against attacks, and get
a snapshot of cyber risk across organizations globally.

Calculate your risk
Services & Support Services & Support
Services
Service Packages
Managed XDR
Support Services
Business Support
Log In to Support
Technical Support
Virus & Threat Help
Renewals & Registration
Education & Certification
Contact Support
Downloads
Free Cleanup Tools
Find a Support Partner
For Popular Products
Deep Security
Apex One
Worry-Free
Worry-Free Renewals
Partners Partners
Channel Partners
Channel Partner Overview
Managed Service Provider
Cloud Service Provider
Professional Services
Resellers
Marketplace
System Integrators
Alliance Partners
Alliance Overview
Technology Alliance Partners
Our Alliance Partners
Tools and Resources
Find a Partner
Education and Certification
Partner Successes
Distributors
Partner Login
Company Company
Overview
Leadership
Customer Success Stories
Human Connections
Strategic Alliances
Industry Accolades
Newsroom
Webinars
Events
Security Experts
Careers
History
Corporate Social Responsibility
Diversity, Equity & Inclusion
Trust Center
Internet Safety and Cybersecurity Education
Investors
Legal



×
Folio (0)
1 Alerts

 * Microsoft Exchange Server Security Alert: Attacks Employ Zero-Day
   Vulnerabilities
   
   dismiss
   How to stay protected

 * No new notifications at this time.

Download
 * Scan Engines
 * All Pattern Files
 * All Downloads
 * Subscribe to Download Center RSS

Buy
 * Find a Partner
 * Home Office Online Store
 * Renew Online
 * Free Tools
 * Contact Sales
 * Locations Worldwide
 * 1-888-762-8736 (M-F 8am - 5pm CST)
 * Small Business
 * Buy Online
 * Renew Online

Region
 * The Americas
 * United States
 * Brasil
 * Canada
 * México
 * Middle East & Africa
 * South Africa
 * Middle East and North Africa

 * Europe
 * België (Belgium)
 * Česká Republika
 * Danmark
 * Deutschland, Österreich Schweiz
 * España
 * France
 * Ireland
 * Italia
 * Nederland

 * Norge (Norway)
 * Polska (Poland)
 * Suomi (Finland)
 * Sverige (Sweden)
 * Türkiye (Turkey)
 * United Kingdom

 * Asia & Pacific
 * Australia
 * Центральная Азия (Central Asia)
 * Hong Kong (English)
 * 香港 (中文) (Hong Kong)
 * भारत गणराज्य (India)
 * Indonesia
 * 日本 (Japan)
 * 대한민국 (South Korea)
 * Malaysia
 * Монголия (Mongolia) and рузия (Georgia)
 * New Zealand

 * Philippines
 * Singapore
 * 台灣 (Taiwan)
 * ประเทศไทย (Thailand)
 * Việt Nam

Log In
 * My Support
 * Log In to Support
 * Partner Portal
 * Home Solutions
 * My Account
 * Lost Device Portal
 * Trend Micro Vault
 * Password Manager
 * Customer Licensing Portal
 * Online Case Tracking
 * Premium Support
 * Worry-Free Business Security Services
 * Remote Manager
 * Cloud One
 * Referral Affiliate
 * Referral Affiliate

Free trials
 * Cloud
 * Detection and Response
 * User Protection

Folio (0)
Contact Us
 * Contact Sales
 * Locations
 * Support
 * Find a Partner
 * Learn of upcoming events
 * Social Media Networks
 * Facebook
 * Twitter
 * Linkedin
 * Youtube
 * Instagram
 * 1-888-762-8736 (M-F 8-5 CST)



 * Microsoft Exchange Server Security Alert: Attacks Employ Zero-Day
   Vulnerabilities
   
   dismiss
   How to stay protected
 * No new notifications at this time.

 * Scan Engines
 * All Pattern Files
 * All Downloads
 * Subscribe to Download Center RSS

 * Find a Partner
 * Home Office Online Store
 * Renew Online
 * Free Tools
 * Contact Sales
 * Locations Worldwide
 * 1-888-762-8736 (M-F 8am - 5pm CST)
 * Small Business
 * Buy Online
 * Renew Online

 * The Americas
 * United States
 * Brasil
 * Canada
 * México
 * Middle East & Africa
 * South Africa
 * Middle East and North Africa

 * Europe
 * België (Belgium)
 * Česká Republika
 * Danmark
 * Deutschland, Österreich Schweiz
 * España
 * France
 * Ireland
 * Italia
 * Nederland

 * Norge (Norway)
 * Polska (Poland)
 * Suomi (Finland)
 * Sverige (Sweden)
 * Türkiye (Turkey)
 * United Kingdom

 * Asia & Pacific
 * Australia
 * Центральная Азия (Central Asia)
 * Hong Kong (English)
 * 香港 (中文) (Hong Kong)
 * भारत गणराज्य (India)
 * Indonesia
 * 日本 (Japan)
 * 대한민국 (South Korea)
 * Malaysia
 * Монголия (Mongolia) and рузия (Georgia)
 * New Zealand

 * Philippines
 * Singapore
 * 台灣 (Taiwan)
 * ประเทศไทย (Thailand)
 * Việt Nam

 * My Support
 * Log In to Support
 * Partner Portal
 * Home Solutions
 * My Account
 * Lost Device Portal
 * Trend Micro Vault
 * Password Manager
 * Customer Licensing Portal
 * Online Case Tracking
 * Premium Support
 * Worry-Free Business Security Services
 * Remote Manager
 * Cloud One
 * Referral Affiliate
 * Referral Affiliate

 * Cloud
 * Detection and Response
 * User Protection

 * Contact Sales
 * Locations
 * Support
 * Find a Partner
 * Learn of upcoming events
 * Social Media Networks
 * Facebook
 * Twitter
 * Linkedin
 * Youtube
 * Instagram
 * 1-888-762-8736 (M-F 8-5 CST)

undefined



Malware
Trickbot Shows Off New Trick: Password Grabber Module

Subscribe

Content added to Folio

Folio (0) close

Malware


TRICKBOT SHOWS OFF NEW TRICK: PASSWORD GRABBER MODULE

Trickbot (detected by Trend Micro as TSPY_TRICKBOT.THOIBEAI) now has a password
grabber module that steals access from several applications and browsers.

By: Noel Anthony Llimos, Carl Maverick Pascual November 01, 2018 Read time: 5
min (1283 words)

Save to Folio

Subscribe

--------------------------------------------------------------------------------

Trickbot, which used to be a simple banking trojan, has come a long way. Over
time, we’ve seen how cybercriminals continue to add more features to this
malware. Last March, Trickbot added a new module that gave it increased
detection evasion and a screen-locking feature. This month, we saw that Trickbot
(detected by Trend Micro as TSPY_TRICKBOT.THOIBEAI) now has a password grabber
module (pwgrab32) that steals access from several applications and browsers,
such as Microsoft Outlook, Filezilla, WinSCP, Google Chrome, Mozilla Firefox,
Internet Explorer, and Microsoft Edge. Based on our telemetry, we saw that this
Trickbot variant has affected users mainly in the United States, Canada, and the
Philippines.

Analyzing Trickbot’s modules

Malware authors continue to cash in on Trickbot’s modular structure — its
ability to continually update itself by downloading new modules from a C&C
server and change its configuration make for a malware that’s ripe for updating.
To gain a better understanding of this threat, we analyzed Trickbot’s different
modules, starting with the new pwgrab32 module that we saw this month.

pwgrab32 module

Trickbot’s new module, called pwgrab32 or PasswordGrabber, steals credentials
from applications such as Filezilla, Microsoft Outlook, and WinSCP.



Figure 1. A screen capture of Trickbot’s new module, pwgrab32, in an affected
system



Figure 2. A screen capture of the new module’s code that steals FTP passwords
from FileZilla



Figure 3. A screen capture of the new module’s code that steals Microsoft
Outlook credentials



Figure 4. A screen capture of Trickbot harvesting passwords from open-source FTP
WinSCP

Aside from stealing credentials from applications, it also steals the following
information from several popular web browsers such as Google Chrome, Mozilla
Firefox, Internet Explorer, and Microsoft Edge:

 * Usernames and Passwords
 * Internet Cookies
 * Browsing History
 * Autofills
 * HTTP Posts



Figure 5. A screen capture of Trickbot’s code that is structured to steal
passwords from popular web browsers

It should be noted that this Trickbot variant is not capable of stealing
passwords from third-party password manager applications. We are studying this
malware further to see if it is able to steal passwords from password managers
that have browser plugins.

shareDll32 module

Trickbot uses the shareDll32 module to help propagate itself throughout the
network. It connects to a C&C server
http[:]//185[.]251[.]39[.]251/radiance[.]png to download a copy of itself and
save it as setuplog.tmp.


Figure 6. Trickbot’s shareDll32 module allows it to connect to a C&C server to
download a copy of itself



Figure 7. The downloaded file is saved as setuplog.tmp

The shareDll32 module then enumerates and identifies systems connected on the
same domain using WNetEnumResource and GetComputerNameW.

Figure 8. Screen capture of code that enumerates and identifies connected
systems using WNetEnumResourceW and GetComputerNameW

The file setuplog.tmp is then copied in the administrative shares of the
discovered machines or systems.



Figure 9. A screenshot of setuplog.tmp copied in the administrative shares

To make the malware more persistent, it has an auto-start service that allows
Trickbot to run whenever the machine boots. This service can have the following
display names:

 * Service Techno
 * Service_Techno2
 * Technics-service2
 * Technoservices
 * Advanced-Technic-Service
 * ServiceTechno5
   
   
   wormDll module
   


The wormDll32 module attempts to identify servers and domain controllers in the
network using NetServerEnum and LDAP queries. Trickbot’s worm-like propagation
capability was first observed by security researchers from Flashpoint in 2017.

Figure 10. Screen capture of code that identifies workstations and servers in a
domain using NetServerEnum



Figure 11. Screen capture of code that identifies domain controllers in a
network using LDAP queries



Figure 12. Screen capture of code that identifies machines which are not domain
controllers in a network using LDAP queries

We also discovered that there is a possible SMB protocol implementation using
“pysmb,” utilizing the NT LM 0.12 query for older Windows operating systems and
IPC shares. It should be noted that this function seems to still be in
development.

Figure13. Screen capture of code showing possible SMB communication

networkDll32

Trickbot uses this encrypted module to scan the network and steal relevant
network information. It executes the following commands to gather information on
the infected system:



Figure 14. Screen capture of the commands executed by the networkDll32 module to
gather network information

Wormdll32 module

Wormdll32 is an encrypted module that Trickbot uses to propagate itself via SMB
and LDAP queries. It is used together with the module “wormDll” to propagate
across the network.

importDll32 module

This module is responsible for stealing browser data such as browsing history,
cookies, and plug-ins, among others.

systeminfo32 module

Once successfully installed in a system, Trickbot will gather system information
such as OS, CPU, and memory information, user accounts, lists of installed
programs and services.

mailsearcher32 module

This module searches the infected system’s files to gather email addresses for
information-stealing purposes. Collecting email addresses for spam
campaign-related needs is usual malware behavior, however, Kryptos Research
recently reported that the Emotet banking trojan doesn't just steal email
addresses; it also harvests emails sent and received via Microsoft Outlook on an
Emotet-infected device. Emotet, according to previous research by Brad Duncan,
is also responsible for delivering this password-grabbing Trickbot variant, as
well as Azorult, to users.

injectDll32 module

This encrypted module monitors websites that banking applications might use.
It's also used to inject code into its target processes using the Reflective DLL
Injection technique.

The injectDll32 monitors banking-related websites for two different
credential-stealing methods:

First, when a user logs in to any of the monitored banking websites on its list
such as Chase, Citi, Bank of America, Sparda-Bank, Santander, HSBC, Canadian
Imperial Bank of Commerce (CIBC), and Metrobank, Trickbot will then send a POST
response to the C&C server to extract the user’s login credentials.

Second, Trickbot monitors if a user accesses certain banking-related websites on
its list, such as C. Hoare & Co bank, St. James’s Place Bank, and Royal Bank of
Scotland, and will redirect users to fake phishing websites.

The banking URLs Trickbot monitors include websites from the United States,
Canada, UK, Germany, Australia, Austria, Ireland, London, Switzerland, and
Scotland.

Trickbot’s other notable tricks

Trickbot is usually sent via malicious spam campaigns. The malware disables
Microsoft’s built-in antivirus Windows Defender by executing certain commands
and modifying registry entries. Additionally, it also terminates Windows
Defender-related processes such as MSASCuil.exe, MSASCui.exe, and antispyware
utility Msmpeng.exe. It also has an autostart mechanism (Msntcs) that is
triggered at system startup and every ten minutes after it is first executed.

It disables the following anti-malware services:

 * MBamService (Malwarebytes-related Process)
 * SAVService (Sophos AV-related process)
    

Its anti-analysis capability checks the system and terminates itself when it
finds certain modules, such as pstorec.dll, vmcheck.dll, wpespy.dll, and
dbghelp.dll.

Defending against Trickbot’s tricks: Trend Micro solutions

Malware authors continue to update banking trojans like Trickbot and Emotet with
new modules that make it more difficult to detect and combat. Users and
enterprises can benefit from protection that use a multi-layered approach to
mitigate the risks brought by threats like banking trojans.

Trend Micro Smart Protection Suites provide a cross-generational blend of threat
defense techniques to protect systems from all types of threats, including
banking trojans, ransomware, and cryptocurrency-mining malware. It features
high-fidelity machine learning on gateways and endpoints, and protects physical,
virtual, and cloud workloads. With capabilities like web/URL filtering,
behavioral analysis, and custom sandboxing, XGen security protects against
today’s threats that bypass traditional controls; exploit known, unknown, or
undisclosed vulnerabilities; either steal or encrypt personally identifiable
data; or conduct malicious cryptocurrency mining. Smart, optimized, and
connected, XGen security powers Trend Micro’s suite.

Indicators of Compromise

Trickbot C&C servers

 * 103[.]10[.]145[.]197:449
 * 103[.]110[.]91[.]118:449
 * 103[.]111[.]53[.]126:449
 * 107[.]173[.]102[.]231:443
 * 107[.]175[.]127[.]147:443
 * 115[.]78[.]3[.]170:443
 * 116[.]212[.]152[.]12:449
 * 121[.]58[.]242[.]206:449
 * 128[.]201[.]92[.]41:449
 * 167[.]114[.]13[.]91:443
 * 170[.]81[.]32[.]66:449
 * 173[.]239[.]128[.]74:443
 * 178[.]116[.]83[.]49:443
 * 181[.]113[.]17[.]230:449
 * 182[.]253[.]20[.]66:449
 * 182[.]50[.]64[.]148:449
 * 185[.]66[.]227[.]183:443
 * 187[.]190[.]249[.]230:443
 * 190[.]145[.]74[.]84:449
 * 192[.]252[.]209[.]44:443
 * 197[.]232[.]50[.]85:443
 * 198[.]100[.]157[.]163:443
 * 212[.]23[.]70[.]149:443
 * 23[.]226[.]138[.]169:443
 * 23[.]92[.]93[.]229:443
 * 23[.]94[.]233[.]142:443
 * 23[.]94[.]41[.]215:443
 * 42[.]115[.]91[.]177:443
 * 46[.]149[.]182[.]112:449
 * 47[.]49[.]168[.]50:443
 * 62[.]141[.]94[.]107:443
 * 68[.]109[.]83[.]22:443
 * 70[.]48[.]101[.]54:443
 * 71[.]13[.]140[.]89:443
 * 75[.]103[.]4[.]186:443
 * 81[.]17[.]86[.]112:443
 * 82[.]222[.]40[.]119:449
 * 94[.]181[.]47[.]198:449


 TSPY_TRICKBOT.THOIBEAI:

 * 806bc3a91b86dbc5c367ecc259136f77482266d9fedca009e4e78f7465058d16


Tags
Malware | Research | Network | Cyber Threats


AUTHORS

 * Noel Anthony Llimos
   
   Threats Analyst

 * Carl Maverick Pascual
   
   Threats Analyst

Contact Us
Subscribe


RELATED ARTICLES

 * Attack Surface Management 2022 Midyear Review Part 3
 * Attack Surface Management 2022 Midyear Review Part 2
 * Latest on OpenSSL 3.0.7 Bug & Security-Fix

See all articles



RECOMMENDED FOR YOU

cyber threats


HOW WATER LABBU EXPLOITS ELECTRON-BASED APPLICATIONS


LEARN MORE




 * Contact Sales
 * Locations
 * Careers
 * Newsroom
 * Trust Center
 * Privacy
 * Accessibility
 * Support
 * Site map

 * linkedin
 * twitter
 * facebook
 * youtube
 * instagram
 * rss

Copyright © 2022 Trend Micro Incorporated. All rights reserved.

sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk

This website uses cookies for website functionality, traffic analytics,
personalization, social media functionality and advertising. Our Cookie Notice
provides more information and explains how to amend your cookie settings.Learn
more

Cookies Settings Accept





English
Accessibility Adjustments
Reset Settings Statement Hide Interface

Choose the right accessibility profile for you
OFF ON
Seizure Safe Profile Clear flashes & reduces color
This profile enables epileptic and seizure prone users to browse safely by
eliminating the risk of seizures that result from flashing or blinking
animations and risky color combinations.
OFF ON
Vision Impaired Profile Enhances website's visuals
This profile adjusts the website, so that it is accessible to the majority of
visual impairments such as Degrading Eyesight, Tunnel Vision, Cataract,
Glaucoma, and others.
OFF ON
ADHD Friendly Profile More focus & fewer distractions
This profile significantly reduces distractions, to help people with ADHD and
Neurodevelopmental disorders browse, read, and focus on the essential elements
of the website more easily.
OFF ON
Cognitive Disability Profile Assists with reading & focusing
This profile provides various assistive features to help users with cognitive
disabilities such as Autism, Dyslexia, CVA, and others, to focus on the
essential elements of the website more easily.
OFF ON
Keyboard Navigation (Motor) Use website with the keyboard
This profile enables motor-impaired persons to operate the website using the
keyboard Tab, Shift+Tab, and the Enter keys. Users can also use shortcuts such
as “M” (menus), “H” (headings), “F” (forms), “B” (buttons), and “G” (graphics)
to jump to specific elements.

Note: This profile prompts automatically for keyboard users.
OFF ON
Blind Users (Screen Reader) Optimize website for screen-readers
This profile adjusts the website to be compatible with screen-readers such as
JAWS, NVDA, VoiceOver, and TalkBack. A screen-reader is software that is
installed on the blind user’s computer and smartphone, and websites should
ensure compatibility with it.

Note: This profile prompts automatically to screen-readers.
Content Adjustments
Content Scaling
Default

Readable Font
Highlight Titles
Highlight Links
Text Magnifier
Adjust Font Sizing
Default

Align Center
Adjust Line Height
Default

Align Left
Adjust Letter Spacing
Default

Align Right
Color Adjustments
Dark Contrast
Light Contrast
High Contrast
High Saturation
Adjust Text Colors
Cancel
Monochrome
Adjust Title Colors
Cancel
Low Saturation
Adjust Background Colors
Cancel
Orientation Adjustments
Mute Sounds
Hide Images
Read Mode
Reading Guide
Useful Links
Select an option Home Header Footer Main Content
Stop Animations
Reading Mask
Highlight Hover
Highlight Focus
Big Black Cursor
Big White Cursor
HIDDEN_ADJUSTMENTS
Keyboard Navigation
Accessible Mode
Screen Reader Adjustments
Read Mode
Web Accessibility By
Learn More
Choose the Interface Language
English
Español
Deutsch
Português
Français
Italiano
עברית
繁體中文
Pусский
عربى
عربى
Nederlands
繁體中文
日本語
Polski
Türk
Accessibility StatementCompliance status

We firmly believe that the internet should be available and accessible to anyone
and are committed to providing a website that is accessible to the broadest
possible audience, regardless of ability.

To fulfill this, we aim to adhere as strictly as possible to the World Wide Web
Consortium’s (W3C) Web Content Accessibility Guidelines 2.1 (WCAG 2.1) at the AA
level. These guidelines explain how to make web content accessible to people
with a wide array of disabilities. Complying with those guidelines helps us
ensure that the website is accessible to blind people, people with motor
impairments, visual impairment, cognitive disabilities, and more.

This website utilizes various technologies that are meant to make it as
accessible as possible at all times. We utilize an accessibility interface that
allows persons with specific disabilities to adjust the website’s UI (user
interface) and design it to their personal needs.

Additionally, the website utilizes an AI-based application that runs in the
background and optimizes its accessibility level constantly. This application
remediates the website’s HTML, adapts its functionality and behavior for
screen-readers used by blind users, and for keyboard functions used by
individuals with motor impairments.

If you wish to contact the website’s owner please use the website's form

Screen-reader and keyboard navigation

Our website implements the ARIA attributes (Accessible Rich Internet
Applications) technique, alongside various behavioral changes, to ensure blind
users visiting with screen-readers can read, comprehend, and enjoy the website’s
functions. As soon as a user with a screen-reader enters your site, they
immediately receive a prompt to enter the Screen-Reader Profile so they can
browse and operate your site effectively. Here’s how our website covers some of
the most important screen-reader requirements:

 1. Screen-reader optimization: we run a process that learns the website’s
    components from top to bottom, to ensure ongoing compliance even when
    updating the website. In this process, we provide screen-readers with
    meaningful data using the ARIA set of attributes. For example, we provide
    accurate form labels; descriptions for actionable icons (social media icons,
    search icons, cart icons, etc.); validation guidance for form inputs;
    element roles such as buttons, menus, modal dialogues (popups), and others. 
    
    Additionally, the background process scans all of the website’s images. It
    provides an accurate and meaningful image-object-recognition-based
    description as an ALT (alternate text) tag for images that are not
    described. It will also extract texts embedded within the image using an OCR
    (optical character recognition) technology. To turn on screen-reader
    adjustments at any time, users need only to press the Alt+1 keyboard
    combination. Screen-reader users also get automatic announcements to turn
    the Screen-reader mode on as soon as they enter the website.
    
    These adjustments are compatible with popular screen readers such as JAWS,
    NVDA, VoiceOver, and TalkBack.
    
    
 2. Keyboard navigation optimization: The background process also adjusts the
    website’s HTML and adds various behaviors using JavaScript code to make the
    website operable by the keyboard. This includes the ability to navigate the
    website using the Tab and Shift+Tab keys, operate dropdowns with the arrow
    keys, close them with Esc, trigger buttons and links using the Enter key,
    navigate between radio and checkbox elements using the arrow keys, and fill
    them in with the Spacebar or Enter key.
    
    Additionally, keyboard users will find content-skip menus available at any
    time by clicking Alt+2, or as the first element of the site while navigating
    with the keyboard. The background process also handles triggered popups by
    moving the keyboard focus towards them as soon as they appear, not allowing
    the focus to drift outside.
    
    Users can also use shortcuts such as “M” (menus), “H” (headings), “F”
    (forms), “B” (buttons), and “G” (graphics) to jump to specific elements.

Disability profiles supported on our website
 * Epilepsy Safe Profile: this profile enables people with epilepsy to safely
   use the website by eliminating the risk of seizures resulting from flashing
   or blinking animations and risky color combinations.
 * Vision Impaired Profile: this profile adjusts the website so that it is
   accessible to the majority of visual impairments such as Degrading Eyesight,
   Tunnel Vision, Cataract, Glaucoma, and others.
 * Cognitive Disability Profile: this profile provides various assistive
   features to help users with cognitive disabilities such as Autism, Dyslexia,
   CVA, and others, to focus on the essential elements more easily.
 * ADHD Friendly Profile: this profile significantly reduces distractions and
   noise to help people with ADHD, and Neurodevelopmental disorders browse,
   read, and focus on the essential elements more easily.
 * Blind Users Profile (Screen-readers): this profile adjusts the website to be
   compatible with screen-readers such as JAWS, NVDA, VoiceOver, and TalkBack. A
   screen-reader is installed on the blind user’s computer, and this site is
   compatible with it.
 * Keyboard Navigation Profile (Motor-Impaired): this profile enables
   motor-impaired persons to operate the website using the keyboard Tab,
   Shift+Tab, and the Enter keys. Users can also use shortcuts such as “M”
   (menus), “H” (headings), “F” (forms), “B” (buttons), and “G” (graphics) to
   jump to specific elements.

Additional UI, design, and readability adjustments
 1. Font adjustments – users can increase and decrease its size, change its
    family (type), adjust the spacing, alignment, line height, and more.
 2. Color adjustments – users can select various color contrast profiles such as
    light, dark, inverted, and monochrome. Additionally, users can swap color
    schemes of titles, texts, and backgrounds with over seven different coloring
    options.
 3. Animations – epileptic users can stop all running animations with the click
    of a button. Animations controlled by the interface include videos, GIFs,
    and CSS flashing transitions.
 4. Content highlighting – users can choose to emphasize essential elements such
    as links and titles. They can also choose to highlight focused or hovered
    elements only.
 5. Audio muting – users with hearing devices may experience headaches or other
    issues due to automatic audio playing. This option lets users mute the
    entire website instantly.
 6. Cognitive disorders – we utilize a search engine linked to Wikipedia and
    Wiktionary, allowing people with cognitive disorders to decipher meanings of
    phrases, initials, slang, and others.
 7. Additional functions – we allow users to change cursor color and size, use a
    printing mode, enable a virtual keyboard, and many other functions.

Assistive technology and browser compatibility

We aim to support as many browsers and assistive technologies as possible, so
our users can choose the best fitting tools for them, with as few limitations as
possible. Therefore, we have worked very hard to be able to support all major
systems that comprise over 95% of the user market share, including Google
Chrome, Mozilla Firefox, Apple Safari, Opera and Microsoft Edge, JAWS, and NVDA
(screen readers), both for Windows and MAC users.

Notes, comments, and feedback

Despite our very best efforts to allow anybody to adjust the website to their
needs, there may still be pages or sections that are not fully accessible, are
in the process of becoming accessible, or are lacking an adequate technological
solution to make them accessible. Still, we are continually improving our
accessibility, adding, updating, improving its options and features, and
developing and adopting new technologies. All this is meant to reach the optimal
level of accessibility following technological advancements. If you wish to
contact the website’s owner, please use the website's form

Hide Accessibility Interface? Please note: If you choose to hide the
accessibility interface, you won't be able to see it anymore, unless you clear
your browsing history and data. Are you sure that you wish to hide the
interface?
Accept Cancel

Continue



Processing the data, please give it a few seconds...


AddThis Sharing Sidebar
Share to FacebookFacebookShare to TwitterTwitterShare to PrintPrintMore AddThis
Share optionsAddThis
2
SHARES
Hide
Show
Close
AddThis