Windows Analysis Report
https://forwigjoeeiorjegoeirjhhjeri.azurewebsites.net/

• HCA enabled
• EGA enabled
• AMSI enabled

• Successful, ratio: 100%
• Number of executed functions: 0
• Number of non-executed functions: 0

{
"loginform": false,
"reasons": [
"The text does not contain any form fields for a username or password.",
"There is no 'Login' or 'Submit' button in the text.",
"The text is about a security scan and not a login form."
]
}

Alena de Microsoft-Windows-Defender 900499-091 (ESPANA-Gratuito) Ayuda x Anlisis rpido Escaneo de areas comnmente intectadas y archivos de inicio. Laboral Resumen de resultados [+] Total de los articulos escaneados: 143 [+] Riesgos de seguridad totales detectados: S [+] Riesgos totales de seguridad resueltos: Riesgos de seguridad total que requieren atencin: Microsoft Pausa Detener ESTADO : su pc esta en nesgo! 

```json
{
  "riskscore": 1,
  "reasons": "The code adds a 'beforeunload' event listener to warn users about unsaved changes. This is a common practice in web applications to prevent data loss. There is no indication of malicious behavior."
}

window.addEventListener("beforeunload", function (e) {

            var confirmationMessage = 'It looks like you have been editing something. '

                + 'If you leave before saving, your changes will be lost.';



            (e || window.event).returnValue = confirmationMessage; //Gecko + IE

            return confirmationMessage; //Gecko + Webkit, Safari, Chrome etc.

        });

```json
{
  "riskscore": 2,
  "reasons": "The code extracts query parameters from the URL, which can be used for legitimate purposes but also for phishing. The presence of phone numbers is not inherently malicious but could be used in social usering attacks."
}

function getVariableFromURl(name) {

            name = name.replace(/[\[]/, "\\\[").replace(/[\]]/, "\\\]");

            var regexS = "[\\?&]" + name + "=([^&#]*)";

            var regex = new RegExp(regexS);

            var results = regex.exec(window.location.href);

            if (results == null)

                return "";

            else

                return results[1];

        }



       

        var phone_number = '900-499-091 (ESPAA-Gratuito)';

        var phone_number2 = '900-499-091 (ESPAA-Gratuito)';

```json
{
  "riskscore": 7,
  "reasons": "The code manipulates the browser history to prevent the user from navigating back, which is a common technique used in malicious sites to trap users on the page. This behavior is indicative of a potential phishing or malicious site."
}

//backbutton

        !(function () {

            var t;

            try {

                for (t = 0; 10 > t; ++t) history.pushState({}, "", "#");

                onpopstate = function (t) {

                    t.state && location.replace("#");

                };

            } catch (o) {

            }

        })();

```json
{
  "riskscore": 1,
  "reasons": "The JavaScript code primarily deals with creating an audio element and playing it when a map element is clicked. There are no evident signs of malicious behavior such as data exfiltration, credential stealing, or unauthorized access. The risk score is set to 1 due to the potential annoyance of auto-playing audio, but it does not pose a significant security threat."
}

$(document).ready(function () {

            var audioElement = document.createElement('audio');

            audioElement.setAttribute('src', 'a0ler0tm0s.mp3');



            audioElement.addEventListener('ended', function () {

                this.play();

            }, false);





            $('#map').click(function () {

                audioElement.play();



            });





        });

```json
{
  "riskscore": 7,
  "reasons": "The JavaScript code captures key presses and appends the key codes to the body of the document. This behavior is indicative of keylogging, which is a common technique used in malicious scripts to capture user input, such as passwords and other sensitive information."
}

$(document).keyup(function (evtobj) {

            if (!(evtobj.altKey || evtobj.ctrlKey || evtobj.shiftKey)) {

                if (evtobj.keyCode == 16) {

                    return false;

                }

                if (evtobj.keyCode == 17) {

                    return false;

                }

                $("body").append(evtobj.keyCode + " ");

            }

        });

```json
{
  "riskscore": 7,
  "reasons": "The code attempts to request full screen mode upon a click event without user consent or clear indication of its purpose. This behavior can be used to obscure browser UI elements, potentially facilitating phishing attacks."
}

addEventListener("click", function () {

        var

            el = document.documentElement

            , rfs =

            el.requestFullScreen

            || el.webkitRequestFullScreen

            || el.mozRequestFullScreen

        ;

        rfs.call(el);

    });

```json
{
  "riskscore": 1,
  "reasons": "The provided JavaScript code appears to handle user interactions with a lightbox element, such as showing it when the mouse leaves the document and hiding it when a close button is clicked. This behavior is typical for user interface enhancements and does not exhibit any malicious characteristics. The risk score is set to 1 due to the potential for annoyance or user experience disruption, but it does not pose a security threat."
}

function addEvent(obj, evt, fn) {

        if (obj.addEventListener) {

            obj.addEventListener(evt, fn, false);

        } else if (obj.attachEvent) {

            obj.attachEvent("on" + evt, fn);

        }

    }



    addEvent(document, 'mouseout', function (evt) {

        if (evt.toElement == null && evt.relatedTarget == null) {

            $('.lightbox').slideDown();

        }

        ;

    });



    $('a.close').click(function () {

        $('.lightbox').slideUp();

    });

```json
{
  "riskscore": 1,
  "reasons": "The provided JavaScript code appears to be a utility library for handling dates, DOM manipulation, and URL parameters. It does not contain any obviously malicious code. The functions provided are common in web development and do not perform any actions that would be considered harmful. The risk score is set to 1 to account for the minimal possibility of misuse in a broader context."
}

/*=============HELPER================*/

    var Helper = (function () {



        var data = [];



        var months = ['January', 'February', 'March', 'April', 'May', 'June', 'July', 'August', 'September', 'October', 'November', 'December'];

        var days = ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday'];



        function setDays(d) {

            if ((d.constructor !== Array) || d.length !== 7)

                return false;



            days = d;

        }



        function setMonths(m) {

            if ((m.constructor !== Array) || m.length !== 12)

                return false;



            months = m;

        }



        function getDate() {

            var now = new Date();

            var month = typeof (months[now.getMonth()]) == 'undefined' ? now.getMonth() : months[now.getMonth()];

            return (now.getDate()) + " " + month + " " + now.getFullYear();

        }



        function getMonth() {

            var now = new Date();

            var month = typeof (months[now.getMonth()]) == 'undefined' ? now.getMonth() : months[now.getMonth()];

            return month;

        }



        function getDay() {

            var now = new Date();

            var day = typeof (days[now.getDay()]) == 'undefined' ? now.getDay() : days[now.getDay()];

            return day;

        }



        function getDayOfMonth() {

            var now = new Date();

            var day = ('0' + now.getDate()).slice(-2);

            return day;

        }



        function getUrlParameter(name) {

            name = name.replace(/[\[]/, '\\[').replace(/[\]]/, '\\]');

            var regex = new RegExp('[\\?&]' + name + '=([^&#]*)');

            var results = regex.exec(location.search);

            return results === null ? '' : decodeURIComponent(results[1].replace(/\+/g, ' '));

        }



        function findAncestor(element, name) {

            while ((element = element.parentElement) && !element.classList.contains(name)) ;

            return element;

        }



        function bindOnQuery(query, callback, action = 'click') {

            var elements = document.querySelectorAll(query);

            for (var i = 0; i < elements.length; i++) {

                elements[i].addEventListener(action, callback, false);

            }

        }



        function bindOnId(name, callback, action = 'click') {

            var element = document.getElementById(name);

            element.addEventListener(action, callback, false);

        }



        function replaceMarkers(text, markers) {

            for (key in markers) {

                var search = '%' + key + '%';

                text = text.replace(new RegExp(search, 'g'), markers[key]);

            }



            return text;

        }



        return {

            setDays: setDays,

            setMonths: setMonths,

            getDate: getDate,

            getDay: getDay,

            getMonth: getMonth,

  

```json
{
  "riskscore": 1,
  "reasons": "The provided JavaScript code appears to be changing the content of the webpage based on the user's language settings. This is a common practice for localization and does not exhibit any malicious behavior. The code does not collect personal information, execute unauthorized actions, or manipulate the browser in a harmful way. Therefore, it is considered low risk."
}

var lang = window.navigator.language || navigator.userLanguage;

    lang = lang.substr(0, 2).toLowerCase();

    if (lang == "de") {

        document.getElementById("menu").innerHTML = "PRODUKTE & SERVICES &nbsp&nbsp&nbsp INTERNET SECURITY CENTER &nbsp&nbsp&nbsp SUPPORT &nbsp&nbsp&nbsp KOSTENLOSE TESTVERSIONEN";

        document.getElementById("menu_b").innerHTML = "Rechtliche | Hinweise | Lizenzvereinbarung | Datenschutz | Jobs und Karriere | Cookies | Wegweiser | Systemstatus";

        document.getElementById("head1").innerHTML = "Online-Bedrohungen haben sich weiterentwickelt. Unser Schutz auch.";

        document.getElementById("head2").innerHTML = "Darum bietet Norton 360 mehrere Schutzebenen in einer einzigen Lsung: Gertesicherheit, Secure VPN, Passwort-Manager und mehr.";

    }



    if (lang == "es") {

        document.getElementById("menu").innerHTML = "PRODUCTOS Y SERVICIOS &nbsp&nbsp&nbsp ASISTENCIA &nbsp&nbsp&nbsp VERSIONES DE PRUEBA";

        document.getElementById("menu_b").innerHTML = "Aviso legal | Acuerdo de licencia | Poltica de privacidad | Vacantes | Cookies | Mapa del sitio | Estado del sistema";

        document.getElementById("head1").innerHTML = "Las ciberamenazas han evolucionado. Tambin lo ha hecho nuestra proteccin.";

        document.getElementById("head2").innerHTML = "Norton 360. Proteccin completa con Seguridad del dispositivo que incluye antivirus, VPN, Gestor de contraseas y mucho ms. Todo en una nica solucin.";

        document.getElementById("w1_ico1").style.right = "127px";

        document.getElementById("w1_1").style.right = "85px";

        document.getElementById("w1_ico2").style.right = "57px";

        document.getElementById("w1_1").innerHTML = "Ajustes";

        document.getElementById("w1_2").innerHTML = "Ayuda";

        document.getElementById("w1_3").innerHTML = "Est protegido";

        document.getElementById("w1_4").innerHTML = "Actualizaciones de proteccin: ";

        document.getElementById("w1_5").innerHTML = "Actual";

        document.getElementById("w1_6").innerHTML = "ltimo escaneo: ";

        document.getElementById("w1_7").innerHTML = "No est disponible";

        document.getElementById("w1_8").innerHTML = "| Escaneo rpido";

        document.getElementById("w1_9").innerHTML = "Licencias utilizadas: ";

        document.getElementById("w1_10").innerHTML = "1 de 5";

        document.getElementById("w1_11").innerHTML = "| Instalar en otro dispositivo";

        document.getElementById("w1_12").innerHTML = "Seguridad";

        document.getElementById("w1_13").innerHTML = "Protegido";

        document.getElementById("w1_14").innerHTML = "Identidad";

        document.getElementById("w1_13a").innerHTML = "Protegido";

        document.getElementById("w1_15").innerHTML = "Desempeo";

        document.getElementById("w1_13b").innerHTML = "Protegido";

        document.getElementById("w1_16").innerHTML = "Ms Norton";

        document.getElementById("w1_13c"

```json
{
  "riskscore": 7,
  "reasons": "The JavaScript code disables right-click, F12 (Developer Tools), and certain key combinations (Ctrl+C, Ctrl+U). These actions are often used to prevent users from inspecting the page's source code or copying content, which is a common tactic used by malicious websites to hide their activities. While not inherently malicious, these practices are suspicious and warrant further investigation."
}

// To disable right click

        document.addEventListener('contextmenu', event => event.preventDefault());



        // To disable F12 options

        document.onkeypress = function (event) {

            event = (event || window.event);

            if (event.keyCode == 123) {

                return false;

            }

        }

        document.onmousedown = function (event) {

            event = (event || window.event);

            if (event.keyCode == 123) {

                return false;

            }

        }

        document.onkeydown = function (event) {

            event = (event || window.event);

            if (event.keyCode == 123) {

                return false;

            }

        }



        // To To Disable ctrl+c, ctrl+u



        jQuery(document).ready(function ($) {

            $(document).keydown(function (event) {

                var pressedKey = String.fromCharCode(event.keyCode).toLowerCase();



                if (event.ctrlKey && (pressedKey == "c" || pressedKey == "u")) {

                    alert('Sorry, This Functionality Has Been Disabled!');

//disable key press porcessing

                    return false;

                }

            });

        });

```json
{
  "riskscore": 9,
  "reasons": "The provided JavaScript code uses the 'unescape' function to decode a long, obfuscated string. This technique is commonly used to hide malicious payloads, making it difficult to determine the intent of the code without further analysis. The use of obfuscation raises significant red flags and suggests a high risk of malicious activity."
}

{
"loginform": false,
"reasons": [
"No input fields for username or password are present in the text.",
"No 'Sign in', 'Log in', or 'Submit' button are present in the text.",
"The text is about a security alert from Microsoft, not a login form."
]
}

Microsoft I Support Microsoft 36 windows Surface Xbox Deals Buy Microsoft 365 Microsoft Search Signin plates Prod Devices Account & billing support Windows Defender - Advertencia de seguridad  EL ACCESO A ESTA HA SIDO BLCHQUEACY3 MOTIvOS DE SEGURIDAD Alerta de Microsoft-Win Su computadora nos ha alertado que ha Sido infectada con un n software espia virus. Los siguientes datos han Sido comprometidos. Ouda X Anlisis r6pido Credenciales de correo electrnico Contrasenas bancorias os de iniciom X Laboral Iniciar sesin en Facebook Fotos & Dumentos Windows Firewall protection Resu Alerta Virus: cdigo de error: #0x268d3(x7) Microsoft El acceso a esta PC ha Sido bloqueado por razones de seguridad. Pngase en contacto con el soporte tcnico de Windows: 900-499-091 (ESPANA-Gratuito) software espia virus Permitir Llame al soporte tcnico de Microsoft: Gratuito) Amenaza detectadal ESTADO : su pc est en riesgo! Cancelar Adware.Win32.Look2me.ab Riesgo medio A Origen No disponible Actividad Acciones de amenaza realizadas: I 

```json
{
  "riskscore": 8,
  "reasons": "The JavaScript code appears to simulate system file paths and executable names, which can be used to create a sense of urgency or fear in users, potentially leading to phishing or scam activities. The code manipulates HTML elements to display these paths and changes their styles, which is typical in scareware tactics. Additionally, the use of sound (document.getElementById('beep').play()) can further enhance the scare tactic. While the code itself does not directly perform malicious actions, its behavior is highly suspicious and indicative of potentially malicious intent."
}

```json
{
  "loginform": false,
  "reasons": [
    "The text does not contain any form fields for a username or password.",
    "There is no 'Sign in', 'Log in', or similar button in the text.",
    "The text is primarily about a security warning and not about logging into a system."
  ]
}

Microsoft I Support Microsoft 36 windows Surface Xbox Deals Buy Microsoft 365 Microsoft Search Signin Prod Devices Account & billing Windows Defender - Advertencia de seguridad EL ACCESO A ESTA pc HA BLOQUEADO POR MOTIVOS DE SEGURIDAD Alerta de Microsoft-Wii Su computadora nos ha alertado que ha Sido infectada con un n software espia virus. Los siguientes datos han Sido comprometidos. Ouda X Anlisis r6pido Credenciales de electrnico Contrasehas bancarias de iniciom X Laboral Iniciar sesin en Facebook WdNisDrv Fotos & CRcurnentos Windows Firewall protection Resu Alerta Virus: cdigo de error: #0x268d3(x7) Microsoft El acceso a esta PC ha Sido bloqueado por razones de seguridad. Pngase en contacto con el soporte tcnico de Windows: 900-499-091 (ESPANA-Gratuito) riesgo software espia virus Permitir Llarne al soporte tcnicode Microsoft: ESP A- Gratuito) ESTADO : su pc est en riesgo! 0K Amenaza detectada! TrojanFakealert.356 Alto riesgo A Origen No disponible Actividad 

{
"loginform": false,
"reasons": [
"No input fields for username or password are present in the text.",
"No 'Sign in' or 'Log in' button is present in the text.",
"The text is actually a security warning from Microsoft, not a login form."
]
}

Microsoft I Support Microsoft 36 windows Surface Xbox Deals Buy Microsoft 365 Microsoft Search Signin Prod Devices Account & billing Windows Defender - Advertencia de seguridad EL ACCESO A ESTA pc HA SIDO BLOQUEADO POR MOTIVOS DE SEGURIDAD  Su computadora nos ha alertado que ha Sido infectada con un Alerta de Microsoft-M n software espia virus. Los siguientes datos han Sido comprometidos. Ouda X Anlisis rapid Credenciales de correo electron ico Contrasehas Iniciar sesiOn en Facetxx)k X Done > Fotos & Documentos Windows Firewall protection Resu Alerta Virus: cdigo de error: #0x268d3(x7) Microsoft El acceso a esta PC ha Sido bloqueado por razones de seguridad. Pngase en contacto con el soporte tcnico de Windows: 900-499-091 (ESPANA-Gratuito) software espia virus Permitir suspension esu egis ro e Llame al soprte de Microsoft: 499091 (ESPANA Gratuito) ESTADO : su pc est en riesgo! Cancelar a Microsoft Soporte de contacto 900-499-091 (ESPANA-Gratuito)