Windows Analysis Report
http://124.110.62.12:50000

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": true,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: http://124.110.62.12:50000

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript code appears to be a legitimate login form validation and localization functionality. It does not exhibit any high-risk indicators, such as dynamic code execution, data exfiltration, or redirects to suspicious domains. The code focuses on basic form validation, setting language preferences, and ensuring the password field is focused. While it uses some legacy practices like `document.forms[0]` and `getCookie()`, these are not inherently malicious. Overall, the code seems to be a standard implementation of common web application features, with a low risk profile."
}

        function focusOnPwd()
        {
            try {
                form=document.forms[0];
                if(form && form.user)
                    form.user.focus();
            } catch (e) { errorReport(e); }
        }

        function validate(form)
        {
            if(form.user.value == ""){
                alert( _nudecodecore(get_trans_str('v_user_check')) );
                form.user.focus();
                return false;
            }
            if(form.pass.value == ""){
                alert( _nudecodecore(get_trans_str('v_passwd_check')) );
                form.pass.focus();
                return false;
            }
            return true;
        }

        function setLocalization(s)
        {
            var lang = s.options[s.selectedIndex].value;
            var current_lang = getCookie("lang");

            if (lang != current_lang)
            {
                setLangCookie(lang);
                initializeLanguagePack();
                changeLang();
            }

            focusOnPwd();
        }

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript snippet appears to be a legitimate script focused on language and user interface functionality. It does not exhibit any high-risk indicators, such as dynamic code execution, data exfiltration, or suspicious redirects. The script primarily handles language selection, cookie setting, and an alert for older Internet Explorer versions, which are common practices. While it uses some legacy APIs like `YAHOO.util.Event.onDOMReady`, these are low-risk indicators. Overall, the script seems to be a benign implementation of standard web application features."
}

YAHOO.util.Event.onDOMReady(
  function() {
      focusOnPwd();

      var current_lang = "en";//getCookie("lang");
      var sel_lang = YAHOO.util.Dom.get("sel_language");
      if (sel_lang)
      {
          var ops = sel_lang.options;
          if (ops)
          {
              for (var i=0; i<ops.length; i++)
              {
                  if (ops[i].value == current_lang)
                  {
                      ops.selectedIndex = i;
                      break;
                  }
              }
          }
      }

      setLangCookie(current_lang);
      initializeLanguagePack();
      changeLang();

      ieVer = YAHOO.env.ua.ie;
      if (ieVer>0 && ieVer<7)
      {
           alert(_nudecodecore(get_trans_str('v_ie_alert')));
      }

  }
);

{
    "risk_score": 4,
    "reasoning": "The provided JavaScript code has a mix of low-risk and moderate-risk indicators. While it does not exhibit any high-risk behaviors, it contains some potentially concerning practices that warrant further review. The code opens a new window and dynamically generates HTML content, which could be used for legitimate purposes but also raises some security considerations. Additionally, the use of the `decodecore` function to handle encoded data introduces a moderate risk, as the behavior of this function is not entirely clear. Overall, the code requires closer inspection to determine the specific intent and potential risks."
}

function openSubWin(status,str) { 
  var chasm = screen.availWidth;
  var mount = screen.availHeight;    
  var w = 450;
  var h = 150;
  if (status=="ok"){
     s="../images/ok.gif";
  }
  else if (status=="warn"){
     s="../images/warn.gif";
  }
  else if (status=="error"){
     s="../images/error.jpg";
  }
  subWin = window.open("",'subWin','width=' + w + ',height=' + h + 
                       ',left=' + ((chasm - w - 10) * .5) + ',top=' + ((mount - h - 30) * .5)+
                       ',resizable=0,menubar=0,location=0,toolbar=0,scrollbars=1,status=0');

var ePen ='<html><head><script>self.focus()</script><title>message box</title></head>';
 ePen += '<body onBlur="javascript:this.focus()"><tt><p></p>';
 ePen += '<p><left><img src=';
 ePen += s;
 ePen += '></center></p><p>';
 ePen += str;
 ePen += '</p><form><p align=center>';
 ePen += '<input type=button value=OK! onClick=self.close() ></p></form>';
 ePen +='</body></html>';
 
var wd = subWin.document;
wd.open();
wd.write(ePen);
wd.close();
}

function decodecore(message) {
	var decodedary = new Array();
	var aryno = 0;
	var notfinish = (true);
	var lastout = 0;
	var lastand = 0;
	var lastsemicolon = 0;
	while (notfinish) {
		lastand = message.indexOf("&#",lastsemicolon);
		if (lastand == -1) {
			decodedary[aryno] = message.substring(lastout,message.length+1);
			aryno++;
			notfinish = (false);
		} else {
			lastsemicolon = message.indexOf(";",lastand);
			decodedary[aryno] = message.substring(lastout,lastand);
			var notbreak = (true);
			if ((decodedary[aryno].indexOf(String.fromCharCode(92)+"n") != -1)&&(document.form.breaktype.value == "js")) {
				while (notbreak) {
					decodedary[aryno] = decodedary[aryno].substring(0,decodedary[aryno].indexOf(String.fromCharCode(92)+"n")-1)+String.fromCharCode(13)+String.fromCharCode(10);+decodedary[aryno].substring(decodedary[aryno].indexOf(String.fromCharCode(92)+"n")+1,decodedary[aryno].length);
					if (decodedary[aryno].indexOf(String.fromCharCode(92)+"n") == -1) notbreak = (false);
				}
			}
			if ((decodedary[aryno].indexOf("<BR>") != -1)&&(document.form.breaktype.value == "htmlbr")) {
				while (notbreak) {
					decodedary[aryno] = decodedary[aryno].substring(0,decodedary[aryno].indexOf("<BR>")-1)+String.fromCharCode(13)+String.fromCharCode(10)+decodedary[aryno].substring(decodedary[aryno].indexOf("<BR>")+4,decodedary[aryno].length);
					if (decodedary[aryno].indexOf("<BR>") == -1) notbreak = (false);
				}
			}
			if ((decodedary[aryno].indexOf("\n") != -1)&&(document.form.breaktype.value == "clean")) {
				while (notbreak) {
					decodedary[aryno] = decodedary[aryno].substring(0,decodedary[aryno].indexOf("\n")-1)+decodedary[aryno].substring(decodedary[aryno].indexOf("\n")+3,decodedary[aryno].length);
					if (decodedary[aryno].indexOf("\n") == -1) notbreak = (false);
				}
			}
			aryno++;
			var base;
			if ((message.substr(lastand+2,1) == "X")||(message.substr(lastand+2,1) == "x"))
				base = 16;
			else base = 10;
			var charcode = parseInt(((base == 16)?"0":"")+message.substring(lastand+2,lastsemicolon));
			if (charcode == 13) decodedary[aryno] = "";
			else decodedary[aryno] = String.fromCharCode(charcode);
			aryno++;
			lastout = lastsemicolon+1;
		}
	}
	//decode end

	return(decodedary.join(""));
}

{
    "risk_score": 1,
    "reasoning": "The provided JavaScript snippet appears to be a part of the YUI (Yahoo User Interface) library, which is a legitimate and widely-used JavaScript framework. The code does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or redirects to malicious domains. The code is primarily focused on namespace management, logging, and version registration, which are common practices in JavaScript libraries. While the code uses some legacy APIs like `XDomainRequest`, these pose minor risks and are not inherently malicious. Overall, this script is likely benign and can be considered low risk."
}

/*
Copyright (c) 2011, Yahoo! Inc. All rights reserved.
Code licensed under the BSD License:
http://developer.yahoo.com/yui/license.html
version: 2.9.0
*/
if(typeof YAHOO=="undefined"||!YAHOO){var YAHOO={};}YAHOO.namespace=function(){var b=arguments,g=null,e,c,f;for(e=0;e<b.length;e=e+1){f=(""+b[e]).split(".");g=YAHOO;for(c=(f[0]=="YAHOO")?1:0;c<f.length;c=c+1){g[f[c]]=g[f[c]]||{};g=g[f[c]];}}return g;};YAHOO.log=function(d,a,c){var b=YAHOO.widget.Logger;if(b&&b.log){return b.log(d,a,c);}else{return false;}};YAHOO.register=function(a,f,e){var k=YAHOO.env.modules,c,j,h,g,d;if(!k[a]){k[a]={versions:[],builds:[]};}c=k[a];j=e.version;h=e.build;g=YAHOO.env.listeners;c.name=a;c.version=j;c.build=h;c.versions.push(j);c.builds.push(h);c.mainClass=f;for(d=0;d<g.length;d=d+1){g[d](c);}if(f){f.VERSION=j;f.BUILD=h;}else{YAHOO.log("mainClass is undefined for module "+a,"warn");}};YAHOO.env=YAHOO.env||{modules:[],listeners:[]};YAHOO.env.getVersion=function(a){return YAHOO.env.modules[a]||null;};YAHOO.env.parseUA=function(d){var e=function(i){var j=0;return parseFloat(i.replace(/\./g,function(){return(j++==1)?"":".";}));},h=navigator,g={ie:0,opera:0,gecko:0,webkit:0,chrome:0,mobile:null,air:0,ipad:0,iphone:0,ipod:0,ios:null,android:0,webos:0,caja:h&&h.cajaVersion,secure:false,os:null},c=d||(navigator&&navigator.userAgent),f=window&&window.location,b=f&&f.href,a;g.secure=b&&(b.toLowerCase().indexOf("https")===0);if(c){if((/windows|win32/i).test(c)){g.os="windows";}else{if((/macintosh/i).test(c)){g.os="macintosh";}else{if((/rhino/i).test(c)){g.os="rhino";}}}if((/KHTML/).test(c)){g.webkit=1;}a=c.match(/AppleWebKit\/([^\s]*)/);if(a&&a[1]){g.webkit=e(a[1]);if(/ Mobile\//.test(c)){g.mobile="Apple";a=c.match(/OS ([^\s]*)/);if(a&&a[1]){a=e(a[1].replace("_","."));}g.ios=a;g.ipad=g.ipod=g.iphone=0;a=c.match(/iPad|iPod|iPhone/);if(a&&a[0]){g[a[0].toLowerCase()]=g.ios;}}else{a=c.match(/NokiaN[^\/]*|Android \d\.\d|webOS\/\d\.\d/);if(a){g.mobile=a[0];}if(/webOS/.test(c)){g.mobile="WebOS";a=c.match(/webOS\/([^\s]*);/);if(a&&a[1]){g.webos=e(a[1]);}}if(/ Android/.test(c)){g.mobile="Android";a=c.match(/Android ([^\s]*);/);if(a&&a[1]){g.android=e(a[1]);}}}a=c.match(/Chrome\/([^\s]*)/);if(a&&a[1]){g.chrome=e(a[1]);}else{a=c.match(/AdobeAIR\/([^\s]*)/);if(a){g.air=a[0];}}}if(!g.webkit){a=c.match(/Opera[\s\/]([^\s]*)/);if(a&&a[1]){g.opera=e(a[1]);a=c.match(/Version\/([^\s]*)/);if(a&&a[1]){g.opera=e(a[1]);}a=c.match(/Opera Mini[^;]*/);if(a){g.mobile=a[0];}}else{a=c.match(/MSIE\s([^;]*)/);if(a&&a[1]){g.ie=e(a[1]);}else{a=c.match(/Gecko\/([^\s]*)/);if(a){g.gecko=1;a=c.match(/rv:([^\s\)]*)/);if(a&&a[1]){g.gecko=e(a[1]);}}}}}}return g;};YAHOO.env.ua=YAHOO.env.parseUA();(function(){YAHOO.namespace("util","widget","example");if("undefined"!==typeof YAHOO_config){var b=YAHOO_config.listener,a=YAHOO.env.listeners,d=true,c;if(b){for(c=0;c<a.length;c++){if(a[c]==b){d=false;break;}}if(d){a.push(b);}}}})();YAHOO.lang=YAHOO.lang||{};(function(){var f=YAHOO.lang,a=Object.prototype,c="[object Array]",h="[object Function]",i="[object Object]",b=[],g={"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#x27;","/":"&#x2F;","`":"&#x60;"},d=["toString","valueOf"],e={isArray:function(j){return a.toString.apply(j)===c;},isBoolean:function(j){return typeof j==="boolean";},isFunction:function(j){return(typeof j==="function")||a.toString.apply(j)===h;},isNull:function(j){return j===null;},isNumber:function(j){return typeof j==="number"&&isFinite(j);},isObject:function(j){return(j&&(typeof j==="object"||f.isFunction(j)))||false;},isString:function(j){return typeof j==="string";},isUndefined:function(j){return typeof j==="undefined";},_IEEnumFix:(YAHOO.env.ua.ie)?function(l,k){var j,n,m;for(j=0;j<d.length;j=j+1){n=d[j];m=k[n];if(f.isFunction(m)&&m!=a[n]){l[n]=m;}}}:function(){},escapeHTML:function(j){return j.replace(/[&<>"'\/`]/g,function(k){return g[k];});},extend:function(m,n,l){if(!n||!m){throw new Error("extend failed, please check that "+"all dependencies are included.");}var k=function(

{
    "risk_score": 4,
    "reasoning": "The provided JavaScript code appears to be a language translation and localization utility. It includes functions for making HTTP requests, retrieving translation strings, and updating the content of HTML elements based on the user's language preference. While the code does not exhibit any high-risk behaviors, it does have some moderate-risk indicators, such as the use of legacy APIs like `ActiveXObject` and the potential for aggressive DOM manipulation. Additionally, the code handles cookies and language preferences, which could be a concern if not implemented securely. Overall, the code requires further review to ensure proper security practices, but it does not appear to be inherently malicious."
}

var NVR_LANG_VERSION="03.11.0000.0016";
var langTrans;
var errMsg;
var currentLang;

function get_req()
{
    var http_request = false;
    if (window.XMLHttpRequest)
    {
        http_request = new XMLHttpRequest();
    } else if (window.ActiveXObject) {
        try {
            http_request = new ActiveXObject("Msxml2.XMLHTTP");
        } catch (e) {
            try {
                http_request = new ActiveXObject("Microsoft.XMLHTTP");
            } catch (e) {}
        }
    }
    return http_request;
}

function get_trans_str(langid)
{
    if (undefined == langid)
        return "";

try {
    if (langTrans[ langid ])
    {
        return langTrans[ langid ];
    }
} catch (e) { return ''; }

    return langid;
}

function changeLang()
{
try{
    var elem = document.getElementsByTagName("span");
    var pattern = new RegExp("(^| )trans( |$)");
    var pattern2 = new RegExp("(^| )notooltip( |$)");
    if (elem && elem.length>0)
    {
        for (var i=0; i<elem.length; i++)
        {
            if (pattern.test(elem[i].className))
            {
                var langid = elem[i].getAttribute('langid');
                if (langid)
                {
                    var t = langTrans[ langid ];
                    if (t != undefined)
                    {
                        elem[i].innerHTML = t;
                        if (!pattern2.test(elem[i].className))
                            elem[i].setAttribute('title', _nudecodecore(t));
                    }
                }
            }
        }
    }
    var elem2 = document.getElementsByTagName("div");
    if (elem2 && elem2.length>0)
    {
        for (var i=0; i<elem2.length; i++)
        {
            if (pattern.test(elem2[i].className))
            {
                var langid = elem2[i].getAttribute('langid');
                if (langid)
                {
                    var t = langTrans[ langid ];
                    if (t != undefined)
                    {
                        elem2[i].innerHTML = t;
                        elem2[i].setAttribute('title', _nudecodecore(t));
                    }
                }
            }
        }
    }

    var elem3 = document.getElementsByTagName("input");
    if (elem3 && elem3.length>0)
    {
        for (var i=0; i<elem3.length; i++)
        {
            if (pattern.test(elem3[i].className))
            {
                var inputType = elem3[i].getAttribute('type');
                if (inputType == 'button' || inputType == 'submit')
                {
                    var langid = elem3[i].getAttribute('langid');
                    if (langid)
                    {
                        var t = langTrans[ langid ];
                        if (t != undefined)
                        {
                            elem3[i].setAttribute('value', _nudecodecore(t));
                        }
                    }
                }
            }
        }
    }
} catch (e) { errorReport(e); }
}

function setLangCookie(lang)
{
    expires=new Date();
    expires.setTime( expires.getTime( ) + 31536000000); // 1 years
    setCookie("lang", lang, expires);
}

function setCookie(name, value, expires)
{
    cookieStr = name + "=" + escape(value);
    if (expires)
    {
        cookieStr += "; expires=" + expires.toGMTString();
    }
    document.cookie = cookieStr;
}

function getCookie(Name) 
{
    var search = Name + "="
    if (document.cookie.length > 0) { 
        // if there are any cookies
        offset = document.cookie.indexOf(search)
        if (offset != -1)
        { 
            // if cookie exists
            offset += search.length

            // set index of beginning of value
            end = document.cookie.indexOf(";", offset)

            // set index of end of cookie value
            if (end == -1)
            end = document.cookie.length

            return unescape(document.cookie.substring(offset, end))
        }
    }
    return null;
}

function formatLangStr()
{
    var args 

{
  "contains_trigger_text": true,
  "trigger_text": "NUUO Network Video Recorder",
  "prominent_button_name": "Login",
  "text_input_field_labels": [
    "Language",
    "Username",
    "Password"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "NUUO"
  ]
}

```json{  "legit_domain": "nuuo.com",  "classification": "known",  "reasons": [    "The brand 'NUUO' is associated with security and surveillance solutions, and its legitimate domain is 'nuuo.com'.",    "The URL provided is an IP address (124.110.62.12), which is unusual for legitimate brand websites that typically use domain names.",    "IP addresses are often used in phishing attempts to obscure the true destination of the link.",    "The presence of input fields for 'Username' and 'Password' on a page accessed via an IP address is suspicious and indicative of a potential phishing attempt."  ],  "riskscore": 8}
Google indexed: False