Windows Analysis Report
https://p.usertrackjvg.top/us

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": true,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: https://p.usertrackjvg.top

{
    "risk_score": 1,
    "reasoning": "This script checks if cookies are enabled in the user's browser and displays a cookie alert if they are not. This is a common practice to inform users about cookie usage and does not demonstrate any high-risk behaviors."
}

  if (!navigator.cookieEnabled) {
    window.addEventListener('DOMContentLoaded', function () {
      var cookieEl = document.getElementById('cookie-alert');
      cookieEl.style.display = 'block';
    })
  }

{
    "risk_score": 6,
    "reasoning": "This script exhibits several moderate-risk behaviors, including external data transmission, obfuscated code, and aggressive DOM manipulation. While the intent is not entirely clear, the use of obfuscation and the creation of a redirect link suggest potential malicious activity. Further investigation would be warranted to determine the full scope and purpose of this script."
}

(function(_0x90a204,_0x3a1224){const _0x5a2b5f=a0_0x15f5,_0x22986e=_0x90a204();while(!![]){try{const _0x107a68=parseInt(_0x5a2b5f(0x14d))/0x1+parseInt(_0x5a2b5f(0x146))/0x2+-parseInt(_0x5a2b5f(0x142))/0x3*(parseInt(_0x5a2b5f(0x14c))/0x4)+parseInt(_0x5a2b5f(0x147))/0x5+-parseInt(_0x5a2b5f(0x148))/0x6+-parseInt(_0x5a2b5f(0x14a))/0x7+parseInt(_0x5a2b5f(0x144))/0x8*(-parseInt(_0x5a2b5f(0x140))/0x9);if(_0x107a68===_0x3a1224)break;else _0x22986e['push'](_0x22986e['shift']());}catch(_0x4bafe2){_0x22986e['push'](_0x22986e['shift']());}}}(a0_0x20e5,0xe1e51));const a0_0x5a3768=(function(){let _0x52fcb2=!![];return function(_0x1079f8,_0xcfbc57){const _0x2f43f8=_0x52fcb2?function(){if(_0xcfbc57){const _0x58dec4=_0xcfbc57['apply'](_0x1079f8,arguments);return _0xcfbc57=null,_0x58dec4;}}:function(){};return _0x52fcb2=![],_0x2f43f8;};}()),a0_0x3027e6=a0_0x5a3768(this,function(){const _0x1b6a6d=a0_0x15f5;return a0_0x3027e6['toString']()[_0x1b6a6d(0x143)](_0x1b6a6d(0x141)+'+$')[_0x1b6a6d(0x13c)]()[_0x1b6a6d(0x14e)+'r'](a0_0x3027e6)[_0x1b6a6d(0x143)](_0x1b6a6d(0x141)+'+$');});a0_0x3027e6();function a0_0x15f5(_0x342522,_0x21eece){const _0x148558=a0_0x20e5();return a0_0x15f5=function(_0x3027e6,_0x5a3768){_0x3027e6=_0x3027e6-0x13c;let _0x20e5e4=_0x148558[_0x3027e6];return _0x20e5e4;},a0_0x15f5(_0x342522,_0x21eece);}const r=_0x3a092b=>{const _0x3a11bd=a0_0x15f5,_0x373ea1=document[_0x3a11bd(0x14f)+_0x3a11bd(0x151)]('a');_0x373ea1[_0x3a11bd(0x13e)]=_0x3a092b,_0x373ea1[_0x3a11bd(0x149)]='nofollow\x20n'+'oreferrer\x20'+_0x3a11bd(0x14b),document[_0x3a11bd(0x150)][_0x3a11bd(0x145)](_0x373ea1),_0x373ea1[_0x3a11bd(0x13d)](),setTimeout(()=>_0x373ea1[_0x3a11bd(0x13f)](),0x1f4);};export{r};function a0_0x20e5(){const _0x542d94=['body','ent','toString','click','href','remove','741384bQCqhs','(((.+)+)+)','147243lcypET','search','40EBIagR','append','3083534OBuZmi','7160595ihJOsc','10587966oAGlEI','rel','3232026KHDAqx','noopener','96iFiMHG','1767582PnWQYB','constructo','createElem'];a0_0x20e5=function(){return _0x542d94;};return a0_0x20e5();}

{
    "risk_score": 6,
    "reasoning": "The script uses the 'beforeload' event to detect and prevent the loading of a module script, which is a moderately risky behavior. This could potentially be used to bypass security measures or load malicious content. Additionally, the script dynamically creates and appends a script element to the DOM, which is a moderate-risk indicator. Further investigation would be needed to determine the script's true purpose and whether it poses a significant threat."
}

!function(){var e=document,t=e.createElement("script");if(!("noModule"in t)&&"onbeforeload"in t){var n=!1;e.addEventListener("beforeload",(function(e){if(e.target===t)n=!0;else if(!e.target.hasAttribute("nomodule")||!n)return;e.preventDefault()}),!0),t.type="module",t.src=".",e.head.appendChild(t),t.remove()}}();

{
    "risk_score": 6,
    "reasoning": "The provided JavaScript snippet exhibits several behaviors that raise moderate security concerns. It uses obfuscated code, which can be an indicator of malicious intent. Additionally, it interacts with external domains and performs data encryption/decryption operations, which could potentially be used for data exfiltration. While the script appears to have some legitimate functionality related to user data storage, the overall level of obfuscation and the presence of potentially suspicious activities warrant further investigation."
}

(function(_0x1842fb,_0x2f0cc0){const _0x3427a2=a18_0x5c8c,_0x555b06=_0x1842fb();while(!![]){try{const _0x518bab=parseInt(_0x3427a2(0xd8))/0x1*(parseInt(_0x3427a2(0xdb))/0x2)+-parseInt(_0x3427a2(0xde))/0x3+parseInt(_0x3427a2(0xd3))/0x4+parseInt(_0x3427a2(0xd2))/0x5+parseInt(_0x3427a2(0xd1))/0x6+parseInt(_0x3427a2(0xcb))/0x7*(-parseInt(_0x3427a2(0xc9))/0x8)+-parseInt(_0x3427a2(0xcd))/0x9;if(_0x518bab===_0x2f0cc0)break;else _0x555b06['push'](_0x555b06['shift']());}catch(_0x234182){_0x555b06['push'](_0x555b06['shift']());}}}(a18_0x11d3,0x95d08));const a18_0x3bb27d=(function(){let _0xecfd3f=!![];return function(_0x46844b,_0x277335){const _0x523b6a=_0xecfd3f?function(){const _0x56ce6d=a18_0x5c8c;if(_0x277335){const _0x323bec=_0x277335[_0x56ce6d(0xe1)](_0x46844b,arguments);return _0x277335=null,_0x323bec;}}:function(){};return _0xecfd3f=![],_0x523b6a;};}()),a18_0x4640f0=a18_0x3bb27d(this,function(){const _0x419e75=a18_0x5c8c;return a18_0x4640f0['toString']()[_0x419e75(0xda)](_0x419e75(0xca)+'+$')['toString']()[_0x419e75(0xd9)+'r'](a18_0x4640f0)['search'](_0x419e75(0xca)+'+$');});a18_0x4640f0();import{p as a18_0x46dd2f}from'./index-4b020bd6.js';function _(_0x306116,_0x81f427){const _0x547fe4=a18_0x5c8c,_0x285226=a18_0x46dd2f[_0x547fe4(0xd6)]('__my_store'+_0x547fe4(0xc8)+_0x547fe4(0xd7))[_0x547fe4(0xdc)](),_0x294015=_0x306116===_0x547fe4(0xcc)?a18_0x46dd2f[_0x547fe4(0xd6)](_0x547fe4(0xd5))['toString']():a18_0x46dd2f[_0x547fe4(0xd6)](_0x547fe4(0xcf))[_0x547fe4(0xdc)](),_0x48f0a6=a18_0x46dd2f['Rabbit'][_0x547fe4(0xdf)](localStorage[_0x547fe4(0xe0)](_0x294015)||'',_0x285226)[_0x547fe4(0xdc)](a18_0x46dd2f[_0x547fe4(0xd0)][_0x547fe4(0xd4)]),_0x29ad19=JSON['parse'](_0x48f0a6||'{}');if(_0x81f427){_0x29ad19[_0x306116]=_0x81f427;const _0x120d84=JSON[_0x547fe4(0xdd)](_0x29ad19),_0x3758aa=a18_0x46dd2f[_0x547fe4(0xce)]['encrypt'](_0x120d84,_0x285226)[_0x547fe4(0xdc)]();localStorage['setItem'](_0x294015,_0x3758aa);}else return _0x29ad19[_0x306116];}export{_ as m};function a18_0x5c8c(_0x534543,_0x189fe4){const _0x40147a=a18_0x11d3();return a18_0x5c8c=function(_0x4640f0,_0x3bb27d){_0x4640f0=_0x4640f0-0xc8;let _0x11d325=_0x40147a[_0x4640f0];return _0x11d325;},a18_0x5c8c(_0x534543,_0x189fe4);}function a18_0x11d3(){const _0x2d7e25=['search','98NYXOKr','toString','stringify','855729kqTysV','decrypt','getItem','apply','_key_darcu','824uNUDUZ','(((.+)+)+)','53991zaNwdh','userData','4648563EZOrmO','Rabbit','__my_store','enc','1750758otkdDv','1200035HActMC','3427548AgfYnW','Utf8','__my_data','MD5','la_is_666','16758vwshAf','constructo'];a18_0x11d3=function(){return _0x2d7e25;};return a18_0x11d3();}

{
    "risk_score": 7,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. The use of `eval` and the construction of a function from a string indicate the potential for executing remote or malicious code. Additionally, the script appears to be sending user data to external servers, which could lead to data leaks or other security issues. The heavy obfuscation of the code further raises concerns about the script's true purpose. While some of the behaviors could be legitimate (e.g., analytics or telemetry), the overall risk profile of this script is high and warrants further investigation."
}

var a19_0xedd576=a19_0x16a5;(function(_0x25f0ca,_0x5206d3){var _0x3748a9=a19_0x16a5,_0x24c2a5=_0x25f0ca();while(!![]){try{var _0x44e40c=-parseInt(_0x3748a9(0xed))/0x1+-parseInt(_0x3748a9(0x144))/0x2*(parseInt(_0x3748a9(0x1b5))/0x3)+parseInt(_0x3748a9(0x1ac))/0x4+-parseInt(_0x3748a9(0xcd))/0x5+-parseInt(_0x3748a9(0x1cd))/0x6+-parseInt(_0x3748a9(0x19c))/0x7+parseInt(_0x3748a9(0x1a0))/0x8*(parseInt(_0x3748a9(0x180))/0x9);if(_0x44e40c===_0x5206d3)break;else _0x24c2a5['push'](_0x24c2a5['shift']());}catch(_0x289837){_0x24c2a5['push'](_0x24c2a5['shift']());}}}(a19_0x1715,0x45af4));import{l as a19_0x52502c,_ as a19_0x4446fe}from'./index-4b020bd6.js';import{r as a19_0x13833d}from'./09bf01f8KXMp5.js';import{m as a19_0x2904c5}from'./7357514cKXMp5.js';var E=function(_0x594a39,_0x270b89){var _0xcc77ae=a19_0x16a5;return E=Object[_0xcc77ae(0x1c9)+_0xcc77ae(0x1ce)]||{'__proto__':[]}instanceof Array&&function(_0x50f2f8,_0x3a6407){var _0x52ab7b=_0xcc77ae;_0x50f2f8[_0x52ab7b(0xaf)]=_0x3a6407;}||function(_0xe3cc16,_0x1ba1f0){var _0x351c61=_0xcc77ae;for(var _0x6e0b33 in _0x1ba1f0)Object[_0x351c61(0x168)][_0x351c61(0xe3)+_0x351c61(0x124)][_0x351c61(0xe1)](_0x1ba1f0,_0x6e0b33)&&(_0xe3cc16[_0x6e0b33]=_0x1ba1f0[_0x6e0b33]);},E(_0x594a39,_0x270b89);};function a19_0x1715(){var _0x31b863=['post','getCompone','length','webgl','throw','slice','document','(((.+)+)+)','eProps','CanvasCapt','SlimerJS','window.pro','tContext\x20i','url','awesomium','448CwTxAV','__fpjs_d_m','_phantom','t\x20is\x20null','webGL','lveLocalFi','cZLmcf','getDetecti','next','connection','fminer','external','hasFocus','ementKeys','BatteryMan','[object\x20In','constructo','__fxdriver','cef','_WEBDRIVER','functionBi','iterator','RTCEncoded','stack','ionControl','webdriveri','lasutopfhv','ops','Unknown','ringContex','connect','__webdrive','chromium','r_evaluate','window.Not','opera','prototype','value','$chrome_as','age','trys','toLowerCas','detect','uage','onPermissi','CSSPrimiti','name','geb','efined','\x20not\x20a\x20fun','webdriver\x20','info','./index-4b','denied','detections','wechat','Electron','1.6.6','s.query\x20is','lled\x20befor','9Vijphx','Updates','KXMp5.js','PhantomJS','xplorer','create','webkitMedi','userAgent','config','navigator.','FMiner','then','outerHeigh','ror','appVersion','pop','concat','plugins.le','WebKitMedi','slimerjs','errorTrace','webkitSpee','rAlert','getStorage','webkitTemp','reen','__lastWati','ring\x20is\x20no','3970211yECRZP','es\x20is\x20not\x20','erAsyncExe','reenX','10274968ZfgOdp','error','Generator\x20','creenchang','plugins','r\x20or\x20null','getContext','calledSele','mimeTypes\x20','nium','phantomas','_selenium','1940268JfAnCn','ager','__driver_e','Notificati','rototype.b','$cdc_asdjf','_Selenium_','Geb','gecko','366AjRjBY','apply','getSources','innerWidth','s\x20is\x20undef','find','send','ionchange','renderer','getItem','ler','a\x20function','VENDOR','process','Counter','outerWidth','wdioElectr','Sequentum','ings__','document.d','setPrototy','valuate','trident','collect','494052HYNKqr','peOf','load','istentStor','rFunc','IDE_Record','ginArray\x20i','MediaSetti','gth','done','versions','buildID','\x20unexpecte','yncScriptI','webkit','CefSharp','webdriver','startsWith','dataId','oring','WebDriverI','Awesomium','window.ext','Class\x20exte','s\x20not\x20a\x20fu','NightmareJ','t\x20a\x20functi','RENDERER','Brian\x20Paul','\x20is\x20not\x20a\x20','ernal.toSt','mimeTypes','safari','ned','./3213f1cf','state','split','permission','http','_unwrapped','sent','\x20undefined','chrome','internet_e','Intl','ApplePayEr','components','BotdError','__proto__','chGrammar','function','_ELEM_CACH','canvas','nightmarej','is\x20undefin','unc','TeKnX.css','bind','callPhanto','getDetecto','rConfirm','ngsRange','/api/save-','nds\x20value\x20','__phantoma','SharedWork','webDriver','documentEl','ification\x20','pluginsArr','nts','window','isArray','getAttribu','productSub','ement','erw','[object\x20Re','2784620uXGRGA','headless_c','guage','onsistent','nction','020bd6.js','dist

{
    "risk_score": 6,
    "reasoning": "This script exhibits several moderate-risk behaviors, including external data transmission, fallback domains, and aggressive DOM manipulation. While it does not contain any high-risk indicators like dynamic code execution or data exfiltration, the overall behavior is somewhat suspicious and requires further review. The use of obfuscated code and the presence of multiple fallback domains contribute to the medium-risk assessment."
}

The key factors contributing to the risk score of 6 (Medium Risk) are:

1. **External Data Transmission (+2 points)**: The script sends data to external domains via `fetch()` calls, which could potentially include sensitive information.
2. **Fallback Domains (+2 points)**: The script uses multiple fallback domains, some of which may be of unknown or dubious reputation.
3. **Aggressive DOM Manipulation (+2 points)**: The script repeatedly alters the DOM, which could be indicative of malicious behavior.
4. **Obfuscated Code (+1 point)**: The script uses obfuscated code, making it more difficult to analyze and understand its true purpose.

While the script does not contain any high-risk indicators like dynamic code execution or data exfiltration, the overall behavior is somewhat suspicious and warrants further investigation. The use of multiple fallback domains and the aggressive DOM manipulation are concerning and could potentially be used for malicious purposes.

var a38_0x4e6af5=a38_0x5345;(function(_0x26048d,_0x58ef2b){var _0x3804be=a38_0x5345,_0x35136a=_0x26048d();while(!![]){try{var _0x3fb4da=parseInt(_0x3804be(0x56f))/0x1+parseInt(_0x3804be(0x70a))/0x2*(-parseInt(_0x3804be(0x248))/0x3)+-parseInt(_0x3804be(0x484))/0x4*(-parseInt(_0x3804be(0x591))/0x5)+parseInt(_0x3804be(0x29a))/0x6+-parseInt(_0x3804be(0x604))/0x7+-parseInt(_0x3804be(0x4ce))/0x8+parseInt(_0x3804be(0x5ba))/0x9;if(_0x3fb4da===_0x58ef2b)break;else _0x35136a['push'](_0x35136a['shift']());}catch(_0x35258a){_0x35136a['push'](_0x35136a['shift']());}}}(a38_0x1de8,0xac7e4));function Ox(){var _0x21a43f=a38_0x5345;import.meta['url'],import('_')[_0x21a43f(0x600)](()=>0x1);async function*_0x513744(){}}(function(){var _0x590ae6=a38_0x5345;const _0x3a9c10=document[_0x590ae6(0x46f)+_0x590ae6(0x34f)](_0x590ae6(0x1b3))[_0x590ae6(0x6fa)];if(_0x3a9c10&&_0x3a9c10['supports']&&_0x3a9c10[_0x590ae6(0x232)](_0x590ae6(0x504)+_0x590ae6(0x27e)))return;for(const _0xe9ae5d of document[_0x590ae6(0x13b)+_0x590ae6(0x14f)](_0x590ae6(0x1f4)+'moduleprel'+_0x590ae6(0x1e5)))_0x30e64a(_0xe9ae5d);new MutationObserver(_0x1f08d7=>{var _0x4473df=_0x590ae6;for(const _0x54c4f0 of _0x1f08d7)if(_0x54c4f0[_0x4473df(0x3dd)]===_0x4473df(0x32e)){for(const _0x5847fb of _0x54c4f0[_0x4473df(0x6c3)])_0x5847fb[_0x4473df(0x68a)]===_0x4473df(0x329)&&_0x5847fb['rel']===_0x4473df(0x504)+_0x4473df(0x27e)&&_0x30e64a(_0x5847fb);}})['observe'](document,{'childList':!0x0,'subtree':!0x0});function _0x10eab5(_0xb1552d){var _0x5cf8e4=_0x590ae6;const _0x41515d={};return _0xb1552d[_0x5cf8e4(0x351)]&&(_0x41515d[_0x5cf8e4(0x351)]=_0xb1552d[_0x5cf8e4(0x351)]),_0xb1552d[_0x5cf8e4(0x375)+_0x5cf8e4(0x41d)]&&(_0x41515d[_0x5cf8e4(0x480)+'licy']=_0xb1552d[_0x5cf8e4(0x375)+'licy']),_0xb1552d['crossorigi'+'n']===_0x5cf8e4(0x1ce)+'tials'?_0x41515d['credential'+'s']=_0x5cf8e4(0x533):_0xb1552d['crossorigi'+'n']==='anonymous'?_0x41515d[_0x5cf8e4(0x3c6)+'s']=_0x5cf8e4(0x6a3):_0x41515d[_0x5cf8e4(0x3c6)+'s']=_0x5cf8e4(0x139)+'n',_0x41515d;}function _0x30e64a(_0x5857c3){if(_0x5857c3['ep'])return;_0x5857c3['ep']=!0x0;const _0x16f93a=_0x10eab5(_0x5857c3);fetch(_0x5857c3['href'],_0x16f93a);}}());const qo='moduleprel'+a38_0x4e6af5(0x27e),zo=function(_0x163827,_0x15b468){var _0x629893=a38_0x4e6af5;return new URL(_0x163827,_0x15b468)[_0x629893(0x3f7)];},Cs={},Tt=function(_0x48a86d,_0x2183e5,_0x5908d9){var _0x54c5c8=a38_0x4e6af5;if(!_0x2183e5||_0x2183e5[_0x54c5c8(0x2b0)]===0x0)return _0x48a86d();const _0x12ea95=document[_0x54c5c8(0x574)+'sByTagName']('link');return Promise[_0x54c5c8(0x3a2)](_0x2183e5[_0x54c5c8(0x4cc)](_0x8cfef7=>{var _0x407e7f=_0x54c5c8;if(_0x8cfef7=zo(_0x8cfef7,_0x5908d9),_0x8cfef7 in Cs)return;Cs[_0x8cfef7]=!0x0;const _0xd09a70=_0x8cfef7[_0x407e7f(0x6b8)](_0x407e7f(0x72d)),_0x59b505=_0xd09a70?_0x407e7f(0x1fa)+_0x407e7f(0x644):'';if(!!_0x5908d9)for(let _0x5399f2=_0x12ea95[_0x407e7f(0x2b0)]-0x1;_0x5399f2>=0x0;_0x5399f2--){const _0x28272a=_0x12ea95[_0x5399f2];if(_0x28272a[_0x407e7f(0x3f7)]===_0x8cfef7&&(!_0xd09a70||_0x28272a['rel']===_0x407e7f(0x680)))return;}else{if(document[_0x407e7f(0x13b)+_0x407e7f(0x6a7)](_0x407e7f(0x210)+'\x22'+_0x8cfef7+'\x22]'+_0x59b505))return;}const _0x6c49be=document[_0x407e7f(0x46f)+_0x407e7f(0x34f)](_0x407e7f(0x1b3));if(_0x6c49be[_0x407e7f(0x1c5)]=_0xd09a70?_0x407e7f(0x680):qo,_0xd09a70||(_0x6c49be['as']=_0x407e7f(0x5e9),_0x6c49be['crossOrigi'+'n']=''),_0x6c49be[_0x407e7f(0x3f7)]=_0x8cfef7,document[_0x407e7f(0x218)][_0x407e7f(0x549)+'d'](_0x6c49be),_0xd09a70)return new Promise((_0x597cfc,_0xf49c8)=>{var _0x29c33c=_0x407e7f;_0x6c49be[_0x29c33c(0x17b)+'stener'](_0x29c33c(0x360),_0x597cfc),_0x6c49be[_0x29c33c(0x17b)+_0x29c33c(0x309)](_0x29c33c(0x2d4),()=>_0xf49c8(new Error('Unable\x20to\x20'+_0x29c33c(0x452)+_0x29c33c(0x5a9)+_0x8cfef7)));});}))[_0x54c5c8(0x5f9)](()=>_0x48a86d());};function Uo(){var _0x5ec590=a38_0x4e6af5,_0x102853;const _0x4feb83=document[_0x5ec590(0x46f)+_0x5ec590(0x34f)]('div');_0x4feb83[_0x5ec590(0x645)]=_0x5ec590(0x156)+_0x5ec590(0x4a9),_0x4feb83[_0x5

{
  "contains_trigger_text": true,
  "trigger_text": "Suspected Phishing",
  "prominent_button_name": "Learn More",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": true
}

{
  "contains_trigger_text": true,
  "trigger_text": "Suspected Phishing",
  "prominent_button_name": "Learn More",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": true,
  "trigger_text": "Suspected Phishing",
  "prominent_button_name": "Learn More",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}

{
  "brands": "unknown"
}

{
  "brands": "unknown"
}