Windows Analysis Report
https://l.facebook.com/l.php?u=https%3A%2F%2Ft.me%2FPAWSOG_bot%2FPAWS%3Fstartapp%3Dy6XarDUx%26fbclid%3DIwZXh0bgNhZW0CMTAAAR3IsDSVMcBgD-KKIyBXkOWfUkEFRcacr_vOCRRmviPmkFBUb89K461Xors_aem_phLdcKrpf4KWQzIltAO6sg&h=AT0WVJB1xqSKqrvz6oCyiCr2S_kisddMHHYmkei4Ws2sbL4pRphOmNE4PXT0dksI9PktkcW4m87_ll8cIS3t1M1003

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": true,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://l.facebook.com

{
    "risk_score": 9,
    "reasoning": "This script demonstrates high-risk behavior by redirecting the user to an untrusted, suspicious domain (t.me/PAWSOG_bot) using obfuscated parameters. This is a strong indicator of a potential phishing or malware attempt, as the script is attempting to lure the user to an external site under the guise of a legitimate application or service."
}

document.location.replace("https:\/\/t.me\/PAWSOG_bot\/PAWS?startapp=y6XarDUx&fbclid=IwY2xjawHSHbVleHRuA2FlbQIxMAABHciwNJUxwGAP4oojIFeQ5Z9SQQVFxpyv-84JFGa-I-aQUFRvz0rjrVeiuw_aem_phLdcKrpf4KWQzIltAO6sg");

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a Telegram-related script that handles the initialization of an iframe, redirects to a Telegram protocol URL, and toggles the theme based on user preferences. While it includes some potentially risky behaviors, such as redirecting to a Telegram protocol URL, the overall context suggests this is likely a legitimate script used for Telegram integration. The script does not exhibit any clear malicious intent or high-risk indicators, so it is assessed as a low-risk script."
}

var protoUrl = "tg:\/\/resolve?domain=PAWSOG_bot&appname=PAWS&startapp=y6XarDUx";
if (false) {
  var iframeContEl = document.getElementById('tgme_frame_cont') || document.body;
  var iframeEl = document.createElement('iframe');
  iframeContEl.appendChild(iframeEl);
  var pageHidden = false;
  window.addEventListener('pagehide', function () {
    pageHidden = true;
  }, false);
  window.addEventListener('blur', function () {
    pageHidden = true;
  }, false);
  if (iframeEl !== null) {
    iframeEl.src = protoUrl;
  }
  !false && setTimeout(function() {
    if (!pageHidden) {
      window.location = protoUrl;
    }
  }, 2000);
}
else if (protoUrl) {
  setTimeout(function() {
    window.location = protoUrl;
  }, 100);
}

var tme_bg = document.getElementById('tgme_background');
if (tme_bg) {
  TWallpaper.init(tme_bg);
  TWallpaper.animate(true);
  window.onfocus = function(){ TWallpaper.update(); };
}
document.body.classList.remove('no_transition');

function toggleTheme(dark) {
  document.documentElement.classList.toggle('theme_dark', dark);
  window.Telegram && Telegram.setWidgetOptions({dark: dark});
}
if (window.matchMedia) {
  var darkMedia = window.matchMedia('(prefers-color-scheme: dark)');
  toggleTheme(darkMedia.matches);
  darkMedia.addListener(function(e) {
    toggleTheme(e.matches);
  });
}

    
    

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a wallpaper animation library with no obvious malicious intent. It uses standard web APIs like `canvas`, `requestAnimationFrame`, and `addEventListener` to create a dynamic wallpaper effect. While it includes some legacy practices like `XDomainRequest`, the overall behavior is benign and likely intended for legitimate purposes. The code does not exhibit any high-risk indicators like dynamic code execution, data exfiltration, or suspicious redirects. Therefore, the risk score is assessed as low."
}

var TWallpaper=function(){function x(a){for(var b=[].concat(G);0<a;)b.push(b.shift()),a--;a=[];for(var c=0;c<b.length;c+=2)a.push(b[c]);return a}function B(a,b){b%=90;var c=x(a%p);if(b){var d=x(++a%p);return[{x:c[0].x+(d[0].x-c[0].x)/90*b,y:c[0].y+(d[0].y-c[0].y)/90*b},{x:c[1].x+(d[1].x-c[1].x)/90*b,y:c[1].y+(d[1].y-c[1].y)/90*b},{x:c[2].x+(d[2].x-c[2].x)/90*b,y:c[2].y+(d[2].y-c[2].y)/90*b},{x:c[3].x+(d[3].x-c[3].x)/90*b,y:c[3].y+(d[3].y-c[3].y)/90*b}]}return c}function H(a){for(l+=a;90<=l;)l-=90,g++,g>=p&&(g-=p);for(;0>l;)l+=90,g--,0>g&&(g+=p)}function I(a){C+=a.deltaY;D||(requestAnimationFrame(P),D=!0)}function P(){var a=C/50;C%=50;if(a=0<a?Math.floor(a):Math.ceil(a))H(a),a=B(g,l),y(z(a));D=!1}function Q(){if(0<A.length){var a=A.shift();y(a)}else clearInterval(E)}function z(a){for(var b=f._hctx.createImageData(50,50),c=b.data,d=0,q=0;50>q;q++)for(var h=q/50-.5,F=h*h,v=0;50>v;v++){var m=v/50-.5,e=.35*Math.sqrt(m*m+F);e=e*e*6.4;var r=Math.sin(e),w=Math.cos(e);e=Math.max(0,Math.min(1,.5+m*w-h*r));m=Math.max(0,Math.min(1,.5+m*r+h*w));for(var J=w=r=0,K=0,t=0;t<u.length;t++){var k=e-a[t].x,L=m-a[t].y;k=Math.max(0,.9-Math.sqrt(k*k+L*L));k*=k*k*k;r+=k;w+=k*u[t].r/255;J+=k*u[t].g/255;K+=k*u[t].b/255}c[d++]=w/r*255;c[d++]=J/r*255;c[d++]=K/r*255;c[d++]=255}return b}function y(a){f._hctx.putImageData(a,0,0);f._ctx.drawImage(f._hc,0,0,50,50)}function M(){var a=+Date.now();!document.hasFocus()||a-N<R||(N=a,H(1),a=B(g,l),y(z(a)));O=requestAnimationFrame(M)}var g=0,l=0,N=0,R=1E3/15,A=[],E=null,O=null,u=[],n=[0,.25,.5,.75,1,1.5,2,2.5,3,3.5,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,18.3,18.6,18.9,19.2,19.5,19.8,20.1,20.4,20.7,21,21.3,21.6,21.9,22.2,22.5,22.8,23.1,23.4,23.7,24,24.3,24.6,24.9,25.2,25.5,25.8,26.1,26.3,26.4,26.5,26.6,26.7,26.8,26.9,27],G=[{x:.8,y:.1},{x:.6,y:.2},{x:.35,y:.25},{x:.25,y:.6},{x:.2,y:.9},{x:.4,y:.8},{x:.65,y:.75},{x:.75,y:.4}],p=G.length,D=!1,C=0,f={init:function(a){u=[];var b=a.getAttribute("data-colors")||"";b&&(b=b.split(","));for(var c=0;c<b.length;c++){var d=u,q=d.push;var h=(h=/^#?([a-f\d]{2})([a-f\d]{2})([a-f\d]{2})$/i.exec(b[c]))?{r:parseInt(h[1],16),g:parseInt(h[2],16),b:parseInt(h[3],16)}:null;q.call(d,h)}f._hc||(f._hc=document.createElement("canvas"),f._hc.width=50,f._hc.height=50,f._hctx=f._hc.getContext("2d"));f._canvas=a;f._ctx=f._canvas.getContext("2d");f.update()},update:function(){var a=B(g,l);y(z(a))},toNextPosition:function(){clearInterval(E);A=[];var a=x(g%p);g++;var b=x(g%p),c=(b[0].x-a[0].x)/27,d=(b[0].y-a[0].y)/27,q=(b[1].x-a[1].x)/27,h=(b[1].y-a[1].y)/27,F=(b[2].x-a[2].x)/27,v=(b[2].y-a[2].y)/27,m=(b[3].x-a[3].x)/27;b=(b[3].y-a[3].y)/27;for(var e=0;60>e;e++)A.push(z([{x:a[0].x+c*n[e],y:a[0].y+d*n[e]},{x:a[1].x+q*n[e],y:a[1].y+h*n[e]},{x:a[2].x+F*n[e],y:a[2].y+v*n[e]},{x:a[3].x+m*n[e],y:a[3].y+b*n[e]}]));E=setInterval(Q,1E3/30)},animate:function(a){a?M():cancelAnimationFrame(O)},scrollAnimate:function(a){a?document.addEventListener("wheel",I):document.removeEventListener("wheel",I)}};return f}();

{
"contains_trigger_text": true,
"trigger_text": "Animals are done! It's PAWS Season",
"prominent_button_name": "Download",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": true,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://t.me

{
  "brands": [
    "PAWS"
  ]
}

{
    "risk_score": 4,
    "reasoning": "The provided JavaScript snippet contains a mix of low-risk and moderate-risk indicators. While it does not exhibit any high-risk behaviors, there are some concerns around external data transmission and aggressive DOM manipulation. The overall risk is assessed as medium, requiring further review to ensure the script's legitimacy and intended purpose."
}

var startTime = +(new Date());
function dT() {
  return '[' + ((+(new Date()) - startTime)/ 1000.0) + '] ';
}

var jsonpCallbacks = [];
function twitterCustomShareInit () {
  var btns = document.querySelectorAll
                ? document.querySelectorAll('.tl_twitter_share_btn')
                : [document.getElementById('tl_twitter_share_btn')];

  if (!btns.length) {
    return;
  }
  var head = document.getElementsByTagName('head')[0], i, script;
  for (i = 0; i < btns.length; i++) {
    (function (btn) {
      var status = btn.getAttribute('data-text'),
          url = btn.getAttribute('data-url') || location.toString() || 'https://telegram.org/',
          via = btn.getAttribute('data-via'),
          urlEncoded = encodeURIComponent(url),
          popupUrl = 'https://twitter.com/intent/tweet?text=' + encodeURIComponent(status) + '&url=' + urlEncoded + '&via=' + encodeURIComponent(via);

      btn.setAttribute('href', popupUrl);
      btn.href = popupUrl;

      btn.addEventListener('click', function (e) {
        var popupW = 550,
            popupH = 450,
            params = [
              'width=' + popupW,
              'height=' + popupH,
              'left=' + Math.round(screen.width / 2 - popupW / 2),
              'top=' + Math.round(screen.height / 2 - popupH / 2),
              'personalbar=0',
              'toolbar=0',
              'scrollbars=1',
              'resizable=1'
            ].join(','),
            popup = window.open(popupUrl, '_blank', params);

        if (popup) {
          try {
            popup.focus();
          } catch (e) {}
        }

        return cancelEvent(e);
      }, false);
    })(btns[i]);
  }
}

function blogRecentNewsInit () {
  if (document.querySelectorAll) {
    var sideImages = document.querySelectorAll('.blog_side_image_wrap');
    var sideImage, parent, i;
    var len = len = sideImages.length;
    for (i = 0; i < len; i++) {
      sideImage = sideImages[i];
      parent = sideImage.parentNode.parentNode;
      if (parent) {
        parent.insertBefore(sideImage, parent.firstChild);
      }
    }
  }

  var moreBtn = document.getElementById('tlb_blog_head_more_link');
  if (!moreBtn) {
    return false;
  }

  var activeClassName = 'tlb_blog_head_recent_active';
  moreBtn.addEventListener('click', function (event) {
    var parent = this.parentNode;
    var className = parent.className;
    if (className.indexOf(activeClassName) == -1) {
      className += ' ' + activeClassName;
    } else {
      className = className.replace(' ' + activeClassName, '');
    }
    parent.className = className;

    return cancelEvent(event);
  });
}

function blogSideImageUpdate(argument) {
  var isDesktop = document.documentElement.offsetWidth >= 1000
  document.querySelectorAll('.blog_side_image_wrap').forEach(function (imageWrap) {
    if (isDesktop) {
      var titleHeight = imageWrap.parentNode.previousElementSibling.clientHeight;
      var beforeTitleEl = imageWrap.parentNode.previousElementSibling.previousElementSibling;
      if (beforeTitleEl) {
        titleHeight += beforeTitleEl.clientHeight;
      }
      imageWrap.firstElementChild.style.marginTop = (-titleHeight - 8) + 'px';
    } else {
      imageWrap.firstElementChild.style.marginTop = '';
    }
  })
}

function blogSideImageInit() {
  window.addEventListener('resize', blogSideImageUpdate, false);
  setTimeout(blogSideImageUpdate, 0);
}

function cancelEvent (event) {
  event = event || window.event;
  if (event) event = event.originalEvent || event;

  if (event.stopPropagation) event.stopPropagation();
  if (event.preventDefault) event.preventDefault();

  return false;
}

function trackDlClick (element, event) {
  var href = element.getAttribute('href'),
      track = element.getAttribute('data-track') || false;

  if (!track || !window.ga) {
    return;
  }

  var trackData = track.toString().split('/');

  ga('send', 'event', trackData[0], trackData[1], href);

  if ((element.getAttribute('target') || '').toLower

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://desktop.telegram.org

{
  "brands": [
    "Telegram"
  ]
}

{
"contains_trigger_text": true,
"trigger_text": "Animals are done! It's PAWS Season",
"prominent_button_name": "OPEN APP",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "Telegram",
    "PAWS"
  ]
}

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://telegram.org