Windows Analysis Report
https://linkedln.contact/ugtxCQqLJUk?in/fuat-kirikci22-46d64297c/

{
    "typosquatting": true,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": true,
    "third_party_hosting": true
}

URL: https://linkedln.contact

{
    "risk_score": 7,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. While some of the behaviors may be related to legitimate functionality like module loading and error handling, the overall level of risk is high due to the presence of multiple malicious indicators."
}

The script exhibits the following behaviors:

1. **Dynamic Code Execution (3 points)**: The script uses the `Function` constructor and `eval` to execute dynamic code, which is a high-risk indicator.
2. **Data Exfiltration (3 points)**: The script sends data to external servers, which could potentially include sensitive information like cookies or user data.
3. **Obfuscated Code/URLs (3 points)**: The script uses heavily obfuscated code, making it difficult to analyze and understand its true purpose.
4. **External Data Transmission (2 points)**: The script sends data to third-party domains via `XHR` and `fetch` calls, which could be a concern depending on the nature of the data being transmitted.

While the script may have some legitimate functionality, such as module loading and error handling, the presence of multiple high-risk indicators outweighs any potential benign use cases. Therefore, the overall risk score is set to 7, indicating a high-risk script that requires further investigation and mitigation.

!function(){"use strict";var e={},n={};function t(r){var o=n[r];if(void 0!==o)return o.exports;var f=n[r]={id:r,loaded:!1,exports:{}};return e[r].call(f.exports,f,f.exports,t),f.loaded=!0,f.exports}t.m=e,function(){var e=[];t.O=function(n,r,o,f){if(!r){var i=1/0;for(d=0;d<e.length;d++){r=e[d][0],o=e[d][1],f=e[d][2];for(var u=!0,c=0;c<r.length;c++)(!1&f||i>=f)&&Object.keys(t.O).every((function(e){return t.O[e](r[c])}))?r.splice(c--,1):(u=!1,f<i&&(i=f));if(u){e.splice(d--,1);var a=o();void 0!==a&&(n=a)}}return n}f=f||0;for(var d=e.length;d>0&&e[d-1][2]>f;d--)e[d]=e[d-1];e[d]=[r,o,f]}}(),t.n=function(e){var n=e&&e.__esModule?function(){return e.default}:function(){return e};return t.d(n,{a:n}),n},function(){var e,n=Object.getPrototypeOf?function(e){return Object.getPrototypeOf(e)}:function(e){return e.__proto__};t.t=function(r,o){if(1&o&&(r=this(r)),8&o)return r;if("object"===typeof r&&r){if(4&o&&r.__esModule)return r;if(16&o&&"function"===typeof r.then)return r}var f=Object.create(null);t.r(f);var i={};e=e||[null,n({}),n([]),n(n)];for(var u=2&o&&r;"object"==typeof u&&!~e.indexOf(u);u=n(u))Object.getOwnPropertyNames(u).forEach((function(e){i[e]=function(){return r[e]}}));return i.default=function(){return r},t.d(f,i),f}}(),t.d=function(e,n){for(var r in n)t.o(n,r)&&!t.o(e,r)&&Object.defineProperty(e,r,{enumerable:!0,get:n[r]})},t.f={},t.e=function(e){return Promise.all(Object.keys(t.f).reduce((function(n,r){return t.f[r](e,n),n}),[]))},t.u=function(e){return"static/js/"+e+"."+{9:"09d61518",22:"948e05b0",23:"e3fedd1c",44:"cadc0bea",89:"24e5e21b",136:"70cb11a6",150:"af93b7e1",158:"b973516a",160:"4aeb2ca1",237:"c73162c0",240:"b9be35fc",249:"beadfb78",287:"e0d7d77c",364:"e9b716cd",373:"84853d18",384:"4265d106",385:"38ba5d9f",428:"6e4ce2e3",434:"e5046da2",445:"a2ea37da",510:"23ffd1db",513:"ded32add",525:"661e4b65",539:"7767a69b",656:"0d8f06f3",683:"3f8f74f1",690:"dab8a559",706:"9c282210",707:"0798dbf5",708:"69bd3cf8",810:"779c23ee",831:"12f9d8a9",936:"bc981dce",970:"fa7e81f1"}[e]+".chunk.js"},t.miniCssF=function(e){},t.g=function(){if("object"===typeof globalThis)return globalThis;try{return this||new Function("return this")()}catch(e){if("object"===typeof window)return window}}(),t.hmd=function(e){return(e=Object.create(e)).children||(e.children=[]),Object.defineProperty(e,"exports",{enumerable:!0,set:function(){throw new Error("ES Modules may not assign module.exports or exports.*, Use ESM export syntax, instead: "+e.id)}}),e},t.o=function(e,n){return Object.prototype.hasOwnProperty.call(e,n)},function(){var e={};t.l=function(n,r,o,f){if(e[n])e[n].push(r);else{var i,u;if(void 0!==o)for(var c=document.getElementsByTagName("script"),a=0;a<c.length;a++){var d=c[a];if(d.getAttribute("src")==n){i=d;break}}i||(u=!0,(i=document.createElement("script")).charset="utf-8",i.timeout=120,t.nc&&i.setAttribute("nonce",t.nc),i.src=n),e[n]=[r];var l=function(t,r){i.onerror=i.onload=null,clearTimeout(s);var o=e[n];if(delete e[n],i.parentNode&&i.parentNode.removeChild(i),o&&o.forEach((function(e){return e(r)})),t)return t(r)},s=setTimeout(l.bind(null,void 0,{type:"timeout",target:i}),12e4);i.onerror=l.bind(null,i.onerror),i.onload=l.bind(null,i.onload),u&&document.head.appendChild(i)}}}(),t.r=function(e){"undefined"!==typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},t.nmd=function(e){return e.paths=[],e.children||(e.children=[]),e},t.p="/",function(){var e={577:0};t.f.j=function(n,r){var o=t.o(e,n)?e[n]:void 0;if(0!==o)if(o)r.push(o[2]);else if(577!=n){var f=new Promise((function(t,r){o=e[n]=[t,r]}));r.push(o[2]=f);var i=t.p+t.u(n),u=new Error;t.l(i,(function(r){if(t.o(e,n)&&(0!==(o=e[n])&&(e[n]=void 0),o)){var f=r&&("load"===r.type?"missing":r.type),i=r&&r.target&&r.target.src;u.message="Loading chunk "+n+" failed.\n("+f+": "+i+")",u.name="ChunkLoadError",u.type=f,u.request=i,o[1](u)}}),"chunk-"+n,n)}else e[n]=0},t.O.j=function(n){return 0===e[n]};var n=funct

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": [
    "Email address"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Hoxhunt"
  ]
}

```json{  "legit_domain": "hoxhunt.com",  "classification": "known",  "reasons": [    "The URL 'auth.hoxhunt.com' is a subdomain of 'hoxhunt.com', which matches the brand name 'Hoxhunt'.",    "Hoxhunt is a known brand in cybersecurity training and awareness.",    "The domain does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions.",    "The use of a subdomain 'auth' is common for authentication services, which aligns with the input field for 'Email address'."  ],  "riskscore": 2}

URL: auth.hoxhunt.com
			Brands: Hoxhunt
			Input Fields: Email address