Windows Analysis Report
https://facebook-com-hr.pages.mus.br/1000297452188999

• HCA enabled
• EGA enabled
• AMSI enabled

• Successful, ratio: 100%
• Number of executed functions: 0
• Number of non-executed functions: 0

• Browse: https://pages.tempisite.com/10005663456

{
"loginform": true,
"urgency": false,
"captcha": false,
"reasons": [
"A login form was found on the webpage, as indicated by the presence of 'Configurar Enta1di' which suggests a request for user credentials.",
"No urgency was detected in the text, as it does not contain phrases such as 'Click here to view document', 'To view secured document click here', or 'Open the link to see your invoice'.",
"No CAPTCHA or anti-robot detection mechanism was found on the webpage."
]
}

```json
{
  "riskscore": 3,
  "reasons": "The code reads cookies and extracts specific values, which could be used for tracking or identifying users. However, there are no clear signs of malicious activity such as data exfiltration or unauthorized access attempts. The code appears to be related to user identification and tracking, which is common in web analytics and advertising."
}

let random = Math.random().toString();window.eid = 'GPages.'+random.substr(random.length-4)+(new Date()).getTime();var c = '',u = '',fbclid = '',data = new Date();function FormatarDigitosData(valor, digitos) { if (valor.toString().length < digitos) {  return (new Array(digitos - valor.toString().length+1).join('0'))+valor; } else { return valor; } }if(document.cookie != ''){var split = document.cookie.split(';');for(var i = 0; i < split.length; i++){var conteudo = split[i].split('=');if(conteudo[0].indexOf('_fbp') !== -1){ c = conteudo[1]; }if(conteudo[0].indexOf('_fbc') !== -1){ fbclid = conteudo[1]; }if(conteudo[0].indexOf('gpages_user') !== -1){ u = JSON.parse(decodeURI(conteudo[1]).replaceAll('%3A',':').replaceAll('%2C',',').replaceAll('%2F','/').replaceAll('%3B',';')); }}}if(typeof u != undefined){if(u?.eId != undefined){ window.eid = u.eId; }}

{
"loginform": false,
"urgency": false,
"captcha": false,
"reasons": [
"The webpage title 'pages.tempisite.com/10005663456' does not contain any elements indicating a login form.",
"The text 'This page could not be found. 404' does not create a sense of urgency or interest.",
"There is no evidence of a CAPTCHA or anti-robot detection mechanism on the webpage."
]
}

Title: pages.tempisite.com/10005663456 OCR: This page could not be found. 404 

```json
{
  "riskscore": 3,
  "reasons": "The code reads cookies and parses user information, which can be a privacy concern. It also checks for specific user agents related to web crawlers like 'GTmetrix' and 'Lighthouse', which might indicate an attempt to detect and possibly alter behavior for these tools. However, there are no direct signs of malicious activity such as data exfiltration or harmful actions."
}

window.getCrawler = function(){let user = {};if(document.cookie != ''){let split = document.cookie.split(';');for(var i = 0; i < split.length; i++){var conteudo = split[i].split('=');if(conteudo[0].indexOf('gpages_user') !== -1){ user = JSON.parse(decodeURI(conteudo[1]).replaceAll('%3A',':').replaceAll('%2C',',').replaceAll('%2F','/').replaceAll('%3B',';')); }}}if(typeof navigator.userAgentData != 'undefined'){let retorno = false;navigator.userAgentData.brands.forEach(function (item) {if(item.brand.toLowerCase() == 'lighthouse' || item.brand.toLowerCase() == 'gtmetrix'){ retorno = true; }});if(!retorno){ retorno = window.navigator.userAgent.indexOf('GTmetrix') !== -1 ? true : false; }if(user?.agent){ retorno = user.agent.indexOf('GTmetrix') !== -1 || user.agent.indexOf('Lighthouse') !== -1 ? true : false; }return retorno;} else {if(window.navigator.userAgent.indexOf('GTmetrix') !== -1 || window.navigator.userAgent.indexOf('Lighthouse') !== -1){ return true; }else if(user?.agent){ return user.agent.indexOf('GTmetrix') !== -1 || user.agent.indexOf('Lighthouse') !== -1 ? true : false; }else { return false; }}};

```json
{
  "phishing_score": 9,
  "brands": "Facebook",
  "phishing": true,
  "suspicious_domain": true,
  "has_loginform": false,
  "has_captcha": false,
  "setechniques": true,
  "legitmate_domain": "facebook.com",
  "reasons": "The URL 'facebook-com-hr.pages.mus.br' is highly suspicious as it does not match the legitimate domain 'facebook.com'. The use of 'facebook-com' in the subdomain is a common social engineering technique to deceive users into thinking they are on the legitimate Facebook site. The image shows a cookie consent banner in Portuguese, which is not typical for Facebook's main login page. These elements strongly suggest that this is a phishing site."
}